The rapid digitalization of healthcare via AI/ML software and connected devices, collectively known as the Internet of Medical Things (IoMT), introduces severe cybersecurity risks threatening patient safety. In response, the U.S. Food and Drug Administration (FDA) implemented a mandatory cybersecurity rule effective October 2023. This rule requires comprehensive documentation, including SBOMs and threat modeling, for 510(k) submissions meeting the statutory definition of a ‘cyber device’ under Section 524B of the FD&C Act. This coincided with the mandatory electronic submission system (eSTAR), creating contrasting effects: a compliance burden from increased documentation versus eSTAR's efficiency gains.
This quantitative study analyzes 80,749 FDA 510(k) clearance decisions across 2,866 product codes from 2000 to 2025. The analysis revealed a statistically significant overall increase in the average 510(k) registration period of 20.92 days (5%-95% percentile-filtered; raw estimate 23.05 days; p < 0.001) after the rule's implementation, consistent with the regulatory burden of cybersecurity documentation outweighing eSTAR's efficiency gains, though contemporaneous confounders (eSTAR's learning curve, post-pandemic dynamics) cannot be fully ruled out.
Furthermore, Heterogeneous Impact Analysis demonstrated variable effects: high-risk software (QYE) saw significant delays, while certain AI-based software (QIH) showed a notable, though statistically insignificant, reduction in review time. These results emphasize that the substantive quality of cybersecurity documentation, beyond mere formal completeness, appears to be an important correlate of the clearance timeline. This study quantifies the initial market impact of a critical global cybersecurity governance policy, providing evidence consistent with regulatory demands for substantive security being associated with a longer device market-entry timeline.