FDA to screen Chinese medical devices for cybersecurity risks, with recall power

What it does

This bill requires the FDA to review networked medical devices made by Chinese manufacturers (or Chinese-controlled companies) for cybersecurity risks, and to order recalls of devices that pose such risks or whose manufacturers refuse to provide security information within 180 days. The bill aims to protect patient data and device integrity by preventing Chinese government access to medical systems and patient information.

Why we flagged it

The bill's operative mechanism is a mandatory FDA review and recall authority for networked medical devices from Chinese manufacturers or Chinese-controlled entities, focused on cybersecurity and patient-data protection. This is a regulatory safety measure, not a trade restriction or industry carve-out.

What the text implies

• The bill's definition of 'covered manufacturer' includes any company 'owned or controlled by' Chinese entities, which may capture U.S. subsidiaries of Chinese parent companies or joint ventures, potentially affecting supply chains for U.S. medical-device manufacturers with Chinese ownership stakes.
• The 18-month review and recall timeline is aggressive; manufacturers unable to provide complete software bills of materials or data-architecture documentation within 180 days face automatic recall orders, even if security risk is unproven. This may incentivize rapid compliance but could also trigger recalls of functional devices if documentation is incomplete.

The full analysis lists 5 implications of this text.

Who stands to gain

U.S. medical-device manufacturers (competitive advantage if Chinese competitors' devices are recalle; Cybersecurity consulting and compliance firms (demand for software bill-of-materials audits and data; Domestic device manufacturers with existing FDA approvals (reduced competition from Chinese-origin d