LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Regulation

The MDR revision makes cybersecurity a core requirement, with a reporting clock

MedDevice Cyber Staff · Dec 17 · 4 min read · Via Osborne Clarke

The Commission published its targeted MDR and IVDR revision in mid-December 2025. Cybersecurity becomes an integral part of the Annex I general safety and performance requirements: data integrity, confidentiality, availability, secure updates, network connectivity.

Then the teeth. New Articles 87a MDR and 82a IVDR require reporting of actively exploited vulnerabilities and severe security incidents to CSIRTs and ENISA, channelled through Eudamed alongside vigilance, using CRA definitions on a lex specialis basis. That is CRA-style dual-track reporting arriving inside device regulation: safety vigilance in one lane, cyber vulnerability and incident notifications in the other. The Commission is targeting applicability around 2027 after Parliament and Council negotiate.

Plan for two reporting pipelines and for cybersecurity checked as a core GSPR at conformity assessment. The direction is fixed even if the final dates move.

Sources

Osborne Clarke ↗

Questions & Answers

What does the MDR revision change on cybersecurity?

The December 2025 proposal writes cybersecurity into the Annex I general safety and performance requirements, covering data integrity, confidentiality, availability, secure updates and network connectivity, checked at conformity assessment.

What are Articles 87a and 82a?

New reporting duties: manufacturers must report actively exploited vulnerabilities and severe security incidents to CSIRTs and ENISA through Eudamed, using CRA definitions, alongside the existing safety vigilance lane. The Commission targets applicability around 2027.

← Back to FDA & Regulation

The MDR revision makes cybersecurity a core requirement, with a reporting clock

Questions & Answers

What does the MDR revision change on cybersecurity?

What are Articles 87a and 82a?

More FDA & Regulation