LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Policy

The EU pushed high-risk AI obligations for medical devices to 2028

MedDevice Cyber Staff · May 13 · 3 min read · Via Gibson Dunn

A provisional political agreement on the Digital Omnibus, reached in early May 2026 and confirmed by member states days later, moves the AI Act high-risk obligations for AI embedded in medical devices from August 2027 to August 2028. That covers AI under MDR conformity assessment: risk management, data governance, logging, robustness and the Article 15 cybersecurity requirements. Standalone high-risk systems move to December 2027, and the Article 50 transparency duties keep their August 2026 date.

A year of breathing room on the heaviest AI obligations. It does not touch the MDR cyber timelines, and it does not make the work smaller, only later. Spend the extra year on the parts that take longest to build, data governance and logging on an AI-enabled device, rather than treating the delay as a reason to stop.

Sources

Gibson Dunn ↗

Questions & Answers

What did the Digital Omnibus change for medical device AI?

High-risk AI Act obligations for AI embedded in medical devices move from August 2027 to August 2028, covering risk management, data governance, logging, robustness and the Article 15 cybersecurity requirements. Standalone high-risk systems move to December 2027.

Did every AI Act date move?

No. The Article 50 transparency duties keep their August 2026 date, and MDR cyber timelines are untouched. The work stays the same size, only later, so the extra year belongs to the slowest parts, data governance and logging.

← Back to FDA & Regulation

The EU pushed high-risk AI obligations for medical devices to 2028

Questions & Answers

What did the Digital Omnibus change for medical device AI?

Did every AI Act date move?

More FDA & Regulation