Premarket expectations, postmarket obligations, and the global regulatory map for device cybersecurity.
Article 14 goes live September 11. Actively exploited vulnerability? You owe ENISA an early warning within 24 hours. MDR devices are carved out, but your companion apps and cloud services may not be.
Software down-classification, a well established technology pathway, and a 30 day clock on reporting exploited vulnerabilities through Eudamed. The December proposal has teeth.
FDA added an MDIC white paper on penetration-testing validation methods to its cybersecurity page, following two MITRE papers on risk analysis and SBOM data quality. Read them as scoping hints for your submission.
The Digital Omnibus agreement postpones AI Act high-risk obligations for AI embedded in medical devices from August 2027 to August 2028. The transparency duties keep their 2026 date.
MHRA published the draft statutory instrument for its 2026 pre-market framework, adding explicit cybersecurity standards for software devices and a Predetermined Change Control Plan route for updates.
Final NIST IR 8259 Revision 1 restructures foundational cybersecurity activities across pre-market and post-market phases and expands what manufacturers must tell customers about support and end of life.
The December 2025 MDR/IVDR revision proposal writes cybersecurity into the GSPRs and adds Articles 87a/82a requiring manufacturers to report actively exploited vulnerabilities and severe incidents to CSIRTs and ENISA.
The German NIS2 implementation law entered into force in December 2025 with immediate effect. Medical device manufacturing is a NIS2 sector, so larger makers with German operations became important entities overnight.
Implementing Regulation (EU) 2025/2392 fixed the technical descriptions of important and critical products under the Cyber Resilience Act, including health-adjacent categories like wellness wearables.
The TGA updated its medical device cybersecurity guidance in October 2025, tying it to Essential Principle 12 and expecting manufacturers to maintain an SBOM and total-product-lifecycle monitoring.
The September 2025 IMDRF Management Committee approved a new work item on cybersecurity controls and testing considerations, the kind of document FDA, PMDA, TGA and EU regulators fold into converging expectations.
The June 2025 final guidance adds a section built around Section 524B: secure development evidence, a machine-readable SBOM, and a postmarket vulnerability plan, all expected in the submission itself.
Illumina settled DOJ allegations that it sold genomic sequencers with vulnerable software to federal agencies while lacking an adequate security program from 2016 to 2023. A former insider brought the case and takes $1.9 million.
A warning letter over quality system violations flagged open tickets for software defects categorized as catastrophic or severe patient harm, plus safety complaints reported late.
At The Medtech Conference, FDA’s Suzanne Schwartz called legacy device cybersecurity a work in progress and a problem regulators and industry have to solve together.