Standards, Guidance & Notices
Showing 51–60 of 134
NIST
SP
SP
SP 800-218A
Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile
This document augments the secure software development practices and tasks defined in Secure Software Development Framework (SSDF) version 1.1 by adding practices, tasks, recommendations, considerations, notes, and informative references that are specific to AI model development throughout the software development life cycle. These additions are documented in the form of an SSDF Community Profile to support Executive Order (EO) 14110, Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, which tasked NIST with “developing a companion resource to the [SSDF] to incorporate secure development practices for generative AI and for dual-use foundation models.” This Community Profile is intended to be useful to the producers of AI models, the producers of AI systems that use those models, and the acquirers of those AI systems. This Profile should be used in conjunction with NIST Special Publication (SP) 800-218, Secure Software Development Framework (SSDF) Version 1.1:
Published: 2024-07-26
EU
Law
Law
Regulation (EU) 2024/1689
Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act)
EU regulation establishing a risk-based framework for artificial intelligence, dated 13 June 2024 and published in the Official Journal on 12 July 2024. It sets out prohibited practices and requirements for high-risk AI systems. Medical device AI becomes high-risk where it is a safety component of a device, or is itself a device, and is subject to third-party conformity assessment by a notified body (MDCG 2025-6). Requirements for high-risk systems cover data governance, technical documentation, transparency, human oversight, and accuracy, robustness and cybersecurity; a single set of technical documentation is drawn up for the MDR or IVDR and the AI Act. Article 99 sets maximum fines of EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for breaches of operator obligations, whichever is higher. As amended by Regulation (EU) 2026/1744, the high-risk requirements apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I products, which include medical devices.
Published: 2024-07-12
IMDRF
IMDRF/GRRP WG/N47 FINAL:2024 (Edition 2)
Essential Principles of Safety and Performance of Medical Devices and IVD Medical Devices
Edition 2 of the IMDRF guidance providing harmonized Essential Principles of Safety and Performance: the fundamental design and manufacturing requirements a manufacturer is expected to meet so that a medical device or IVD medical device is safe and performs as intended throughout its life cycle. Section 5 sets out principles that apply to all medical devices including IVD medical devices, Section 6 those for medical devices other than IVD medical devices, and Section 7 those that apply only to IVD medical devices. Design and manufacturing activities should be under the control of the manufacturer's quality management system, and conformity with the applicable principles is demonstrated and assessed according to procedures designated by the regulatory authority. The document uses "should" to indicate recommendations and reserves "must" for unavoidable situations, including those mandated by regulation. For the content of labeling, it refers to IMDRF/GRRP WG/N52.
Published: 2024-04-26
NIST
CSWP
CSWP
CSWP 33
Product Development Cybersecurity Handbook: Concepts and Considerations for IoT Product Manufacturers
As interest in Internet of Things (IoT) technologies has grown, so have concerns and attention to cybersecurity of the newly network-connected products and services offered in many sectors, including energy services, water/waste-water services, automobiles, consumer electronics, and government. This Product Development Cybersecurity Handbook will describe concepts important to developing and deploying secure IoT products for any sector or use case, including discussion of IoT Product architecture, deployment, roles and cybersecurity perspectives. This publication extends and elaborates on NIST’s prior work related to development of IoT products. In addition to discussing the concepts, this publication also demonstrates their application and discusses how satisfaction of cybersecurity in IoT products can be approached.
Published: 2024-04-03
MHLW
Notice
Notice
MHLW-PFSB-MDED-0328-No.1
Guidance on Vulnerability Management to Ensure Cybersecurity of Medical Devices
Notice on post-market vulnerability management framework. Requires manufacturers/distributors to integrate vulnerability monitoring, evaluation, response, and disclosure processes (including SBOM utilization) into quality management systems. Mandates establishment of PSIRT structure, clear vulnerability notification policies to customers, and practical end-of-life support management procedures.
Published: 2024-03-28
NIST
CSWP
CSWP
CSWP 29
The NIST Cybersecurity Framework (CSF) 2.0
The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks. It offers a taxonomy of high-level cybersecurity outcomes that can be used by any organization — regardless of its size, sector, or maturity — to better understand, assess, prioritize, and communicate its cybersecurity efforts. The CSF does not prescribe how outcomes should be achieved. Rather, it links to online resources that provide additional guidance on practices and controls that could be used to achieve those outcomes. This document describes CSF 2.0, its components, and some of the many ways that it can be used.
Published: 2024-02-26
FDA
CDRH
CDRH
21 CFR Part 820
Quality Management System Regulation (QMSR) — 21 CFR Part 820
The FDA quality system regulation for medical device manufacturing. Under the February 2024 final rule, it incorporates ISO 13485:2016 by reference and was renamed the Quality Management System Regulation (QMSR), effective February 2, 2026. It specifies CGMP requirements across manufacturing, including design and development controls (equivalent to former 820.30). The foundational regulation for quality system compliance in simultaneous Japan-US submissions.
Published: 2024-02-02
MHLW
Notice
Notice
Admin-Notice-2024-01-31
Q&A on Cybersecurity of Medical Devices (2024 Version)
Expanded Q&A set on application and conformance assessment of Essential Principles Article 12(3). Provides guidance on system architecture diagram formats, post-transition application handling, third-party testing utilization, SBOM documentation scope, and legacy product compliance strategies based on practical implementation experience.
Published: 2024-01-31
JFMDA
Notice
Notice
jfmda_20240129_f5a055dd
English Translation of Cybersecurity and Usability Notification
Notice (29 January 2024) from the JFMDA Legislative Affairs Committee, Review-Related Subcommittee, announcing unofficial English translations, prepared by the PMDA Office of Medical Devices, of three MHLW notifications concerning medical device cybersecurity and usability: (1) Application of Article 12-3 of the Essential Principles for Medical Devices (PSEHB MDED Notification No. 0331-8, 31 March 2023); (2) Confirmation of compliance with Article 12-3 of the Essential Principles for Medical Devices (PSEHB MDED Notification No. 0523-1, 23 May 2023); and (3) Handling of the revised Japanese Industrial Standard (JIS) on usability engineering requirements for medical devices (PSEHB MDED and CND Notification No. 0930-1, 30 September 2022). The page notes that the translations are provided for reference only and that only the original Japanese texts have legal effect.
Published: 2024-01-29
MHLW
Notice
Notice
MHLW-PSEHB-PSD-0115-No.2
Fundamental Approach to Adverse Event Reporting Related to Medical Device Cybersecurity
Notice clarifying handling of cybersecurity events in adverse event/serious adverse event reporting systems. Addresses reporting applicability for patient harm from cyber attacks or vulnerability exploitation, decision-making flowcharts, and manufacturer response procedures. Serves as foundational regulatory documentation for post-market cybersecurity management.
Published: 2024-01-15