Premarket expectations, postmarket obligations, and the global regulatory map for device cybersecurity.
The Senate passed S. 3315, the Health Care Cybersecurity and Resiliency Act, by unanimous consent on September 30. It sets mandatory MFA, encryption, continuous monitoring, and penetration testing for every HIPAA covered entity and business associate.
Sens. Ron Wyden and Mark Warner reintroduced the Health Infrastructure Security and Accountability Act on September 17, two years after the Change Healthcare attack first prompted it. The bill sets mandatory HIPAA security standards, requires CEO and CISO sign off on annual attestations, and ties penalties as high as $250,000 to uncorrected willful neglect.
Health-ISAC's Medical Device Security Council published nine capability domains for hospitals to score medical devices against, and any device that misses one now needs a documented exception with a named executive attached.
HSCC's Greg Garcia told a House subcommittee that patching legacy medical devices is not enough, and asked Congress to fund outright replacement alongside two pending cybersecurity bills.
ENISA updated its list of CSIRTs designated as coordinators on September 4, 2026, covering all 27 member states, one week before Article 14 reporting obligations apply on September 11. The Single Reporting Platform launches with no API and no support for voluntary reporting under Article 15. Registration runs through EU Login with multi factor authentication, and platform downtime does not pause the 24 hour clock.
A federal court in Colorado granted preliminary approval on August 21, 2026 to a settlement of up to $15 million in Jenkins et al. v. DaVita Inc., resolving class litigation over the April 12, 2025 Interlock ransomware attack that compromised data on 2,689,826 dialysis patients. Class members can claim up to $2,500 in documented losses plus a cash payment expected near $50.
FDA's device center opened docket FDA-2026-N-7874 on August 18 with a discussion paper on generative AI enabled medical devices. It floats a two-axis risk framework, competency style premarket evaluation, and risk-proportionate postmarket monitoring that folds in cybersecurity and update handling. Comments are due October 19, 2026.
Article 14 goes live September 11. Actively exploited vulnerability? You owe ENISA an early warning within 24 hours. MDR devices are carved out, but your companion apps and cloud services may not be.
Software down-classification, a well established technology pathway, and a 30 day clock on reporting exploited vulnerabilities through Eudamed. The December proposal has teeth.
CISA published the 2026 Minimum Elements for a Software Bill of Materials on July 29, replacing the NTIA baseline in force since July 2021. The NSA, the FBI and 15 international partner agencies co-sealed it. Ten data fields are new, among them Component Hash Value, Component Hash Algorithm and SBOM Generation Context, and FDA premarket guidance still points at the document CISA just superseded.
FDA added an MDIC white paper on penetration-testing validation methods to its cybersecurity page, following two MITRE papers on risk analysis and SBOM data quality. Read them as scoping hints for your submission.
The Digital Omnibus agreement postpones AI Act high-risk obligations for AI embedded in medical devices from August 2027 to August 2028. The transparency duties keep their 2026 date.
MHRA published the draft statutory instrument for its 2026 pre-market framework, adding explicit cybersecurity standards for software devices and a Predetermined Change Control Plan route for updates.
Final NIST IR 8259 Revision 1 restructures foundational cybersecurity activities across pre-market and post-market phases and expands what manufacturers must tell customers about support and end of life.
The December 2025 MDR/IVDR revision proposal writes cybersecurity into the GSPRs and adds Articles 87a/82a requiring manufacturers to report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA.
The German NIS2 implementation law entered into force in December 2025 with immediate effect. Medical device manufacturing is a NIS2 sector, so larger makers with German operations became important entities overnight.
Implementing Regulation (EU) 2025/2392 fixed the technical descriptions of important and critical products under the Cyber Resilience Act, including health-adjacent categories like wellness wearables.
The TGA updated its medical device cybersecurity guidance in October 2025, tying it to Essential Principle 12 and expecting manufacturers to maintain an SBOM and total-product-lifecycle monitoring.
The September 2025 IMDRF Management Committee approved a new work item on cybersecurity controls and testing considerations, the kind of document FDA, PMDA, TGA and EU regulators fold into converging expectations.
The June 2025 final guidance adds a section built around Section 524B: secure development evidence, a machine-readable SBOM, and a postmarket vulnerability plan, all expected in the submission itself.
Illumina settled DOJ allegations that it sold genomic sequencers with vulnerable software to federal agencies while lacking an adequate security program from 2016 to 2023. A former insider brought the case and takes $1.9 million.
A warning letter over quality system violations flagged open tickets for software defects categorized as catastrophic or severe patient harm, plus safety complaints reported late.
At The Medtech Conference, FDA’s Suzanne Schwartz called legacy device cybersecurity a work in progress and a problem regulators and industry have to solve together.