LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Global

IMDRF greenlit a new cybersecurity work item in Sapporo

MedDevice Cyber Staff · Sep 22 · 3 min read · Via MedTech Europe

The 28th IMDRF Management Committee met in Sapporo in mid-September 2025, chaired by Japan PMDA, and approved a new work item for the cybersecurity working group: guidance on cybersecurity controls and testing considerations, extending the existing N60, N70 and N73 family.

IMDRF documents are not law anywhere. They are the draft national regulators quietly converge on, so watching this working group is watching your future submission requirements take shape. The committee also pushed a Predetermined Change Control Plan draft into a 60-day consultation, the mechanism that lets you pre-authorize software and security updates instead of resubmitting for each one.

Security testing evidence, penetration and fuzzing and verification, is what the new work item points at. If you are not generating that evidence in a form a regulator will accept, the harmonized guidance will eventually make you.

Sources

MedTech Europe ↗

Questions & Answers

What did IMDRF approve at the Sapporo meeting?

The September 2025 Management Committee, chaired by Japan’s PMDA, approved a new cybersecurity work item on controls and testing considerations, extending the N60, N70 and N73 guidance family, and moved a Predetermined Change Control Plan draft into a 60-day consultation.

Why do IMDRF documents matter if they are not law?

National regulators converge on them. FDA, PMDA, TGA and EU authorities fold IMDRF guidance into their own expectations, so the working group’s output previews future submission requirements, especially security testing evidence.

← Back to FDA & Regulation

IMDRF greenlit a new cybersecurity work item in Sapporo

Questions & Answers

What did IMDRF approve at the Sapporo meeting?

Why do IMDRF documents matter if they are not law?

More FDA & Regulation