Complass
Cybersecurity for medical devices (MDR/IVDR)
For manufacturers of medical devices and in vitro diagnostics with software or network connectivity, and their suppliers: what the MDR and IVDR require on cybersecurity, how MDCG 2019-16 interprets it and how you demonstrate it from development to vigilance reporting.
The MDR and IVDR have no chapter on cybersecurity, but Annex I requires software in line with the state of the art including information security, and minimum requirements for the IT environment. The non-binding MDCG 2019-16 Rev. 1 guidance is, in practice, the benchmark notified bodies use to assess them.
The whitepaper leads from the threat model and the interplay of security and safety risk management via SBOM, testing, operator information and technical documentation to vulnerabilities, updates and the vigilance deadlines of Art. 87 MDR. It delimits the CRA, NIS2 and the AI Act, presents the amending proposal COM(2025) 1023 expressly as a proposal, and closes with supplier obligations, a roadmap, a practice example and a checklist.
Short "Implementation in Complass" boxes with platform screenshots show SBOM, vulnerability management and document control: only features already live are named, the medical devices framework as "coming soon".
16 pages · Version 1.0 · as of 07.10.2026 · Author Marc Linden, Complass GmbH i. G.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.