IVD Cybersecurity in the QMSR Era: What FDA's Warning Letters Are Signaling

The Association of Medical Diagnostics Manufacturers (AMDM) recently held its 2026 Focus Meeting, two days of regulatory updates for the IVD and diagnostics community. Cybersecurity got its own session this year, and our VP of Regulatory Strategy, Naomi Schwartz, opened it. Before Medcrypt, Naomi spent six-plus years as a premarket reviewer in CDRH's in vitro diagnostics office (OHT7).

AMDM keeps its presentations for attendees, so we won't be sharing slides here. But the message is worth passing along: FDA is asking IVD makers sharper cybersecurity questions, and inspectors have new tools to ask them.

Are IVDs "cyber devices" under Section 524B?

Often, yes. A cyber device is any device with software, the ability to connect to a network, and characteristics that could be vulnerable to cybersecurity threats. The ability to connect is what counts, not the intent. Even a standalone lab instrument with a USB port can qualify.

Devices submitted after March 29, 2023 must comply with 524B. Older devices aren't off the hook: Naomi pointed to FDA's Section 518(b) "repair, replace or refund" authority as a risk for legacy products that fall short of state-of-the-art design. And any substantial change to a legacy device brings it under 524B, along with all the documentation that implies.

How has FDA's inspection approach changed?

FDA's inspection playbook has moved from the 1999 QSIT guide to the 2026 QMSR Compliance Program Manual. The new manual explicitly pulls in Section 524B and assumes continuous, total-product-lifecycle risk management.

A few practical consequences Naomi called out:

• Inspectors are trained to the compliance program manual, not just ISO 13485. They arrive knowing what triggers enforcement and what to ask.
• Management review and internal audits are now in scope. Leadership is expected to be actively engaged in cybersecurity risk.
• Expect Form 483 citations specifically for risk management.
• FDA is using LLMs to check consistency across your documents. If one SOP says you do A, B and C and another says B, C and G, expect the question.

Why IVD cybersecurity can't live in a silo

Risk management touches nearly every element of the QMSR, and Section 524B(b)(2) requires processes that tie cybersecurity into the rest of your quality system. Failing to meet 524B is a prohibited act under Section 301(q). As Naomi put it, cybersecurity isn't an island; it shouldn't even be a peninsula. If your security work is disconnected from complaint handling, CAPA, supplier controls and design, that disconnect is itself the finding.

What triggers a directed inspection?

Usually a postmarket signal or a whistleblower complaint. FDA protects its sources, so the questions may come sideways: a request for manufacturing audit logs, for instance, when the real concern is tampering on a connected production line.

For IVD makers, the MDR signal matters most. A lack of MDRs is not evidence of a lack of problems. FDA compares reporting rates across companies in the same product code, and an outlier can read as a missing MDR program. Fragmented complaint categories that dilute a signal were cited in a recent OHT7 warning letter.

The lab ecosystem problem

Many IVDs connect to LIS and EHRs over older, insecure HL7 implementations. You can design a secure instrument and still have to downgrade it for backward compatibility with the systems it plugs into. Naomi's ask: more manufacturers pushing security requirements into interoperability standards.

Elsewhere on the agenda

• Securing the whole test system. Doug Shaw of Doug Shaw Consulting said FDA reviews the entire test system, including middleware, off-the-shelf software and LIMS. It wants a complete SBOM, risk scored on exploitability rather than probability, and a recent pentest on the final build. In one review of an off-the-shelf LIMS, his team found more than 4,000 known vulnerabilities.
• QMSR enforcement is starting to show up. Allyson Mullen of Hyman, Phelps & McNamara noted that the first QMSR warning letters focus on risk management, including feeding postmarket data back into it.
• AI in postmarket surveillance. Colleen Watson of Thermo Fisher described FDA's framing shifting from "human in the loop" to "human accountable."

A quick self-check for IVD teams

1. Is cybersecurity connected to the rest of your QMS? Look at complaint handling, CAPA, supplier controls and management review.
2. Would your documents survive a consistency check? Assume FDA will compare your SOPs against each other and against your submission.
3. Do your MDR and complaint data make sense next to your peers'? A low reporting rate is a question, not a reassurance.
4. Do you have a plan for legacy products? Know which devices fall under 524B, and what state-of-the-art looks like for the ones that don't.
5. Does leadership see cybersecurity risk? Management review is now fair game.

FAQ

Do IVDs need to comply with FDA Section 524B?

Yes, if the device was submitted after March 29, 2023 and meets the cyber device definition: software, the ability to connect to a network, and potential vulnerability to cybersecurity threats.

What is the QMSR Compliance Program Manual?

It's FDA's 2026 inspection program for the Quality Management System Regulation. It replaces the 1999 QSIT guide and explicitly incorporates Section 524B for cyber devices.

Can FDA inspect internal audits under the QMSR?

Yes. Internal audit and management review records are now eligible for inspection, including how they address cybersecurity risk.

Thanks to AMDM for the invitation and for a well-run meeting. If you'd like to talk through any of this, from gap assessments to threat modeling to postmarket vulnerability management, get in touch with our team.