MDR-IVDR Amendment Proposals: What About Cybersecurity?

Cybersecurity in the EU Health Sector: A Critical Shift

The cybersecurity landscape in the European Union has become increasingly critical, prompting the European Commission to introduce regulations and directives—such as NIS2 (Network and Information Security Directive, which entered into force in 2023) [1]—to address resilience needs across both the private and public sectors. The healthcare sector is now classified as “Critical” under NIS2*, making cybersecurity paramount for product design, development, and sales, particularly for medical devices and in vitro diagnostic medical devices.

Medical device manufacturers marketing products in Europe must recognize that their systems will be integrated into critical infrastructure, potentially serving as entry points for cybersecurity threats that could lead to safety risks, security breaches, and the compromise of essential infrastructure assets.

MDR and IVDR Amendments: A Focus on Competitiveness and Security

It is recognized that “the EU is a world leader in medical devices and that, within the Union, the sector employs nearly one million people, mostly in small and medium-sized enterprises” (SMEs) [2]. In this context, the European Commission has proposed an “ambitious package of measures to improve the health of EU citizens, while ensuring the long-term resilience and competitiveness of the health sector” [2]. These include proposed amendments to the MDR (Medical Device Regulation) and IVDR (In Vitro Diagnostic Regulation). The policy areas concerned are explicitly stated in the proposal document: “Competitiveness, prosperity, and security.”

Since the new proposed amendments focus on promoting market access for medical devices while reducing the compliance burden and costs, the question is how these proposals would affect cybersecurity-related requirements for medical device manufacturers. With regard to cybersecurity, two important points are explicitly mentioned: the interplay between the Cyber Resilience Act (CRA) [3] and the MDR/IVDR, and the explicit inclusion of cybersecurity in Annex I.

Interplay Between the CRA and the MDR/IVDR

Background for those unfamiliar with the topic: The CRA, a recently adopted horizontal regulation (which entered into force in 2024), aims to strengthen security requirements for products with digital elements that connect to devices or networks, whether directly or indirectly. In the proposed amendment, cybersecurity-specific terms such as “ENISA” (the European Union Agency for Cybersecurity), “CSIRT” (computer security incident response team), and “actively exploited vulnerabilities” now appear explicitly. These terms are defined in the CRA and NIS2, but were previously absent from the MDR and IVDR regulations.

Two substantially equivalent new articles—Article 87a for the MDR and Article 82a for the IVDR—are proposed to address a critical cybersecurity vigilance gap between the MDR/IVDR and the CRA. The current rules require the reporting of cybersecurity-related incidents only if they qualify as serious incidents affecting public health or patient safety, leaving other incidents unreported. Articles 87a and 82a would require manufacturers to report actively exploited vulnerabilities and severe incidents impacting device security, with notifications sent to CSIRTs and ENISA. This change would oblige medical device manufacturers to strengthen vigilance practices concerning operational cybersecurity and product security.

Cybersecurity in General Safety and Performance Requirements

The proposed amendment states: “In Annex I of the MDR/IVDR, cybersecurity will be explicitly mentioned in the general safety and performance requirements.” Proposed measure:

Section 17.4. is replaced by the following: “17.4. Manufacturers shall specify the minimum requirements regarding hardware, IT network characteristics, IT security measures, and cybersecurity—including protection against unauthorized access—necessary to run the software as intended.”

This makes the distinction between “IT security measures” and “cybersecurity” explicit in the MDR and IVDR texts, leaving no room for misinterpretation. How this difference should be interpreted is another regulatory question.

Why might this regulatory approach come as a surprise to those working in the sector?

This regulatory approach may come as a surprise to many professionals in the field because it creates a clear paradox. Modern medical devices rely heavily on connectivity, software, and cloud-based functionalities, making them technologically similar to many products regulated under the CRA. Yet, despite this similarity in cybersecurity risk profile, products covered by the MDR and IVDR are explicitly excluded from the CRA’s scope**. At first glance, this exclusion may leave cybersecurity experts, system integrators, product developers, and system engineers feeling perplexed.

The CRA is a 75-page horizontal regulation that establishes strict cybersecurity requirements for a wide variety of connected products. Given that today’s medical devices function as IoT systems, incorporate embedded and third-party software, and interact with digital infrastructures, it is reasonable to expect them to be subject to the same cybersecurity requirements.

However, the MDR and IVDR do not directly contain cybersecurity requirements comparable to those in the CRA. While the MDR and IVDR briefly mention information security or IT security, these references are only tangential. They do not provide the explicit, prescriptive cybersecurity framework that manufacturers would need, particularly those who consider the MDR and IVDR to be the primary reference points for CE marking compliance. This absence naturally creates uncertainty about how to properly implement cybersecurity measures.

Lack of CRA Support Provisions for SMEs

Furthermore, the situation is even more surprising when considering the role of SMEs. During the development of the CRA, SMEs and microenterprises were actively consulted, and the regulation includes Article 33, which provides dedicated support measures for them. These include, among other things, awareness-raising, training, and simplified documentation formats. Yet none of these support provisions explicitly appear in the MDR/IVDR amendment proposals. Since the CRA does not apply to products regulated by the MDR/IVDR, medical device manufacturers would not be eligible for the support mechanisms under Article 33.

This is particularly controversial given that the EU medical device industry consists primarily of SMEs, and implementing and maintaining cybersecurity requires substantial financial and operational investment. As a result, small medical device vendors and startups would have to rely solely on the MDR/IVDR requirements, without the complementary support mechanisms that the CRA provides to other sectors.

Final Considerations and Recommendations

The new proposed amendments set higher standards for cybersecurity for both medical devices and the quality management systems that support them. A CE-marked product under the MDR/IVDR does not automatically guarantee that it was developed using a structured security development lifecycle such as IEC 81001-5-1 (based on IEC 62304), as these standards have not yet been harmonized. These frameworks ensure that cybersecurity practices are integrated from the earliest design phases rather than added as an afterthought.

Even manufacturers who already follow NIST (National Institute of Standards and Technology) processes and the NVD (National Vulnerability Database), the KEV Catalog (Known Exploited Vulnerabilities), or maintain robust documentation should also consider ENISA’s guidelines and the EU Vulnerability Database. However, this is only part of the picture.

Looking Ahead: A Call to Action

Given the vastness of cyberspace and the complexity of modern threats, the MDCG (Medical Device Coordination Group) had already published a 46-page guidance document (MDCG 2019 16 Rev. 1 [4]) to clarify how the MDR and IVDR address security and to support manufacturers in preparing devices for the EU market. This topic was previously discussed in an earlier article [5] for those interested, and it remains relevant in light of the new proposed amendments.

Familiarity with this guidance remains essential for understanding how cybersecurity should be implemented under the MDR and IVDR, including expectations regarding vigilance mechanisms, supply chain security, and the distribution of responsibilities among manufacturers, system integrators, and healthcare providers.

The key question for all manufacturers remains: Have you fully integrated cybersecurity into your QMS and your products?

If you're unsure and would like some help, get in touch today.