The TGA updated "Complying with medical device cyber security requirements" in early October 2025, tying it to Essential Principle 12.1(5), software developed to best practice for security and engineering. The expectations track the global consensus: maintain an SBOM to assess vulnerability exposure, design secure and quality by default, keep QMS and risk-management evidence available on request, and monitor for cyber issues across the total product lifecycle.
The convergence is what matters. FDA, EU, PMDA and now TGA are asking for versions of the same evidence package, so a manufacturer that builds it once can serve most markets from it. If your SBOM is a spreadsheet someone updates when they remember, that is the gap. Every one of these regimes now assumes it is current and machine-readable.