FDA’s 2027 guidance priorities: what medical device teams should prepare for

Standards and guidance update — 5 October 2026

Regulatory monitoring is about more than identifying new requirements. It also means recognising where expectations are heading early enough to prepare the people, processes and evidence needed to respond.

FDA’s proposed guidance programme for fiscal year 2027, published on 1 October 2026, provides that kind of forward signal. For medical device developers, three areas deserve particular attention: artificial intelligence, postmarket cybersecurity and quality management information in premarket reviews. [1, 2]

The programme does not itself introduce new obligations. Its value is in helping organisations decide what to monitor and where preparation could reduce future disruption.

Read the programme as a planning signal

FDA divides its programme into three categories:

These categories describe intentions, rather than guaranteed publication dates. The distinction between draft and final guidance also matters: publication of a draft opens a policy discussion; it does not mean the proposed recommendations are ready for implementation. FDA is seeking comments on the programme by 30 November 2026. [1]

AI device development needs a lifecycle view

FDA has placed finalisation of its AI-enabled device software lifecycle and submission guidance on the A-list. A draft addressing generative AI conversational devices for mental disorders is also prioritised, while broader generative AI risk and evidence considerations remain Under Construction. Together, these entries signal a substantial programme of AI policy work. [2]

The existing January 2025 AI lifecycle guidance remains a draft, explicitly marked “Not for implementation”. It proposes an approach covering both submission evidence and management of risk throughout the total product lifecycle. [3]

For development teams, the useful question is broader than whether an algorithm performs well at release: can we explain how the complete device will remain safe and effective as its operating environment changes?

A practical preparation review could examine:

• Whether the intended use and limits of the AI function are clearly defined.
• How development and evaluation data represent the intended population and conditions of use.
• How changes to the model, software or surrounding system are assessed.
• How performance concerns will be detected and investigated after deployment.
• Whether responsibilities for these activities are assigned and resourced.

Prepare without predicting the final wording

These are sensible preparation questions, rather than predictions of the final guidance’s exact wording. Teams should compare the eventual final document with their existing approach before deciding what needs to change.

Postmarket cybersecurity moves onto the forward watch list

FDA’s programme includes a draft postmarket cybersecurity guidance topic on the B-list. This signals planned policy work, subject to available resources; it does not establish the content or timing of a replacement framework. [2]

The existing final postmarket guidance dates from December 2016. It already emphasises managing vulnerabilities and addressing cybersecurity throughout the device lifecycle. The separate premarket cybersecurity guidance is the February 2026 final version. [4, 5]

Manufacturers should therefore continue operating their current cybersecurity processes while monitoring the forthcoming draft.

The most useful preparation is to check whether postmarket cybersecurity works in practice. Who receives vulnerability reports? Who assesses their potential clinical consequences? How are suppliers involved? How are corrective updates developed, verified and delivered? How does the manufacturer know that affected devices have received the update?

For connected products, that review should consider dependencies such as operating systems, third-party libraries, communications services and cloud infrastructure. A device can remain physically unchanged while its exposure to cybersecurity threats changes substantially.

QMSR implementation must connect processes with evidence

FDA has also prioritised final guidance on QMS information for certain premarket application reviews. Its inclusion on the A-list points towards supporting submission policy, rather than an amendment to QMSR itself. [2]

QMSR became effective on 2 February 2026, amending 21 CFR Part 820 and incorporating ISO 13485:2016 by reference. [6]

The preparation opportunity is to examine the connection between documented processes and product evidence.

For example, can the organisation show how a design change moved through requirements, risk assessment, verification, approval and release? Can it demonstrate how supplier issues influenced product decisions? Are the records consistent with what the procedures say should happen?

This does not mean every submission will require the same QMS information. The planned guidance concerns certain premarket reviews, and its eventual scope should be checked carefully.

What should teams do this week?

The immediate action is to update the regulatory watch list and assign an owner to each relevant topic.

For AI-enabled products, plan a review when the lifecycle guidance becomes final. For connected devices, monitor the postmarket cybersecurity draft and prepare to assess its implications. For relevant premarket applications, track the QMS information guidance alongside existing submission plans.

For submission preparation, FDA currently lists eSTAR version 7.1 and PreSTAR version 3.1. Check the applicable template and FDA’s version instructions before starting or submitting a dossier. [7]

The central lesson from this week’s programme is straightforward: planned guidance creates a preparation opportunity, not an immediate compliance deadline.

Use that opportunity to strengthen lifecycle evidence, clarify operational responsibilities and identify gaps that already matter to the product. When new guidance arrives, the organisation will then have a sound basis for assessing what genuinely needs to change.