How many EU reporting clocks does one medtech security incident start?

The CRA carves medical devices out of its own scope. Article 2(2) states that the Regulation does not apply to products with digital elements to which the listed Union legal acts apply, and point (a) names Regulation (EU) 2017/745.^[1] Point (b) names Regulation (EU) 2017/746, which covers in vitro diagnostic medical devices.

Recital 25 gives the reason. Both Regulations already lay down essential requirements for medical devices that function through an electronic system or that are software themselves. Both already mandate risk management principles and requirements concerning IT security measures. Both already carry conformity assessment procedures. The recital closes by stating that products to which either Regulation applies should therefore sit outside the CRA.^[2]

So a certified medical device carries MDR vigilance duties and the CRA reaches it nowhere. The two reporting regimes meet inside one organisation and never inside one product.

The exclusion attaches to a product. Article 2(2) removes the products to which Regulation (EU) 2017/745 applies, and it leaves everything else the same manufacturer sells inside the CRA.^[1]

Three groups of products commonly stay in scope.

• Software sold around a device rather than as part of it, such as a hospital integration layer, a clinician portal or an analytics service, where the device certificate covers neither.
• Connected accessories and companion hardware that fall outside the intended purpose the certificate describes.
• Personal wearable products with a health monitoring purpose to which Regulation (EU) 2017/745 and Regulation (EU) No 2017/746 do not apply. CRA Annex III lists these at point 19 of Class I, so they are important products and their conformity route is stricter than the default class.^[3]

The boundary work therefore comes first. Each product in the portfolio needs a recorded decision on whether Regulation (EU) 2017/745 applies to it, because that decision picks the reporting regime, and the two regimes route to different authorities on different deadlines.

Each regime asks a different question about the same event, so the trigger, the first deadline and the recipient all differ.

The CRA and NIS2 deadlines are the tightest, so a manufacturer inside either regime files first and files with the least information.^[4][10] The MDR period is the longest of the four for an ordinary serious incident and the shortest of the four for a serious public health threat, which is why the MDR clock earns the same preparation as the others.^[5] The GDPR sets one 72 hour deadline and no earlier stage.^[11]

Article 87(1) binds manufacturers of devices made available on the Union market, other than investigational devices. They report any serious incident involving those devices, and any field safety corrective action, through the electronic system referred to in Article 92.^[5]

Article 87(2) states that the reporting period takes account of the severity of the serious incident, and paragraphs 3 to 5 set the three periods.^[5]

1. Article 87(3). Report immediately after establishing that a causal relationship between the incident and the device exists or is reasonably possible, and within 15 days of becoming aware of the incident.
2. Article 87(4). For a serious public health threat, report immediately, and within 2 days of becoming aware of the threat.
3. Article 87(5). For a death or an unanticipated serious deterioration in a person's state of health, report immediately after establishing or suspecting a causal relationship, and within 10 days of becoming aware of the serious incident.

Two further paragraphs matter in the first hours. Article 87(6) allows an incomplete initial report followed by a complete report, so a thin first filing is the design. Article 87(7) requires a report inside the same period even where the manufacturer stays uncertain whether the incident is reportable.^[5]

The investigation duty then runs under Article 89. The manufacturer investigates without delay, cooperates with the competent authority, and submits a final report setting out its findings through the Article 92 electronic system.^[8] Where a field safety corrective action follows, Article 89(8) requires a field safety notice that reaches users of the device.^[8] An incident below the serious threshold can still reach the authority through the trend reporting duty in Article 88, which covers a statistically significant increase in the frequency or severity of incidents that are not serious.^[7]

The MDR routes a cyber event through its outcome for a person. Article 2, point (65), defines a serious incident as any incident that directly or indirectly led, might have led or might lead to the death of a patient, user or other person, to the temporary or permanent serious deterioration of a person's state of health, or to a serious public health threat.^[6] Point (66) defines a serious public health threat as an event which could result in imminent risk of death, serious deterioration in a person's state of health, or serious illness, that may require prompt remedial action.^[6]

The test therefore turns on the clinical consequence. A ransomware event that stops a device from delivering therapy meets the definition. A flaw that produces no clinical consequence sits below the threshold, and a rising frequency of such events reaches the authority through Article 88 trend reporting instead.^[7]

Security sits inside the MDR requirements in its own right. Annex I, point 17.4, requires manufacturers to set out minimum requirements concerning hardware, IT networks characteristics and IT security measures, including protection against unauthorised access, necessary to run the software as intended.^[9] A failure of those measures is therefore a device performance question that the vigilance system already covers.

Every decision worth making happens before an incident, because none of them can be made well inside 24 hours.

• Record which regime binds which product. The MDR decision drives the CRA decision through Article 2(2)(a), so one register answers both.^[1]
• Name each recipient in advance. A coordinating CSIRT under CRA Article 14(7), a CSIRT or competent authority under national NIS2 transposition, a supervisory authority under the GDPR, and a national medical device competent authority reached through MDR Article 92.^{[4][10][11][5]}
• Timestamp awareness once. Commission guidance C(2026) 5252 reads CRA awareness as a reasonable degree of certainty after an immediate initial assessment, and it aligns that reading with the NIS2 implementing regulation and the EDPB breach notification guidelines.^[12] The MDR fixes its own periods on becoming aware of the incident or the threat.^[5]
• Assess severity against all four tests from the same facts. A serious public health threat carries the 2 day MDR period, and the same facts usually satisfy the CRA severe incident test for any connected product in scope.^[5][4]
• Diarise the final reports separately. The CRA vulnerability final report runs 14 days from a corrective or mitigating measure being available, the CRA severe incident and NIS2 final reports run one month from the 72 hour notification, and the MDR final report follows the investigation under Article 89(5).^[4][10][8]

The overlap between the CRA, NIS2 and the GDPR works through the first three regimes in detail, and the awareness test works through the moment each CRA clock starts.