EU Cyber Resilience Act Guide for Medical Device Manufacturers
Important Class I for most networked medical devices; Critical Class II possible for devices on critical health infrastructure
Medical device manufacturers placing connected devices on the EU market face overlapping obligations under both the EU Medical Device Regulation (MDR) and the EU Cyber Resilience Act. Software as a Medical Device (SaMD) and hardware devices with network interfaces are subject to CRA requirements that run in parallel with MDR cybersecurity guidance. Class I classification is likely for devices processing patient data or connected to clinical networks.
CRA Scope and Classification for Medical Devices
The CRA applies to medical devices that qualify as 'products with digital elements' — hardware devices with software components and network interfaces, embedded systems, and Software as a Medical Device (SaMD). The MDR does not exempt devices from the CRA; the two regulations apply concurrently, with the CRA adding cybersecurity-specific obligations on top of MDR's general safety requirements.
Under Annex III, devices that process patient health data, interface with hospital networks, or perform diagnostic or therapeutic functions via software are classified as Important Class I. Devices integrated into hospital critical infrastructure or life-support systems may qualify as Critical Class II. Manufacturers should conduct a product-by-product classification assessment and document the rationale. A connected infusion pump with remote monitoring is Class I; a standalone single-use diagnostic reader with no network interface may remain Default Class.
Key Technical Security Obligations for Medical Devices
Annex I Part I of the CRA imposes technical requirements that are directly relevant to medical device cybersecurity:
- Secure by default configuration: Devices must ship with only the minimum required services enabled. Default credentials are prohibited — a requirement that many legacy medical device platforms currently fail.
- Data confidentiality: Patient data transmitted over networks must be encrypted. Devices integrating HL7 FHIR or DICOM interfaces must protect those channels.
- Authenticated software updates: Firmware updates must be cryptographically signed and verified before installation. Remote update mechanisms must be tamper-resistant.
- Audit logging: Devices must maintain audit logs of security-relevant events accessible to authorised operators.
- SBOM maintenance: A software bill of materials covering all third-party libraries (including medical-specific stacks such as OpenSSL and FHIR libraries) must be maintained and updated throughout the product lifecycle.
MDR MDCG 2019-16 guidance on cybersecurity is closely aligned with these requirements, so manufacturers with mature MDR cybersecurity files will have a strong foundation for CRA conformity.
CVD Policy and Article 13 Requirements
Article 13 requires all manufacturers of products with digital elements to establish and publish a coordinated vulnerability disclosure policy. For medical device manufacturers, this overlaps with FDA cybersecurity guidance in the US (where applicable) and MDCG 2019-16 incident handling requirements in the EU.
The Article 13 CVD policy must be publicly accessible — typically via a security.txt file and a disclosure page — and must cover all CRA-scoped products. The policy must define submission channels, acknowledgement timelines, and the manufacturer's commitment to remediation. Medical device manufacturers must also notify their Notified Body of significant post-market security findings under MDR Article 87, creating a parallel notification track alongside the CRA's ENISA reporting pathway.
CVD Portal provides a single intake platform that can route medical device disclosures to both the internal PSIRT and the relevant regulatory notification workflows, reducing coordination overhead for compliance teams managing both MDR and CRA obligations simultaneously.
Article 14 Incident Reporting for Medical Devices
Article 14 of the CRA requires manufacturers to notify ENISA within 24 hours of becoming aware of an actively exploited vulnerability. For medical devices, an exploited vulnerability affecting patient safety — such as unauthorised modification of infusion pump dosing parameters or compromise of a diagnostic algorithm — constitutes a particularly high-severity incident requiring parallel notifications:
- ENISA under Article 14 CRA (24-hour initial notification)
- National competent authority under MDR Article 87 (serious incident reporting)
- CERT/national CSIRT as directed by the competent authority
Manufacturers must maintain internal procedures that can trigger all three tracks simultaneously. The CRA's 72-hour detailed report and 30-day final report timelines must be tracked separately from MDR's FSCA (Field Safety Corrective Action) and FSCA reporting timelines. CVD Portal's Article 14 timeline tool supports multi-track deadline tracking from a single incident record.
Conformity Assessment Pathway
Class I medical devices with digital elements require third-party conformity assessment by a CRA-accredited notified body. Manufacturers who already engage a notified body for MDR assessment may be able to use the same organisation for CRA assessment, depending on that body's accreditation scope — though these are separate assessments under separate regulations.
- Technical security architecture against Annex I Part I requirements
- Vulnerability management process maturity (Annex I Part II)
- CVD policy operational status
- SBOM completeness and update process
- Post-market surveillance integration with security monitoring
Manufacturers should initiate notified body engagement by Q4 2025 to allow sufficient time for gap assessment, remediation, and formal assessment before the September 2026 deadline. Evidence generated for MDR MDCG 2019-16 compliance — particularly the cybersecurity risk assessment and post-market surveillance plan — is directly reusable in the CRA technical file.
CVD Portal handles your CRA Article 13 obligations automatically.
Public CVD submission portal, 48-hour acknowledgment tracking, Article 14 deadline alerts, and CSAF advisory generation. Free forever for Medical Device Manufacturers.
Start your free portalFrequently asked
Does MDR compliance satisfy CRA requirements for medical devices?+
No. MDR and CRA are separate regulations with different scopes and obligations. MDR cybersecurity guidance (MDCG 2019-16) covers similar technical ground to CRA Annex I, and evidence prepared for MDR can be reused in the CRA technical file. However, the CRA introduces additional obligations not covered by MDR: an explicit public CVD policy (Article 13), mandatory ENISA incident reporting (Article 14), and a formal conformity assessment procedure specifically for cybersecurity. Manufacturers must satisfy both regulations independently.
Does SaMD (Software as a Medical Device) fall under the CRA?+
Yes. SaMD that is distributed as a standalone software product with digital elements — including mobile apps, cloud-based diagnostic platforms, and clinical decision support software — is within CRA scope if it is placed on the EU market. The CRA classification will depend on whether the software interfaces with critical infrastructure or processes sensitive health data. Class I is the expected classification for most networked SaMD. Manufacturers should note that IVDR (in vitro diagnostic regulation) products with software components are similarly within scope.
How does the 24-hour ENISA notification work for medical device incidents?+
Under Article 14, once a manufacturer becomes aware that a vulnerability in their product is being actively exploited, the 24-hour clock starts immediately. The initial notification to ENISA need not be comprehensive — it should confirm the product, indicate the nature of the exploitation, and describe any immediate mitigating measures in place. A detailed technical report is due within 72 hours, and a final report including root cause and long-term remediation within 30 days. These timelines run in parallel with, not in place of, MDR incident reporting obligations to the national competent authority.
Compliance checklists for your products
Key CRA articles for Medical Device Manufacturers
Need a CVD policy template for Medical Device Manufacturers?
Download a free CRA-compliant vulnerability disclosure policy and deploy it in minutes.