Standards, Guidance & Notices
Showing 1–10 of 134
FDA
CDRH
CDRH
FDA-2026-N-9505
Robotically-Assisted Surgical Devices - Premarket Submissions (Draft Guidance)
On September 25, 2026, FDA issued the draft guidance "Robotically-Assisted Surgical Devices - Premarket Submissions" (document number GUI01500081; Docket No. FDA-2026-N-9505). It covers teleoperated, software-controlled robotically-assisted surgical devices (RASDs) that assist qualified practitioners with open, minimally invasive or endoluminal procedures, and sets out recommendations on non-clinical testing, clinical data and labeling. Topics include substantial equivalence comparisons for 510(k) submissions, software verification and validation, reliability testing, cybersecurity, wireless coexistence (AAMI TIR69), human factors, and reprocessing validation. For cybersecurity, a RASD that meets the definition of a cyber device under section 524B(c) of the FD&C Act must meet the section 524B(b) requirements; the draft additionally recommends threat and vulnerability analysis and penetration testing that covers back-end infrastructure and remote access, including a simulated compromised hospital network. Remotely teleoperated and autonomous RASDs, and RASDs for placing or using interventional devices such as catheters, are out of scope; manufacturers of such devices are encouraged to use the Q-Submission Program. Comments are due within 60 days of the Federal Register notice, i.e. by November 24, 2026. Separately, CDRH will hold a public workshop on December 2-3, 2026 (in person and online) on benefit-risk evaluation of robotic devices with autonomous or remote teleoperation capabilities.
Published: 2026-09-25
EU
MDCG
MDCG
MDCG 2020-16 rev.5
Guidance on Classification Rules for in vitro Diagnostic Medical Devices under Regulation (EU) 2017/746
Revision 5 (September 2026) of the MDCG guidance on interpreting the classification rules in Annex VIII of the IVDR (Regulation (EU) 2017/746). It sets out the principles for classifying IVDs into classes A to D based on intended purpose and inherent risk, and provides the rationale and non-exhaustive examples for each of Rules 1 to 7. Software that drives or influences the use of a device falls within the same class as the device, while software independent of any other device is classified in its own right, with reference to MDCG 2019-11. Annexes provide examples of classifying IVDs used in combination and a flowchart to help determine whether an IVD is a companion diagnostic. Revision 5 clarifies the rationale of Rule 7 (controls without an assigned value) and revises its examples. The guidance is not legally binding.
Published: 2026-09-01
MHLW
Notice
Notice
MHLW-PFSB-MDED-0825-No.1
Guideline on the Introduction and Operation of SBOM for Medical Devices (1st Edition)
Guideline compiled under the FY2025 Medical Device Cybersecurity Promotion Project and circulated to industry by MHLW notice for reference. It covers all software contained in a medical device and sets out a stepwise adoption path according to organizational maturity: Stage 1 establishes the capability to create, update and change-manage SBOMs based on the NTIA minimum elements; Stage 2 integrates SBOMs into existing QMS and post-market safety processes, including vulnerability, license and EOL/EOS management, for lifecycle risk management. SPDX 2.2 or later and CycloneDX 1.6 or later are recommended for new adoption; where SWID is already in use, parallel use or conversion may be considered. As the disclosure baseline set by the guideline, manufacturers should be able to provide SBOMs to healthcare facilities, mainly at installation and upon significant software changes, and present them on request at least throughout the product support period. Intended readers span software development, quality assurance, regulatory affairs, PSIRT/information security and field service, as a shared cross-functional reference. Article 12(3) of the Essential Principles and FD&C Act Section 524B are cited as regulatory background.
Published: 2026-08-25
FDA
CDRH
CDRH
fda_20260819_Considerations_Regulation_Gene
Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback
A discussion paper and request for feedback from the FDA Digital Health Center of Excellence (DHCoE) within CDRH on the regulation of generative AI-enabled medical devices. The paper notes that these devices may carry risks that differ from those of traditional software and AI-enabled devices, and aims to engage stakeholders on the associated challenges. It covers four topics: (1) considerations for assessing risk, (2) considerations for premarket evaluation, (3) postmarket monitoring, and (4) other relevant topics. The paper is for discussion purposes only: it is neither draft nor final guidance and does not communicate proposed or final regulatory expectations of CDRH. Feedback from device manufacturers, clinicians, researchers, the public, and other interested parties is requested via docket FDA-2026-N-7874 on Regulations.gov, with a submission deadline of October 19, 2026. Respondents need not answer every question and may address only the topics relevant to their expertise.
Published: 2026-08-19
NIST
CSF 2.0
CSF 2.0
NIST SP 1353 (Initial Public Draft)
NIST Cybersecurity Framework 2.0: Quick-Start Guide for Using Artificial Intelligence (AI) for CSF Analysis and Reporting
Illustrates structured AI prompts for CSF 2.0 policy review, Current State Profile, and Target State Profile drafting; comments due Oct 15, 2026.
