LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Global

The UK's draft device rules add explicit cybersecurity and a change-control path

MedDevice Cyber Staff · May 8 · 3 min read · Via Emergo by UL

MHRA published the draft statutory instrument for the future UK pre-market framework in May 2026. It moves UK essential requirements toward EU MDR and IVDR concepts, adds explicit cybersecurity standards for software medical devices, and introduces a Predetermined Change Control Plan pathway, the same idea gaining ground at FDA and IMDRF: pre-authorize a class of software and security updates so you are not filing a new submission for each patch.

A stakeholder survey closed in June, with adoption expected around December 2026 and entry into force roughly six months later, plus transition periods. If you sell into Great Britain, start building technical documentation that demonstrates cybersecurity against the new essential requirements, and design the PCCP route into your release process now, because it changes how fast you can ship a fix.

Sources

Emergo by UL ↗

Questions & Answers

What is in the MHRA draft statutory instrument?

The May 2026 draft moves UK essential requirements toward EU MDR and IVDR concepts, adds explicit cybersecurity standards for software medical devices, and introduces a Predetermined Change Control Plan pathway for pre-authorized software and security updates.

When does the new UK framework land?

Adoption is expected around December 2026 with entry into force roughly six months later, plus transition periods. Manufacturers selling into Great Britain should build cybersecurity evidence against the new essential requirements now.

← Back to FDA & Regulation

The UK's draft device rules add explicit cybersecurity and a change-control path

Questions & Answers

What is in the MHRA draft statutory instrument?

When does the new UK framework land?

More FDA & Regulation