EU Cyber Resilience Act (CRA) for Medical Devices
EU Cyber Resilience Act (Regulation 2024/2847) scoping and readiness for medical device companies. The CRA excludes products regulated under the MDR or IVDR, but it can cover the non-device products around them: separately sold apps, gateways, hubs and wellness wearables. We sort each product into MDR/IVDR, CRA or neither, then build the CRA evidence only where it is needed.
The short answer
Does the EU Cyber Resilience Act apply to medical devices?
Devices regulated under the EU MDR or IVDR are excluded from the Cyber Resilience Act. It can still apply to connected products around them that fall outside those regulations, such as some companion apps, gateways and accessories. Most CRA obligations apply from December 11, 2027, with vulnerability reporting starting earlier. We work out what's in scope and prepare the evidence.
275+ FDA submissions supported, zero cybersecurity rejections.
- Senior team
- Fixed-fee
- Reviewer-ready
- Re-test included
- Free 30-min call
- No obligation
- Senior expert, not a sales rep
- Fixed-fee quote in 24 hours
- NDA available on request
Reviewer-ready deliverables in one engagement
Every engagement ships with documented artifacts, traceable, complete, and aligned with current guidance.
- Product-by-product scope check: MDR/IVDR, CRA, or neither
- CRA product class (default, important, critical) for in-scope items
- Annex I essential requirements gap assessment for in-scope items
- Article 14 reporting workflow (24-hour early warning, 72-hour notification)
- Conformity assessment route and technical documentation
- Shared evidence with your MDR and FDA files where the controls overlap
EU Cyber Resilience Act (CRA) for Medical Devices FAQs
When the CRA applies, and when it doesn't
The Cyber Resilience Act (Regulation (EU) 2024/2847) sets cybersecurity rules for products with digital elements sold in the EU. Article 2(2) excludes products covered by the MDR (2017/745) and IVDR (2017/746). So for a medical device company, the question is which of your products are regulated as devices and which are not.
Outside the CRA
- Connected medical devices CE marked under the MDR
- In vitro diagnostic devices under the IVDR
- Software regulated as a medical device
- Accessories regulated under the MDR
- Standalone cloud services (NIS2 may apply to the company)
Can be inside the CRA
- Wellness apps and wearables sold without a medical purpose
- General-purpose gateways, hubs or routers sold on their own
- Hardware or software components you sell to other manufacturers
- Non-medical connected products in the same product line
Key dates
- December 10, 2024: the CRA entered into force.
- June 11, 2026: rules for conformity assessment bodies apply.
- September 11, 2026: reporting of actively exploited vulnerabilities and severe incidents applies (24-hour early warning, 72-hour notification).
- December 11, 2027: all other obligations apply, including the Annex I essential requirements.
For the device itself, see EU MDR vs FDA cybersecurity.
Filing in the U.S. and EU?
Most teams can run one cybersecurity evidence set and present it twice. Our EU MDR vs FDA cybersecurity crosswalk covers the narrative comparison: legal anchors, deliverables, disclosure clocks, and the IVDR differences. For the row-by-row control mapping, use mdccrosswalk.com, a free standards crosswalk we sponsor.
Find out which of your products the CRA covers.
EU Cyber Resilience Act (Regulation 2024/2847) scoping and readiness for medical device companies. The CRA excludes products regulated under the MDR or IVDR, but it can cover the non-device products around them: separately sold apps, gateways, hubs and wellness wearables. We sort each product into MDR/IVDR, CRA or neither, then build the CRA evidence only where it is needed.