In the EU, a medical device's cybersecurity is judged under the MDR or IVDR, not the Cyber Resilience Act. We build the evidence Annex I and MDCG 2019-16 call for and organize it in your technical documentation, so the Notified Body review is about your device, not missing files.
The short answer
In the EU, medical device cybersecurity is set by the MDR (2017/745) and IVDR (2017/746), not the Cyber Resilience Act. Annex I requires devices with software to be built using the state of the art for the development life cycle, information security, verification, and validation, with protection against unauthorized access. MDCG 2019-16 Rev.1 explains what Notified Bodies expect: secure design, security risk management, testing, instructions for use, and postmarket vulnerability handling.
275+ devices supported across FDA and EU markets.
Notified Bodies see the same gaps again and again.
Teams prepare Cyber Resilience Act evidence for a device the CRA excludes under Article 2(2), and leave Annex I gaps open. The device needs MDR or IVDR evidence; the CRA can apply only to separate non-device products.
Does the CRA apply to you?MDCG 2019-16 expects security risks to feed the ISO 14971 safety risk file, with a benefit-risk view where a control could affect safety or performance. A standalone IT risk register leaves that link unproven.
EU CRA and MDR cybersecurity FAQAnnex I and the MDR postmarket rules expect you to keep the device secure after CE marking. Files that never say how vulnerabilities are monitored, assessed, patched, and reported raise questions at review and at surveillance audits.
Each item is traced to the Annex I requirement it supports.
We review your device, classification, Notified Body, and current files, then confirm which products fall under the MDR or IVDR and which, if any, fall under the CRA. You get a fixed-fee proposal.
We compare your existing threat model, risk file, testing, and labeling to Annex I and MDCG 2019-16 and list gaps ranked by patient risk.
We close the gaps: threat model, risk assessment, penetration testing, SBOM, and postmarket procedures, written to fit your technical documentation.
We help you answer Notified Body cybersecurity questions during review and surveillance. If you also sell in the US, the same evidence is formatted for your FDA submission.
Every eu mdr medical device cybersecurity engagement ships with the artifacts FDA reviewers expect to see - traceable, complete, and aligned with current guidance.
In the EU, a medical device's cybersecurity is judged under the MDR or IVDR, not the Cyber Resilience Act. We build the evidence Annex I and MDCG 2019-16 call for and organize it in your technical documentation, so the Notified Body review is about your device, not missing files.
