Cyber devices must include an SBOM, a vulnerability management plan and evidence of secure design in every premarket submission, and FDA's final guidance from June 2025 explains what reviewers expect. On February 2, 2026 the QMSR replaced the old Quality System Regulation with ISO 13485 by reference. What that means for software and cloud components running on AWS.
Software as a medical device, and devices with a cloud backend, now face two sets of requirements that touch infrastructure directly: section 524B of the FD&C Act for cyber devices, and the Quality Management System Regulation (QMSR).
A cyber device is one that includes software, can connect to the internet, and could be vulnerable to cyber threats. Anyone submitting a 510(k), PMA, De Novo, PDP or HDE for one must provide:
A plan to monitor, identify and address postmarket vulnerabilities, including coordinated disclosure.
Processes that provide reasonable assurance the device and related systems are cybersecure, with updates and patches on a regular cycle and out of cycle for critical issues.
A software bill of materials covering commercial, open-source and off-the-shelf components.
FDA's final guidance, "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions", issued June 27, 2025, sets out what reviewers expect: threat modelling, security architecture views, testing evidence, and the SBOM with support status for each component.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Since February 2, 2026, 21 CFR Part 820 incorporates ISO 13485:2016 by reference, and FDA inspects against it. Companies already certified to ISO 13485 have less to change; those built around the old Quality System Regulation have a gap analysis to do. Software development, configuration management and supplier controls all sit inside the quality system, and that includes cloud infrastructure.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
EKS for HIPAA in 2026: What the BAA Covers and What You Still Have to Configure
EKS, ECR, Fargate, EBS, EFS and GuardDuty are on AWS's HIPAA eligible services list, so you can run workloads with PHI on Kubernetes under a BAA. Eligibility is not compliance: encryption, access, isolation, audit logs and what lands in your logs are yours. A control-by-control checklist, with a diagram.
Read
HIPAA on AWS in 2026: The BAA, the Eligible Services List, and What You Still Own
Signing AWS's Business Associate Addendum takes a few clicks in AWS Artifact. It covers only HIPAA-eligible services, and it leaves most of the Security Rule with you. What the October 2026 eligible list includes (Bedrock, AgentCore, HealthLake, HealthScribe), the split of responsibilities, and why we build to the proposed Security Rule even though it is not final.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.