Two significant regulatory changes, Section 524B and the Quality Management System Regulation (QMSR), have recently come into effect, altering the medical device risk environment. The FDA’s Section 524B cybersecurity requirements, which apply to connected devices, now govern how these devices reach and stay on the market. The QMSR, which took effect on February 2, 2026, rewrites the quality system rules that underlie every device a company manufactures.
These changes have a profound impact on medical device companies, affecting not only their compliance but also their liability, contracts, and insurance programs. A company can be fully compliant on paper and still carry uninsured exposure due to the new baseline created by these changes.
Understanding the Changes
Section 524B of the Federal Food, Drug, and Cosmetic Act applies to cyber devices, which are defined as devices that include software, can connect to the internet, and have technological characteristics that could be vulnerable to cybersecurity threats. For these devices, a premarket submission must show a plan to monitor, identify, and address postmarket vulnerabilities, including a coordinated disclosure process.
The QMSR, on the other hand, aligns FDA’s quality system requirements with the international standard ISO 13485 and folds risk management more deeply into the quality system. This change affects documentation, terminology, and the expectations around how a company demonstrates that its processes are controlled.
The two changes touch three kinds of exposure that a device maker already carries: cybersecurity exposure, product liability exposure, and recall exposure. A connected device that is compromised can trigger a product liability claim, a cyber claim, and a regulatory response tied to the postmarket obligations under 524B.
A company that knew about a vulnerability and did not act on it faces a very different claim than one that followed a documented response process. The paper trail becomes part of the liability picture, and strong process control, traceability, and risk documentation make a claim defensible.
Related Post: Reverse Engineering Used in Medical Devices
Exposure and Insurance
Many device makers are underinsured against the new baseline created by these changes. Cyber policies often exclude bodily injury, and product liability policies may not address software, firmware, and post-market updates. Recall coverage is frequently absent or set at a limit that reflects an earlier and smaller product footprint.
Underwriters are now asking more specific questions about a device maker’s software bill of materials, postmarket vulnerability management process, and quality system alignment with ISO 13485. Companies that can answer these questions well tend to place coverage on better terms, while those that cannot answer them are harder to place and pay more for narrower coverage.
Contracts play a significant role, as hospital agreements, distributor agreements, and contract manufacturing relationships often specify insurance requirements.
As device makers prepare for their next coverage review, they should map their connected devices against the 524B definition, read their cyber and product liability policies side by side, and confirm that their quality system documentation reflects the QMSR transition. They should also review the retroactive date and claims-made terms to ensure that prior acts are not stranded outside their current policy.
The work is not complicated, but it is specific, and companies that do this before a renewal are in a far stronger position than those that discover the gaps during a claim. The FDA’s authority to refuse submissions that do not meet the requirements of Section 524B is a significant factor in this process, as it creates an ongoing obligation to watch for vulnerabilities and respond to them for as long as the device is in use.
Preparing for the New Reality
Device makers can take steps to prepare for the new reality created by Section 524B and QMSR. They should review their insurance policies and contracts to ensure they are adequate and up-to-date.
