On September 25, 2026, FDA issued the draft guidance "Robotically-Assisted Surgical Devices - Premarket Submissions" (document number GUI01500081; Docket No. FDA-2026-N-9505). It covers teleoperated, software-controlled robotically-assisted surgical devices (RASDs) that assist qualified practitioners with open, minimally invasive or endoluminal procedures, and sets out recommendations on non-clinical testing, clinical data and labeling. Topics include substantial equivalence comparisons for 510(k) submissions, software verification and validation, reliability testing, cybersecurity, wireless coexistence (AAMI TIR69), human factors, and reprocessing validation. For cybersecurity, a RASD that meets the definition of a cyber device under section 524B(c) of the FD&C Act must meet the section 524B(b) requirements; the draft additionally recommends threat and vulnerability analysis and penetration testing that covers back-end infrastructure and remote access, including a simulated compromised hospital network. Remotely teleoperated and autonomous RASDs, and RASDs for placing or using interventional devices such as catheters, are out of scope; manufacturers of such devices are encouraged to use the Q-Submission Program. Comments are due within 60 days of the Federal Register notice, i.e. by November 24, 2026. Separately, CDRH will hold a public workshop on December 2-3, 2026 (in person and online) on benefit-risk evaluation of robotic devices with autonomous or remote teleoperation capabilities.

A discussion paper and request for feedback from the FDA Digital Health Center of Excellence (DHCoE) within CDRH on the regulation of generative AI-enabled medical devices. The paper notes that these devices may carry risks that differ from those of traditional software and AI-enabled devices, and aims to engage stakeholders on the associated challenges. It covers four topics: (1) considerations for assessing risk, (2) considerations for premarket evaluation, (3) postmarket monitoring, and (4) other relevant topics. The paper is for discussion purposes only: it is neither draft nor final guidance and does not communicate proposed or final regulatory expectations of CDRH. Feedback from device manufacturers, clinicians, researchers, the public, and other interested parties is requested via docket FDA-2026-N-7874 on Regulations.gov, with a submission deadline of October 19, 2026. Respondents need not answer every question and may address only the topics relevant to their expertise.

Final guidance issued by FDA CDRH on May 29, 2026 (finalizing the December 2022 draft) that provides a risk-based framework for the human factors information to include in 510(k), De Novo, PMA and HDE submissions; combination products are not addressed. Submitters determine one HF Submission Category per submission using a flowchart based on the use-related risk analysis (URRA): whether the device is a modification; whether the user interface, intended users, uses, use environments, training or labeling change; whether there are critical tasks (new or impacted, for modified devices); and whether human factors validation data are needed given the user interface history of use, its complexity and the adequacy of existing risk controls. Category 1 calls for a conclusion and high-level summary; Category 2 adds a rationale and descriptions of users, uses, environments, training, the user interface and known use problems; Category 3 calls for a full HFE/UE report including the URRA, critical tasks and human factors validation testing. Worked examples are included; for instance, a change to a computer-assisted detection algorithm with no user interface change falls into Category 1. The guidance is a companion to Applying Human Factors and Usability Engineering to Medical Devices. FDA generally does not anticipate the newly recommended information in submissions pending at publication or received before August 1, 2026. Docket FDA-2015-D-4599.

FDA CDRH issued final guidance on the collection and submission of patient preference information (PPI). It includes recommendations on study design, validation, and the integration of PPI across the total product life cycle, and provides a roadmap for sponsors incorporating the patient perspective into regulatory submissions.

Under Section 524B of the FD&C Act, added by the 2023 Consolidated Appropriations Act, this guidance requires SBOM submission, a vulnerability disclosure process, and coordinated vulnerability disclosure (CVD) planning as part of premarket review. The title change from "Quality System" to "Quality Management System" reflects FDA's move from the legacy QSR to the ISO 13485-based QMSR. IEC 81001-5-1 and AAMI TIR57 appear as two of several optional frameworks manufacturers may draw on for secure product development — alongside JSP2 and ISA/IEC 62443-4-1 — rather than as standards the guidance formally aligns with.

FDA final guidance (Feb 2026) on risk-based assurance for software used in medical device production and quality management systems. Supersedes the September 24, 2025 version, with the title updated from "Quality System Software" to "Quality Management System Software" to align with the QMSR (21 CFR Part 820 / ISO 13485:2016 harmonization effective February 2, 2026). Replaces Section 6 of the 2002 GPSV. Does NOT apply to SaMD/SiMD.

FDA final guidance (issued January 6, 2026, reissued January 29, 2026, superseding the 2022 version) setting out the approach to clinical decision support (CDS) software functions excluded from the device definition under the criteria of section 520(o)(1)(E) of the FD&C Act. It clarifies the distinction between device CDS and non-device CDS. Where only one recommendation is clinically appropriate, FDA intends to exercise enforcement discretion for CDS that outputs that single recommendation, provided the other non-device CDS criteria are met.

FDA draft guidance (January 2025) on lifecycle management and marketing submissions for AI/ML-enabled SaMD. It provides specific recommendations on training data management, performance monitoring, and change management (PCCP: Predetermined Change Control Plan), including recommendations on handling adaptive algorithms and on describing postmarket performance monitoring plans. Still at the draft stage, pending finalization.

FDA final guidance (December 2024) on Predetermined Change Control Plans (PCCPs), which streamline change management for AI-enabled medical devices. Modifications described in an authorized PCCP can be implemented without a new premarket submission for each change. It specifies the three elements a PCCP should include: a description of modifications, a modification protocol, and an impact assessment. It puts into practice the statutory framework of section 515C of the FD&C Act, added by FDORA.

The FDA quality system regulation for medical device manufacturing. Under the February 2024 final rule, it incorporates ISO 13485:2016 by reference and was renamed the Quality Management System Regulation (QMSR), effective February 2, 2026. It specifies CGMP requirements across manufacturing, including design and development controls (equivalent to former 820.30). The foundational regulation for quality system compliance in simultaneous Japan-US submissions.