Jul 1, 2025·MDCG (EU) · GuidanceActiveHigh impact
MDCG 2019-16 Rev. 2 - cybersecurity expectations for MDR/IVDR submissions
Revised MDCG cybersecurity guidance details security risk management, IT environment assumptions, and basic UDI/postmarket cybersecurity expectations for Notified Body review.
What changed
- Clarifies the split between safety risk (ISO 14971) and security risk (IEC 81001-5-1).
- Spells out IT environment assumptions manufacturers must document and validate.
Action for manufacturers
Cross-reference your MDR technical documentation against Rev. 2's checklist; many 2023-era submissions still cite Rev. 1.