- Where are the EU cybersecurity requirements for medical devices?
- In Annex I of the MDR and IVDR, the general safety and performance requirements. For cybersecurity, the key sections are 17.2, 17.4, and 18.8 of the MDR, with matching sections in the IVDR.
- What is MDCG 2019-16?
- Guidance from the Medical Device Coordination Group on cybersecurity for medical devices. It isn't legally binding, but Notified Bodies use it to judge whether Annex I is met, so following it is the practical way to show conformity.
- What does a Notified Body expect to see?
- A threat model, a security risk assessment linked to your ISO 14971 safety risk file, a security benefit-risk view, verification evidence such as penetration testing, security information for users, and postmarket processes for vulnerabilities.
- Can we reuse our FDA cybersecurity evidence for the EU?
- Much of it, yes. The threat model, risk assessment, SBOM, and penetration test usually carry over. The EU file needs mapping to Annex I, a security benefit-risk view, and postmarket processes that fit MDR surveillance and vigilance.
- Do security incidents need to be reported under the MDR?
- A security incident that meets the MDR definition of a serious incident is reported through vigilance like any other serious incident. Other incidents and vulnerabilities go through your postmarket surveillance and corrective action processes.
- Do you cover IVDs?
- Yes. The IVDR has matching cybersecurity requirements in its Annex I, and MDCG 2019-16 applies to both.
