LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Policy

One month to CRA reporting. The MDR exemption is thinner than it looks

MedDevice Cyber Staff · 6 days ago · 4 min read · Via European Commission

CRA reporting obligations start September 11, 2026. From that day, if you learn a vulnerability in your product is being actively exploited, ENISA and your national CSIRT get an early warning within 24 hours. Fuller notification at 72 hours. Final report inside 14 days.

Medical devices under MDR and IVDR are excluded from CRA scope. A lot of regulatory teams stopped reading there. Too comfortable. Companion apps, cloud services, accessories, general purpose software: if it sits outside MDR classification, it can be in scope. Ship a phone app with your device and part of your stack may owe Brussels a report.

And the exemption has a shelf life. The Commission’s MDR revision proposal imports the same reporting requirements into device regulation itself, through Eudamed. Brussels is not exempting the idea. Just delaying it.

Treat September 11 as a dress rehearsal. If your PSIRT can’t produce a 24 hour early warning today, that’s the gap. Not the paperwork.

Sources

European Commission ↗

← Back to FDA & Regulation

One month to CRA reporting. The MDR exemption is thinner than it looks

More FDA & Regulation