FDA 524B Clause 524B(b)(3)
Software bill of materials requirement
FD&C Act Section 524B
Section 524B(b)(3) requires a cyber device's premarket submission to include a machine-readable software bill of materials (SBOM) listing all commercial, open-source, and off-the-shelf software components. FDA accepts SPDX or CycloneDX formats and expects a human-readable companion. Each component needs identity (supplier, name, version) and traceability (a unique identifier plus dependency relationships). Because it must be generated from your actual build and kept current as components change, the SBOM is the single most common friction point — it cannot be hand-assembled at submission time.
Where Forge applies this
Verified against the primary source. Standards are periodically revised — always confirm the current text.