FDA to screen Chinese medical devices for cybersecurity risks, with recall power
S. 4939 — Countering CCP Act · Filed by Tom Cotton (R-AR) · 1 cosponsor · Introduced Jun 24, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill requires the FDA to review networked medical devices made by Chinese manufacturers (or Chinese-controlled companies) for cybersecurity risks, and to order recalls of devices that pose such risks or whose manufacturers refuse to provide security information within 180 days. The bill aims to protect patient data and device integrity by preventing Chinese government access to medical systems and patient information.
Why we flagged it
The bill's operative mechanism is a mandatory FDA review and recall authority for networked medical devices from Chinese manufacturers or Chinese-controlled entities, focused on cybersecurity and patient-data protection. This is a regulatory safety measure, not a trade restriction or industry carve-out.
What the text implies
- The bill's definition of 'covered manufacturer' includes any company 'owned or controlled by' Chinese entities, which may capture U.S. subsidiaries of Chinese parent companies or joint ventures, potentially affecting supply chains for U.S. medical-device manufacturers with Chinese ownership stakes.
- The 18-month review and recall timeline is aggressive; manufacturers unable to provide complete software bills of materials or data-architecture documentation within 180 days face automatic recall orders, even if security risk is unproven. This may incentivize rapid compliance but could also trigger recalls of functional devices if documentation is incomplete.
- The shortage exemption (paragraph 3) gives the Secretary discretion to waive recalls if they would 'pose a danger to patient health,' creating a potential loophole if no domestic alternatives exist for critical devices.
- The bill does not establish a public database or transparency mechanism for the FDA's cybersecurity findings; the only public output is a 2-year congressional report. Patients and clinicians may not know which devices were flagged or why.
- The bill applies only to devices cleared/approved before March 28, 2023; newer devices from Chinese manufacturers are not covered, potentially creating a regulatory gap for recently approved devices.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Ordinary patients gain a direct safety and privacy protection: the FDA will screen networked medical devices for cybersecurity vulnerabilities and data-exfiltration risks before they remain in use. The bill does not restrict patients' access to care (it includes a shortage exemption) and imposes no new costs on individuals. The burden falls on device manufacturers to demonstrate security or face recall.
Who stands to gain
- U.S. medical-device manufacturers (competitive advantage if Chinese competitors' devices are recalle
- Cybersecurity consulting and compliance firms (demand for software bill-of-materials audits and data
- Domestic device manufacturers with existing FDA approvals (reduced competition from Chinese-origin d
Named in the bill
FDA (Food and Drug Administration), CISA (Cybersecurity and Infrastructure Security Agency), People's Republic of China, Senate Committee on Health, Education, Labor, and Pensions, Senate Committee on Homeland Security and Governmental Affairs, House Committee on Energy and Commerce, House Committee on Homeland Security
Where it stands
1 cosponsor: 1 Republicans.
- Jun 24, 2026 — Introduced · Congress.gov: “Introduced in Senate”
- Jun 24, 2026 — Referred to Senate Committee on Health, Education, Labor, and Pensions · Congress.gov: “Read twice and referred to the Committee on Health, Education, Labor, and Pensions”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
Money around this bill
2 lobbying clients named this bill on 2 disclosure filings across 1 quarter, Jun 2026 to Jun 2026. Those filings disclosed $1,021,000 in lobbying spend. A filing names 7 bills on average, so that figure is what each filing reported, not a share belonging to this bill.
More lobbying clients named this bill than 41% of bills with at least one filing.
Tom Cotton, the sponsor, reported $1,292,206 in PAC receipts in the 2026 cycle.
- Advanced Medical Technology Assn — $971,000 on 1 filing
- Baxter Healthcare Corporation — $50,000 on 1 filing
Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (6,093 characters) on Aug 12, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
Money — Senate Lobbying Disclosure Act filings whose specific-issue field names this bill for quarters ending Jun 2026 to Jun 2026. A filing's amount is reported whole beside the median number of bills a filing names; it is never divided across them. PAC receipts are FEC-reported contributions to the sponsor's candidate committee in the 2026 cycle.
As of — lobbying records through Jul 20, 2026 · page rendered 2026-10-20.
“FDA to screen Chinese medical devices for cybersecurity risks, with recall power” QuorumCivic. https://share.quorumcivic.app/bill/119/s4939 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.