EU Medical Device CybersecurityMDR and IVDR Evidence Your Notified Body Can Follow.
In the EU, a medical device's cybersecurity is judged under the MDR or IVDR, not the Cyber Resilience Act. We build the evidence Annex I and MDCG 2019-16 call for and organize it in your technical documentation, so the Notified Body review is about your device, not missing files.
The short answer
What are the EU cybersecurity requirements for medical devices?
In the EU, medical device cybersecurity is set by the MDR (2017/745) and IVDR (2017/746), not the Cyber Resilience Act. Annex I requires devices with software to be built using the state of the art for the development life cycle, information security, verification, and validation, with protection against unauthorized access. MDCG 2019-16 Rev.1 explains what Notified Bodies expect: secure design, security risk management, testing, instructions for use, and postmarket vulnerability handling.
275+ FDA submissions supported, zero cybersecurity rejections. Cybersecurity support for FDA and EU markets.
- Annex I GSPR mapping
- MDCG 2019-16
- Threat model + risk
- Penetration testing
- Postmarket vigilance
- Free 30-min call
- No obligation
- Senior expert, not a sales rep
- Fixed-fee quote in 24 hours
- NDA available on request
Where EU cybersecurity files run into trouble
Notified Bodies see the same gaps again and again.
Following the wrong law
Teams prepare Cyber Resilience Act evidence for a device the CRA excludes under Article 2(2), and leave Annex I gaps open. The device needs MDR or IVDR evidence; the CRA can apply only to separate non-device products.
Does the CRA apply to you?Security kept apart from safety risk
MDCG 2019-16 expects security risks to feed the ISO 14971 safety risk file, with a benefit-risk view where a control could affect safety or performance. A standalone IT risk register leaves that link unproven.
EU CRA and MDR cybersecurity FAQPostmarket left vague
Annex I and the MDR postmarket rules expect you to keep the device secure after CE marking. Files that never say how vulnerabilities are monitored, assessed, patched, and reported raise questions at review and at surveillance audits.
What the EU cybersecurity work covers
Each item is traced to the Annex I requirement it supports.
Requirements mapping
- Annex I 17.2: state of the art for life cycle, information security, verification, and validation
- Annex I 17.4: minimum hardware, IT network, and IT security requirements
- Annex I 18.8: protection against unauthorized access
- IVDR Annex I equivalents for IVDs
Design and risk
- Threat model with architecture views and trust boundaries
- Security risk assessment linked to ISO 14971
- Security benefit-risk analysis
- SBOM and third-party component review
Verification
- Penetration testing scoped from the threat model
- Security requirement verification evidence
- Fuzz and vulnerability scanning where in scope
- Retests until uncontrolled risks are closed
Labeling and postmarket
- Security content for instructions for use and operator information
- Vulnerability monitoring and coordinated disclosure process
- Postmarket surveillance plan inputs
- Vigilance decision workflow for security incidents
How an EU MDR cybersecurity engagement runs
- 01
Scoping call
We review your device, classification, Notified Body, and current files, then confirm which products fall under the MDR or IVDR and which, if any, fall under the CRA. You get a fixed-fee proposal.
- 02
Gap assessment
We compare your existing threat model, risk file, testing, and labeling to Annex I and MDCG 2019-16 and list gaps ranked by patient risk.
- 03
Build and test
We close the gaps: threat model, risk assessment, penetration testing, SBOM, and postmarket procedures, written to fit your technical documentation.
- 04
Notified Body support
We help you answer Notified Body cybersecurity questions during review and surveillance. If you also sell in the US, the same evidence is formatted for your FDA submission.
Reviewer-ready deliverables in one engagement
Every engagement ships with documented artifacts, traceable, complete, and aligned with current guidance.
- Annex I GSPR mapping (17.2, 17.4, and 18.8) for cybersecurity
- Threat model, security risk assessment, and security benefit-risk analysis
- Penetration testing and verification evidence
- Instructions for use, postmarket surveillance, and vigilance procedures
EU MDR Medical Device Cybersecurity FAQs
EU MDR Medical Device Cybersecurity - scoped, fixed-fee, built for FDA premarket submissions.
In the EU, a medical device's cybersecurity is judged under the MDR or IVDR, not the Cyber Resilience Act. We build the evidence Annex I and MDCG 2019-16 call for and organize it in your technical documentation, so the Notified Body review is about your device, not missing files.