Reading FDA's FY2027 guidance agenda

What the existing drafts already tell device manufacturers

Each October, the Center for Devices and Radiological Health (CDRH) publishes the guidance documents it intends to issue during the coming fiscal year. The list is commonly read as a forecast. It is more useful when read as an index, because several of the documents it schedules for finalization already exist in draft form, and those drafts are the clearest available statement of what FDA reviewers will expect.

How the agenda is structured

CDRH organizes the agenda into three tiers. The A-list identifies priority documents the agency intends to publish during fiscal year 2027. The B-list identifies documents it intends to publish as resources permit. The "Under Construction" list identifies topics the agency intends to develop, also as resources permit, without a commitment to the current year.

The list describes intent rather than obligation. In fiscal year 2026, CDRH published seven of the eleven guidances it had listed, and "Predetermined Change Control Plans for Medical Devices," an A-list item for 2026, reappears on the 2027 A-list. The agency also notes that it may issue guidance appearing on neither list. For planning purposes, the existence of a published draft is a more reliable signal than a document's position on the agenda.

Three A-list documents with published drafts

The first is "Predetermined Change Control Plans for Medical Devices," issued in draft in August 2024. The draft extends the predetermined change control plan (PCCP) framework, originally developed for AI-enabled software, to all device types reviewed through the 510(k), De Novo, and PMA pathways. A PCCP describes planned modifications, the methodology for developing and validating them, and an assessment of their impact. Its practical foundation is the design change process required under ISO 13485:2016 clause 7.3.9, which the Quality Management System Regulation (QMSR) now incorporates by reference into 21 CFR Part 820. A manufacturer whose change control process cannot already characterize and assess modifications will find a PCCP difficult to write.

The second is "Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations," issued in draft in January 2025. The draft takes a total product lifecycle approach, addressing data management, model validation, transparency, and postmarket performance monitoring. Its principal implication for development teams concerns timing. Evidence of training data provenance, subgroup performance, and drift monitoring is difficult to reconstruct retrospectively and is best generated as a design input.

The third is "Quality Management System Information for Certain Premarket Submission Reviews," issued in draft in October 2025 to address quality system content in PMA and Humanitarian Device Exemption (HDE) applications under the QMSR, effective February 2, 2026. Manufacturers not pursuing a PMA also have reason to read it, since it is among the more detailed statements of how FDA interprets ISO 13485:2016 in practice, including its expectations for management review.

Software and cybersecurity revisions on the B-list

Two B-list drafts bear directly on software manufacturers. The first is a revision of "Postmarket Management of Cybersecurity in Medical Devices," finalized in December 2016. That guidance predates section 524B of the Federal Food, Drug, and Cosmetic Act, which requires manufacturers of cyber devices to maintain a plan to monitor, identify, and address postmarket vulnerabilities. A revision is likely to bring the guidance into closer alignment with the statute. Manufacturers whose software bill of materials (SBOM) is not already connected to an active vulnerability monitoring process have reason to address that gap independently of the revision's timing.

The second is a revision of "Policy for Device Software Functions," with "Mobile Medical Applications" removed from the title. The retitling suggests a broader framing of software policy, although its substantive scope cannot responsibly be predicted before the draft is published.

Generative AI enters the agenda

The A-list includes a new draft on evidentiary recommendations for generative AI-enabled conversational devices intended for mental disorders, and the Under Construction list includes a broader document on risk assessment and evidentiary considerations for generative AI-enabled devices. Neither has been published in draft. For manufacturers working in this area, the prudent course is to document hazard analysis and risk control rationale under ISO 14971:2019 now, so that the analysis can be mapped to FDA's framework once it becomes available.

A structured review for the next RA/QA meeting

The agenda lends itself to a brief, structured review. First, map each product and roadmap item to the listed topics that affect it. Second, for A-list items with published drafts, compare current documentation against the draft and record gaps as design inputs or planned quality system improvements. Third, for topics without a published draft, assign responsibility for monitoring the Federal Register and FDA's guidance database rather than planning around speculation.

Finally, consider whether any topic is consequential enough to warrant comment, since CDRH accepts feedback on list priorities through docket FDA-2012-N-1021.
The question to carry into that discussion is a direct one: for each draft that touches our products, do we know where our current documentation would fall short if the guidance were finalized tomorrow?

If your team is working through which of these guidances affect your roadmap, we would be glad to walk through it with you.