Networked Radiology Imaging and Treatment Planning Systems and FDA Cybersecurity Regulation: A...

The objective of this study is to determine whether 510(k) clearance duration for AI-enabled devices changed differentially relative to the general market around October 1, 2023-the date FDA began Refuse-to-Accept enforcement of Section 524B cybersecurity documentation completeness-using a freshly re-extracted, complete FDA 510(k) dataset. We analyzed 83,675 FDA 510(k) records (De Novo excluded; decisions dated January 2000 through August 2, 2026). AI-enabled codes were identified via FDA's officially published AI-Enabled Medical Device List (26 codes, N = 7070). Log-transformed clearance duration was modeled with a difference-in-differences (DiD) regression (product code-clustered standard errors, adjusted for submission type and review pathway); a half-year event study specification tested parallel pre-rule trends and timing, and Bonferroni-corrected Mann-Whitney tests (15 comparisons) assessed code-level heterogeneity; AI-enabled status was assigned at the product code level and was not confirmed at the individual-submission level. After adjustment, the overall market showed no significant post-rule change (Post coefficient = 0.029, p = 0.141), while the AI-enabled cohort showed a robust increase (AI × Post = 0.212, p < 0.001; ≈24% longer). The two half-years nearest the cutoff showed no significant pre-rule trend, though the most distant pre-rule half-year (six half-years prior) showed a significant negative coefficient, an anomaly discussed in Limitations; the AI x Post effect itself became significant approximately 24 months post-implementation. Five codes-diagnostic ultrasound (IYN), CT scanners (JAK), radiology image processing software (LLZ), angiography/fluoroscopy systems (OWB), and radiotherapy-planning software (MUJ)-were Bonferroni significant (all p < 0.001) and together drove the aggregate effect; all five are radiology panel codes. The highest-volume AI code (QIH) showed no significant change after correction. The observed clearance time increase for AI-enabled submissions is associated with, and concentrated in, networked radiology panel imaging and treatment planning systems rather than AI-enabled software broadly, and it accumulates over roughly 6 to 24 months rather than appearing immediately. Because AI-enabled status is defined at the product code level, submissions in the control group may include non-AI cyber devices also subject to the cybersecurity rule, and the concurrent mandatory eSTAR transition is not separately identified; these findings should therefore be read as an association warranting device category-specific, rather than blanket AI/ML, regulatory attention, not as established evidence that Section 524B specifically caused the observed delay.