Somewhere in most 524B conversations, someone asks the reasonable question: is my device exempt?
It is reasonable because the statute says exemptions are possible. It is also, as of today, unanswerable in the way the asker intends — because the place you would look does not have anything in it.
What the statute actually provides
Section 524B(d) of the FD&C Act reads:
“The Secretary may identify devices, or categories or types of devices, that are exempt from meeting the cybersecurity requirements established by this section and regulations promulgated pursuant to this section. The Secretary shall publish in the Federal Register, and update, as appropriate, a list of the devices, or categories or types of devices, so identified by the Secretary.”
Two verbs, and the difference between them matters.
May identify. Congress gave FDA discretion. Nothing obliges the agency to exempt anything, and choosing not to is a legitimate exercise of that discretion rather than a failure to act. This is worth stating clearly, because it is the opposite of the situation on the European side, where the Cyber Resilience Act gave the Commission a dated shall adopt obligation for two of its own instruments.
Shall publish. The publication duty is not discretionary — but it only engages once devices have been identified. No identification, nothing to publish.
What the public record shows
Section 524B became effective on 29 March 2023. Searching the Federal Register's published record of FDA documents since 1 January 2023 does not surface an exemption list.
Four searches, run on 12 August 2026:
- “cyber device exempt” — no results.
- “exempt from meeting the cybersecurity requirements”, the statute's own phrasing — three results, all unrelated: a hepatitis B assay reclassification and the laboratory developed tests rule.
- “360n-2”, the US Code citation for 524B — two results, both notices announcing the availability of cybersecurity guidance.
- “ensuring cybersecurity of devices exempt” — the same three unrelated documents.
FDA's own cybersecurity FAQ points the same way. The word “exempt” appears in it three times, and none of the three is a 524B exemption: twice as part of “Humanitarian Device Exemption,” which is a submission pathway, and once in “all 510(k) submissions, unless exempted,” which is about eSTAR.
The honest way to state this is that there is no public record, as of August 2026, that any 524B exemption list has been published. That is a claim about the record, and the record is where the statute says the list would be.
What follows from that
If there is no list, there is no membership question. The only route to “does 524B apply to my device” runs through the definition in 524B(c), and its three conditions are cumulative. A cyber device is one that:
- includes software validated, installed, or authorized by the sponsor as a device or in a device;
- has the ability to connect to the internet; and
- contains any such technological characteristics validated, installed, or authorized by the sponsor that could be vulnerable to cybersecurity threats.
The second condition is the one that catches people, and it catches them on a single word. The test is ability, not use. A network port nobody plugs in, a radio disabled in the shipped configuration, an update path that only field service opens — the capability is present, and the statute asks about capability.
Which means the practical answer to “are we exempt” is usually: you are asking the wrong question. There is no exemption to qualify for. There is only whether the three conditions are met, and if they are, the requirements attach.
Where the flexibility actually went
It would be wrong to read any of this as FDA being inflexible. The agency has created a good deal of room — it just did not do it by exempting devices.
It did it twice, in two different ways:
Through a transition policy. FDA said it generally did not intend to issue refuse-to-accept decisions based solely on 524B information before 1 October 2023, working with sponsors through the interactive review process instead. That is a timing accommodation, not an exemption, and it expired.
Through graduated documentation. For device modifications, the guidance applies least burdensome principles and says the information it recommends “will generally differ based on the type of change and whether such change impacts the cybersecurity of the device.” A materials change does not carry what a new connectivity feature carries.
Both of those are real relief. Both operate on how much you have to produce, never on whether the law reaches you. That is a coherent regulatory posture, and it is worth understanding as such: the burden is proportionate, the scope is not negotiable.
The practical takeaway
Stop looking for the list. Run the three-condition test in 524B(c) against each marketed and in-development product, and record the reasoning — including for the products you conclude are out of scope, because that reasoning is what you will be asked for later.
And if FDA does publish an exemption list at some point, you will find it in the Federal Register, because that is where the statute says it goes.