Published: 2026-08-19
IMDRF
IMDRF/SaMD WG/N90 FINAL:2026
Essential Principles and Content of Predetermined Change Control Plans
Final document of the IMDRF Software as a Medical Device Working Group setting out high-level principles for Predetermined Change Control Plans (PCCPs), through which manufacturers can seek authorization in advance for certain planned modifications to medical device software (as defined in N81) that remain within the original intended use or intended purpose. It identifies five essential principles (focused and bounded, risk-based, evidence-based, transparent, and TPLC perspective) and three interconnected elements: Description of Changes, Change Plan (performance evaluation methods with pre-specified acceptance criteria, and update procedures including labelling and communication to users), and Impact Assessment (individual and cumulative benefits, risks and mitigations). Changes are expected to be implemented under the quality management system of the manufacturer, in line with standards such as IEC 62304. It also discusses benefits and challenges, including more complex submissions and differing adoption across jurisdictions. The document aims to support international convergence and does not establish regulatory requirements or serve as regulation or guidance in any jurisdiction.
Published: 2026-08-06
ISO
ISO 81001-1 Ed.2
ISO 81001-1 Ed.2 - Health Software and Health IT Systems - Safety, Effectiveness and Security - Part 1: Principles and Concepts
ISO 81001-1 Edition 2 establishes fundamental principles and conceptual frameworks for ensuring safety, effectiveness, and security of health software and health information technology systems. Currently in Committee Draft (CD) stage under ISO/TC 210/WG1, the document is undergoing international standardization review with a voting deadline of March 27, 2026. This standard serves as a foundational framework supporting medical device software regulation globally, providing overarching principles that align with and complement harmonized standards including IEC 62304, ISO 14971, and others. The document addresses the integrated governance of safety, effectiveness, and cybersecurity across the health software lifecycle. Manufacturers should reference this standard to establish consistent quality management approaches and risk governance frameworks applicable to health software and IT systems. Edition 2 reflects evolving regulatory expectations regarding artificial intelligence, machine learning, and connected health technologies in the medical device ecosystem.
Published: 2026-08-05
MDSAP
MDSAP AU P0002.011
MDSAP Audit Approach (MDSAP AU P0002.011)
Revision 11 of the MDSAP Audit Approach (document number MDSAP AU P0002.011, revision date 3 August 2026), the audit procedure of the Medical Device Single Audit Program in which the regulatory authorities of the United States, Australia, Brazil, Canada and Japan participate. Main changes from version 010: (1) Cybersecurity. Measurement, Analysis and Improvement Task 12 adds provisions on post-market feedback, including systematic collection of vulnerability reports, security incident data and threat intelligence, used as input to risk management, improvement and design change control. Design and Development Tasks 7 and 12 add US FDA cybersecurity requirements, and Task 7 adds RDC ANVISA 848/2024 Article 1 to the Brazilian requirements. For the FDA, auditors verify that cyber devices cleared or approved after 29 March 2023 meet section 524B(b) of the FD&C Act: a plan to monitor and address post-market vulnerabilities including coordinated vulnerability disclosure, processes and post-market patches to keep the device cybersecure, and a maintained software bill of materials. (2) The predetermined change control plan (PCCP) text in Device Marketing Authorization and Facility Registration Task 3 no longer refers specifically to AI-enabled devices. (3) Other changes include refocusing Management Task 7 on management oversight of risk management across the product life cycle, and additions on UDI for Australia (TGA) and the FDA.
Published: 2026-08-03
EU
Law
Law
Regulation (EU) 2026/1744
Regulation (EU) 2026/1744 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)
Regulation simplifying the implementation of the harmonised rules on artificial intelligence (Digital Omnibus on AI). It amends the AI Act (Regulation (EU) 2024/1689) together with Regulations (EU) 2018/1139 and (EU) 2023/1230. Dated 8 July 2026 and published in the Official Journal on 24 July 2026, it enters into force on the third day following publication. The date of application of Sections 1 to 3 of Chapter III of the AI Act is set to 2 December 2027 for AI systems classified as high-risk under Article 6(2) and Annex III, and to 2 August 2028 for those classified as high-risk under Article 6(1) and Annex I, which covers AI embedded in products such as medical devices.
Published: 2026-07-24
NIST
SP
SP
SP 800-213 Rev. 1
IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements
Organizations increasingly use Internet of Things (IoT) products for the mission benefits they can offer, but care must be taken in the acquisition and implementation of this equipment. Understanding that an IoT product is a system element facilitates an understanding of how the IoT product must be considered in the risk management process. The acquisition and integration of an IoT product into an information system may alter the system’s risk assessment based on new risks introduced by the product. An updated risk assessment may require additional or new controls to be selected and implemented in the system. The guidelines in this publication focus on establishing product cybersecurity requirements to support security controls. This publication provides general considerations of how IoT products may impact an information system’s risk assessment and subsequent allocation of controls that may be necessary. Readers are encouraged to reference SP 800-30, Revision 1, Guide for
Published: 2026-06-24