The FDA is rejecting submissions today for missing SBOM and cybersecurity evidence.
A Technical Screening hold adds months. A Refuse to Accept determination ends the cycle.
FDA Section 524B is in force. Every 510(k) and PMA submission for a cyber device must include a machine-readable SBOM, a postmarket vulnerability management plan, and evidence of secure product development. Since October 2023, the FDA has been issuing Technical Screening holds for missing or non-compliant submissions — adding months to clearance timelines.
IEC 62304 Class B and C software requires end-to-end traceability from requirements through architecture, code, testing, and release. EU MDR demands a Technical File and post-market surveillance plan. HIPAA governs ePHI-handling components. SOUP management is a direct IEC 62304 obligation. None of these wait for each other.
X-DLM™ connects Siemens Polarion and Black Duck so that your SBOM, SOUP inventory, traceability matrix, and vulnerability response evidence are generated automatically — and submission-ready before the FDA asks.
and
What the FDA and hospital procurement teams are finding
Medical device software carries open-source risk, license exposure, and SOUP that regulators now examine by default. The consequence is submission rejection, not a warning.
Of hospital procurement organizations have rejected a device on cybersecurity grounds — up from 46% in 2025. Source: RunSafe Medical Device Cybersecurity Index 2026.
Of hospital procurement teams will not consider a medical device without an SBOM. SBOM absence now accounts for 34% of device rejection decisions.
Of medical device manufacturers struggle to produce compliant SBOMs due to complex third-party and open-source dependencies. Source: Blue Goat Cyber 2024.
Of medical devices with software are now classified as FDA 'cyber devices' under Section 524B — significantly expanding the compliance scope.
Sources: RunSafe Medical Device Cybersecurity Index 2026. Blue Goat Cyber 2024. Finite State 2024. FDA Section 524B.
FDA Section 524B — In Force. Submissions Rejected Today. No Grace Period.
A missing SBOM is not a deficiency to address later. It is a Technical Screening hold that stops your submission.
FDA Section 524B
Submission Rejection
Every 510(k) and PMA for a cyber device must include a compliant SBOM, postmarket vulnerability management plan, and evidence of secure product development. Non-compliant submissions receive a Technical Screening hold or Refuse to Accept determination.
IEC 62304
SOUP Violation
IEC 62304 Class B and C requires every open-source component (SOUP — Software of Unknown Provenance) to be identified, assessed for risk, and managed through a documented change control process. Undocumented SOUP is a direct Class B/C violation.
EU MDR / HIPAA
Market Access & Data Risk
EU MDR requires a Technical File with post-market surveillance evidence for CE marking. HIPAA Security Rule governs any software component that processes, stores, or transmits ePHI — with per-violation fines up to $1.9M/year.
Brand authority buyers recognize
Backed by Siemens lifecycle governance and Black Duck AppSec intelligence.
Siemens Polarion ALM
Polarion provides the lifecycle system of record for requirements, tests, approvals, traceability, workflow automation, audit evidence, and regulated software delivery.
Black Duck Software Composition Analysis
Black Duck identifies open source and third-party components across source, binaries, containers, firmware, snippets, AI-generated code, and C/C++ environments without package managers.
The X-DLM™ medical device workflow
Black Duck detects SOUP risk → X-DLM™ routes → Polarion traces → teams approve → FDA-ready evidence is retained.
X-DLM™ integrates Siemens Polarion ALM and Black Duck into a governed medical device software compliance system that automatically:
- 01
Generates machine-readable SBOMs in SPDX and CycloneDX for FDA 510(k), PMA, and EU MDR Technical File submissions
- 02
Identifies every SOUP component, license conflict, malware signal, and vulnerability across source, binaries, containers, and firmware
- 03
Routes IEC 62304 SOUP change control, vulnerability response, and risk acceptance through governed Polarion workflows with timestamps and approval chains
- 04
Links requirements to architecture, code, test cases, test results, and release evidence — the IEC 62304 traceability matrix, built continuously
- 05
Produces postmarket surveillance evidence and vulnerability management records for FDA 524B ongoing obligations and EU MDR post-market monitoring
Your 510(k) submission window is already scheduled.
Make the evidence submission-ready before it costs you market access.
Book a 15–30 minute walkthrough. We show you exactly how X-DLM™ connects Black Duck and Siemens Polarion to produce FDA 524B SBOM, IEC 62304 SOUP traceability, and postmarket surveillance evidence — automatically.
The X-DLM™ medical device trust equation