Recently, two key regulatory updates have significantly altered the environment of protection for medical device companies. The FDA’s Section 524B cybersecurity requirements, governing connected devices’ market presence, and the Quality Management System Regulation, effective February 2, 2026, have revised quality system rules underlying all devices produced by a company.
What The Two Changes Actually Require
Many discussions about these two regulatory updates focus solely on their compliance aspects, assuming they only affect internal regulatory and quality teams. However, they fundamentally alter the risk profile for device manufacturers, impacting legal liability, contractual obligations, and insurance coverage. A company might meet all regulatory standards on paper yet still face significant unprotected risks stemming from these new expectations.
Section 524B of the Federal Food, Drug, and Cosmetic Act covers cyber-enabled devices, defined broadly as any device containing software, capable of internet connectivity, and susceptible to cybersecurity risks. Manufacturers must submit documentation proving they can continuously monitor, detect, and address vulnerabilities after the product launches, including a structured disclosure process. The submission must verify that both the device and connected systems meet security standards and that regular updates and patches—backed by a software bill of materials—are provided. The FDA reserves the right to reject submissions that fail to meet these criteria.
Continuous Postmarket Responsibilities
The key term here is postmarket. Unlike a one-time approval, 524B imposes a lasting responsibility to track and address vulnerabilities throughout a device’s operational life. This continuous obligation means a company’s risk doesn’t vanish after production—it extends as long as the device remains in use.
Related Post: Medical Device Makers Weave Cybersecurity Into Design Phase
It aligns FDA’s quality system requirements with the international standard ISO 13485 and folds risk management more deeply into the quality system. In practice it changes documentation, terminology, and the expectations around how a company demonstrates that its processes are controlled. For companies already certified to ISO 13485, much of the work is reconciliation. For companies that built their quality system around the older regulation, it is a genuine transition, and the transition itself is a moment when gaps surface.
Impact on Product Liability and Recalls
These regulations influence four key risk areas for device makers. Cybersecurity is one: a compromised connected device doesn’t trigger a simple, single-type claim. For example, a hospital monitoring device with a security flaw could lead to patient harm, sparking a product liability lawsuit, a cyber-related data breach claim, and regulatory penalties tied to 524B’s postmarket requirements. The stakes rise further if a company ignored a known vulnerability, such cases face harsher legal consequences than those with documented response plans, with internal records playing a critical role in liability determinations.
QMSR strengthens the link between quality system failures and product liability. When a defect is alleged, a company’s quality records become its primary defense. Robust documentation, traceability, and risk management make claims easier to contest, while weak systems make them costlier to resolve. Under QMSR, the quality system isn’t just a compliance checkbox; it’s evidence that can determine how a claim is settled.
Both updates increase the likelihood of field actions and alter their nature. A cybersecurity flaw may demand corrective measures resembling a recall, even without patient harm. Quality system issues could force broad product-line corrections. Recall expenses, including notifications, retrievals, and operational disruptions, represent a distinct risk category, often inadequately covered or excluded from insurance plans.
When regulatory or quality failures harm a company, executives may face claims of negligence in risk oversight. Directors and officers’ liability grows as scrutiny intensifies, and these changes amplify that exposure. For venture-backed firms, this risk extends to investors and board members beyond the founders.
Related Post: AI Integration Risks in Medical Device Development
Insurance Gaps and Contractual Risks
A persistent issue is the disconnect between evolving risks and outdated insurance policies. Many cyber policies focus on data breaches and network incidents, excluding bodily injury claims. A device causing patient harm through a security breach might fall between a cyber policy (which excludes injury) and a product liability policy (not designed for software risks). Companies often discover these coverage gaps at the worst possible time.
Underwriting Is Catching Up To Both Changes
Insurers are now adapting to these changes, asking more targeted questions during reviews. Device makers should prepare for inquiries about their software bill of materials, postmarket vulnerability management, coordinated disclosure protocols, patch schedules, and incident response plans. Expect questions on ISO 13485 alignment, risk documentation, recall preparedness, and past field actions. Strong responses improve coverage terms, while weak answers may result in higher premiums or limited protection.
Contracts Sit Alongside The Underwriting
Contracts sit alongside the underwriting. Hospital agreements, distributor agreements, and contract manufacturing relationships almost always specify insurance requirements, and those requirements are written by parties who are paying attention to the same regulatory changes. A company that has not updated its program to reflect 524B and QMSR can find that its coverage no longer satisfies the insurance schedule its customers require. Reading those requirements before signing, rather than after a claim, is where a company keeps its leverage.
Section 524B and QMSR are compliance obligations, but they are also risk events. They changed what a device company is exposed to, and a program that was adequate a year ago may no longer match the risk. The work is not complicated, but it is specific. Read the policies against the new baseline, close the gaps between them, confirm the coverage still satisfies your contracts, and make sure the quality and security evidence a claim would depend on actually exists. The companies that do this before a renewal are in a far stronger position than the ones that discover the gaps during a claim.
