The Cyber Resilience Act will apply to medical devices, but perhaps not the way you think.
MDs and IVDs are not directly covered by the CRA.
The MDR and the IVDR are already very demanding on the subject.
But here is what you should not miss.
Your medical device may include digital components made by third parties: embedded software, connectivity modules, control interfaces.
Those suppliers fall under the CRA. From September 2026, they will have to report any confirmed vulnerability in their products. And by December 2027, all connected digital products sold in the EU will have to meet strict cybersecurity requirements.
What does this mean for your teams, in practice?
- Build the CRA compliance of digital components into your existing quality processes.
- Monitor vulnerabilities and follow up security updates throughout the product life cycle.
- Document every action (patches, follow-up, compliance) in a traceable, auditable way.
- Take on the manufacturer's responsibility: if a supplier does not maintain its components, it is the manufacturer's product that is affected.
Healthcare remains the third sector most affected by cyber risk.
This is not a context in which you can afford to manage component traceability in a shared Excel spreadsheet.
The CRA does not target you directly. But it adds to the production control and traceability requirements. And if your quality system is not structured to absorb this extra pressure, you are taking risks.
There is a reliable solution, adopted by MedTech companies, for adapting to these requirements: production tracking and quality software.
Does that seem out of reach? Our software Arianis is designed for growing startups and SMEs, from its pricing to its ease of use.
Get an overview at cerebellis.com/en/arianis and book a short demo.
