By Naomi Schwartz

When Baxter initiated a Class I recall of its Life2000 ventilators, it wasn’t the first cybersecurity-related recall we’d seen in the industry. But it was a clear sign that the FDA now treats cybersecurity vulnerabilities the same way it treats other high-risk safety issues. This wasn’t a low-acuity product. These were ventilators used in complex, high-risk clinical environments. And Baxter didn’t wait to be told to take action. They disclosed the issue via ICS-CERT and on their own website before initiating the formal recall process, which was a proactive move that shows just how seriously many manufacturers are starting to treat cybersecurity.

That recall can be seen as a signal. The FDA is codifying a shift we’ve felt coming for years: cyber risk is patient risk.
Cybersecurity and AI: Two sides of the same coin
In recent months, the FDA has taken multiple steps that reinforce this point. Its updated Q-submission guidance now requires manufacturers to provide cybersecurity documentation much earlier in the product lifecycle. At the same time, the agency launched an internal AI oversight tool designed to help surface risk signals across large datasets. This convergence is more than a coincidence.

Software vulnerabilities, whether from hardcoded credentials or outdated encryption libraries, can undermine the clinical integrity of a device just as easily as a mechanical defect. And as more devices rely on AI to optimize performance or personalize treatment, the line between cybersecurity and algorithmic safety is blurring fast. Risks like AI model drift or adversarial attacks don’t fit neatly into existing safety paradigms, but they still pose real harm.

What this means for hospitals: cybersecurity and AI safety are becoming interconnected areas of regulatory scrutiny. Hospitals and HTM teams must start evaluating these risks together.

The growing gap between expectations and readiness
The FDA’s recently finalized guidance on premarket cybersecurity risk management offers further clarity on what’s expected and when. Updating a 2024 draft, the 2025 final guidance underscores that manufacturers must implement security as an integral part of the design process, not as an afterthought. It outlines expectations for threat modeling, SBOM completeness, and vulnerability management across the total product lifecycle. Hospitals and healthcare delivery organizations should view this not just as regulatory housekeeping, but as a patient safety imperative.

U.S. Healthcare Homepage