Guideline compiled under the FY2025 Medical Device Cybersecurity Promotion Project and circulated to industry by MHLW notice for reference. It covers all software contained in a medical device and sets out a stepwise adoption path according to organizational maturity: Stage 1 establishes the capability to create, update and change-manage SBOMs based on the NTIA minimum elements; Stage 2 integrates SBOMs into existing QMS and post-market safety processes, including vulnerability, license and EOL/EOS management, for lifecycle risk management. SPDX 2.2 or later and CycloneDX 1.6 or later are recommended for new adoption; where SWID is already in use, parallel use or conversion may be considered. As the disclosure baseline set by the guideline, manufacturers should be able to provide SBOMs to healthcare facilities, mainly at installation and upon significant software changes, and present them on request at least throughout the product support period. Intended readers span software development, quality assurance, regulatory affairs, PSIRT/information security and field service, as a shared cross-functional reference. Article 12(3) of the Essential Principles and FD&C Act Section 524B are cited as regulatory background.

MHLW notice continuing the pilot of prioritized review for software as a medical device (SaMD), conducted since FY2022 following a June 2022 Cabinet decision on the New Capitalism action plan, by setting designation requirements and accepting applications on a rolling basis. Eligible products are SaMD and physical medical devices with SaMD-equivalent program functions; products seeking approval under the rebalancing notice or the two-stage approval notice are excluded. All three requirements must be met: (1) innovativeness of the treatment, diagnostic or preventive method (programs that deliver content equivalent to clinical patient guidance to prompt behavior change at home are, in principle, not considered innovative); (2) medical usefulness for the target disease; and (3) intent and capability to file in Japan first or simultaneously (within three months), using the PMDA SAKIGAKE comprehensive evaluation consultation. Designated products receive priority consultation, priority review under Article 23-2-5, paragraph 10 of the PMD Act, coordination by a concierge, and eligibility for the support program for consultation and applications for innovative medical devices, with the aim of shortening the review period to six months or less after adequate pre-submission evaluation. The procedure runs from registration, hearing and preliminary screening to formal application and PMDA evaluation, with results reported to the Pharmaceutical Affairs Council and then published. Conditions for revoking designation are also specified.

Q&A (Part 3) issued by the Japanese Ministry of Health, Labour and Welfare (MHLW), clarifying when manufacturing/marketing and sales activities are deemed to begin for home-use medical device software (SaMD) distributed via app stores or download servers. Manufacturing/marketing is deemed to start when the software is made available on a download server or app store, while sales is deemed to start when the end user is able to use it. Issued 25 March 2026 in response to a growing number of approved home-use device programs. It also confirms that a company acting as both marketing authorization holder and seller needs both business licenses (or notifications), and that legally required labeling information may be provided via easily accessible electronic records rather than a printed insert, provided it is given to the user before use.

Caution alert (administrative notice, 19 March 2026) issued by the Japanese Ministry of Health, Labour and Welfare (MHLW) in response to a rise in ransomware attacks that exploit VPN equipment and other network devices connected to medical devices. It calls on marketing authorization holders to (1) confirm, under maintenance contracts with healthcare facilities, who is responsible for managing attached network equipment such as VPN devices, (2) check that firmware is up to date and identify any devices that are no longer supported, and (3) strengthen security by informing facilities about unsupported devices and applying stronger authentication and access control.

Notice (MHLW-PFSB-MDED-0306-No.1, 6 March 2026) issued by the Medical Device Evaluation Division setting out procedures for the registration and operation of Registered Conformity Assessment Bodies (RCABs) for medical devices and in vitro diagnostics in Japan. It principally implements a new succession-of-status scheme introduced by the 2025 amendment to the PMD Act (Act No. 37 of 2025), covering business transfers, inheritance, mergers, and demergers of RCABs. The notice also covers registration application procedures and the registration license tax (JPY 90,000), notification requirements for suspension or discontinuation of business (at least two weeks before the planned date), operating rules aligned with ISO/IEC 17021-1 and 17065, restrictions on consulting activities that could compromise confidentiality or impartiality, and detailed succession procedures beginning with prior consultation six months in advance. The notice takes effect on 1 May 2026.

Notice (MHLW-PFSB-MDED-0306-No.4, 6 March 2026) establishing implementation standards for a new witness inspection scheme for Registered Conformity Assessment Bodies (RCABs) and partially revising the existing on-site inspection standards. The witness inspection scheme, introduced under the 2025 amendment to the PMD Act (Act No. 37 of 2025), aims to maintain and standardize the assessment capabilities of RCABs. Under it, MHLW and PMDA staff observe an RCAB conformity assessment roughly once a year, with at least two officials attending and with the consent of the assessed facility, carried out in a manner intended not to affect the assessment itself. The revised on-site inspection standards separate out the witness inspection procedure and newly require RCABs to make efforts so that the assessed facility understands and agrees to accept a witness inspection. The notice takes effect on 1 May 2026.

Notice (MHLW-PSEHB-PSD-0210-No.3, 10 February 2026) partially revising the attachment to the 2020 notice on Reporting of Medical Device Defects and Other Incidents (No. 0131-1, 31 January 2020). Issued in connection with the 2025 amendment to the PMD Act (Act No. 37 of 2025) and the related 2025 ministerial ordinance (Ordinance No. 117 of 2025), the revision removes known deaths or serious cases involving foreign medical devices and foreign regenerative medicine products from the scope of the 30-day reporting requirement, while newly requiring 15-day reporting for defects in such foreign products that are not readily foreseeable, whose occurrence trend is unclear, or that suggest a risk of harm to public health and hygiene, along with other technical revisions. The notice takes effect on 1 May 2026.

Notice on post-market vulnerability management framework. Requires manufacturers/distributors to integrate vulnerability monitoring, evaluation, response, and disclosure processes (including SBOM utilization) into quality management systems. Mandates establishment of PSIRT structure, clear vulnerability notification policies to customers, and practical end-of-life support management procedures.

Expanded Q&A set on application and conformance assessment of Essential Principles Article 12(3). Provides guidance on system architecture diagram formats, post-transition application handling, third-party testing utilization, SBOM documentation scope, and legacy product compliance strategies based on practical implementation experience.

Notice clarifying handling of cybersecurity events in adverse event/serious adverse event reporting systems. Addresses reporting applicability for patient harm from cyber attacks or vulnerability exploitation, decision-making flowcharts, and manufacturer response procedures. Serves as foundational regulatory documentation for post-market cybersecurity management.