Framework
Connected medical devices and software as a medical device must be securely developed, documented and monitored in the field under the MDR and IVDR. Complass guides manufacturers and suppliers of the medical technology industry from the threat model to vulnerability reporting.
The Medical Devices Regulation (EU) 2017/745 (MDR) and the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (IVDR) require software to be developed according to the state of the art, risk management to include information security and manufacturers to set out minimum requirements for hardware, IT networks and IT security measures. Guidance MDCG 2019-16 Rev. 1 explains what this means in practice.
Content as of:
The requirements apply to manufacturers of medical devices and in vitro diagnostic medical devices that contain software or are software. Suppliers of electronics, embedded software, radio modules or contract manufacturing are affected indirectly: manufacturers pass the requirements on to them through the quality management system and contracts and expect, for example, an SBOM, a security data sheet and commitments on updates.
Medical devices are excluded from the Cyber Resilience Act. Components with digital elements that are also sold on their own or outside medical technology, however, generally fall under the CRA. Manufacturers of medical devices and in vitro diagnostic medical devices of medium size or larger can additionally fall under NIS2 (Annex 2 BSIG).
This overview does not replace legal advice. The legal or normative text is authoritative; in Complass you check applicability with guidance based on the references.
Date of application and transitional periods according to the consolidated versions of the MDR and IVDR. A Commission proposal of 16.12.2025 (COM(2025) 1023) provides for additional reporting obligations for vulnerabilities; it has not yet been adopted.
Classification and role, secure development with risk management, minimum IT environment requirements, technical documentation, post-market surveillance and vigilance, plus a dedicated phase for suppliers.
Cyber requirements from the MDR and IVDR, measures according to MDCG 2019-16 and security activities in the life cycle with status and evidence, linkable with the CRA, IEC 62443 and ISO 27001.
Including security plan, threat model, security risk management file, SBOM register, minimum IT environment requirements, coordinated disclosure policy, patch and update concept and security agreement with suppliers.
SBOM matching against known vulnerabilities, recording of incidents and an overview of reporting deadlines.
Catalogue: MDR/IVDR requirements relevant to cybersecurity
Implement frameworks with guidance: phases, templates, document pyramid, catalogues, gap analysis, objectives and action plan up to the audit in the auditor portal.
Learn moreFind known vulnerabilities in your assets, prioritise them in context and work through them with recommendations and deadlines.
Learn moreRisk register with qualitative or quantitative assessment, risk appetite and treatment plan, linked to assets, vulnerabilities and incidents.
Learn moreThe medical technology industry template preselects the framework for the MDR and IVDR and the building blocks you need for the threat model, vulnerabilities and suppliers.
available
from €476 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
Indirectly, yes: your customers must demonstrate the MDR cyber requirements and expect information and commitments from you for this. If you also sell the component to other industries, the Cyber Resilience Act generally applies to it as well. The module contains a dedicated phase for suppliers.
No. Complass structures the cyber requirements and evidence and can be integrated into your existing QMS; conformity assessment and approvals remain with you and your notified body.
The module describes the activities in its own words with references to the clauses. You obtain the standard text itself from a standards distributor; you can store excerpts from your licensed edition in the project.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
