Cybersecurity and Medical Devices: Preparing for the Future of the European Regulation

From patient monitoring systems to implantable medical technologies, connected devices have revolutionized healthcare. However, this digital transformation comes with significant risks. Cyberattacks targeting hospitals and healthcare infrastructure have increased in recent years, putting patient safety, data privacy, and medical operations at risk.

As regulatory bodies worldwide tighten cybersecurity requirements, medical device manufacturers must proactively adapt to evolving standards. At Applus+ Laboratories, we believe cybersecurity should be a core component of medical device certification—not just for compliance but for the safety and trust of patients and healthcare providers.

Regulatory Landscape: What’s Changing?

The Cyber Resilience Act (CRA) and Medical Devices

The Cyber Resilience Act (CRA) aims to strengthen cybersecurity across all software and hardware products in the EU market. However, medical devices already fall under strict cybersecurity requirements within the Medical Device Regulation (MDR) and In Vitro Diagnostic Medical Device Regulation (IVDR), meaning that they are currently out of the CRA's direct scope.

Nevertheless, the European Commission’s Action Plan suggests a shift towards greater alignment between CRA and MDR/IVDR. The plan even encourages manufacturers of medical and in vitro diagnostic devices to voluntarily report cybersecurity vulnerabilities and incidents—a clear sign that regulators are considering future integration.

What does this mean for manufacturers?

While CRA compliance is not yet a formal requirement for medical devices, adopting its principles early could provide a competitive advantage and future-proof products against upcoming regulations.

The NIS2 Directive and Healthcare Cybersecurity

Another key regulation reshaping cybersecurity in healthcare is the NIS2 Directive. This European directive imposes stricter incident reporting and security measures on critical infrastructure, including healthcare providers.

For medical device manufacturers, this means:

• Stronger security risk management will be required across the supply chain.
• New reporting obligations for security breaches could indirectly affect device manufacturers collaborating with hospitals and healthcare facilities.
• Increased regulatory scrutiny on cyber resilience measures, which could push for a higher security standard in medical devices.

The FDA’s Cybersecurity Reinforcement

While Europe refines its cybersecurity strategy, the U.S. Food and Drug Administration (FDA) has already intensified its enforcement of cybersecurity standards for medical devices. In March 2023, the FDA mandated that all new medical devices must include a comprehensive cybersecurity plan to be approved for the U.S. market.

For companies seeking global market approval, meeting FDA requirements now and aligning with upcoming EU changes is crucial.

Applus+ Laboratories: A Proactive Approach to Cybersecurity Certification

At Applus+ Laboratories, we understand that cybersecurity is no longer an optional add-on—it is a regulatory and ethical necessity. That’s why we offer integrated cybersecurity evaluations to help manufacturers stay ahead of compliance requirements.

How We Help

• CRA-Based Cybersecurity Testing for medical devices, allowing manufacturers to meet high cybersecurity standards before they become mandatory.
• Regulatory Alignment Packages, combining EU MDR/FDA compliance with CRA principles, ensuring a holistic cybersecurity certification approach.
• Future-Ready Security Assessments, helping companies implement best practices that anticipate regulatory shifts, including NIS2 compliance and voluntary CRA adherence.

By taking a proactive approach, manufacturers can not only strengthen product security but also accelerate market entry and gain greater trust from regulatory bodies and healthcare providers.

The Future of Cybersecurity in Medical Devices

With increasing cyber threats and evolving regulations, the message is clear:

1. Cybersecurity in medical devices is not a future requirement—it’s a present necessity.
2. Aligning with FDA, NIS2, and CRA principles will ensure long-term market access and security.
3. A well-designed cybersecurity strategy will safeguard patients, data, and business continuity.

Is Your Company Ready for the New Cybersecurity Era in Medical Devices?

At Applus+ Laboratories, we’re here to help you navigate these challenges with cutting-edge cybersecurity testing and certification solutions. Contact us today to learn more!