Who it’s for
You develop connected medical devices, software as a medical device or in vitro diagnostics, or you supply electronics and firmware for them. The MDR and IVDR require cybersecurity across the entire life cycle. Complass guides you from the threat model to reporting in the field.
Notified bodies check Annex I sections 17.2 and 17.4 MDR. If the threat model, security risk file or SBOM is missing, the conformity assessment is delayed.
Operating systems and libraries age faster than a medical device. You have to detect, assess and if necessary report new vulnerabilities in the field.
Without SBOMs, security information and update commitments from suppliers, your own documentation remains incomplete.
The requirements apply per product, before and after placing on the market. The main points:
Frameworks: Medical devices · NIS2 · ISO 27001
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
No CRA for medical devices. Medical devices and in vitro diagnostics are excluded from the Cyber Resilience Act (Art. 2(2) CRA). Components that you also sell outside medical technology, however, generally fall under the CRA. Go to the page for manufacturers
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Devices with network connection, remote maintenance or radio module, from infusion pumps to imaging systems.
Standalone software and apps with a medical intended purpose, often with a cloud component.
Analysers and laboratory software under the IVDR, with the same requirements for software and the IT environment.
Electronics, embedded software and contract manufacturing: your customers pass the requirements on to you.
From classification through secure development and technical documentation to surveillance, vigilance and a dedicated phase for suppliers.
More about this featureMaintain an SBOM per product, match it against known vulnerabilities and record the assessment for post-market surveillance.
More about this featureWork through attack paths with MITRE ATT&CK and assess them as security risks in the risk register.
More about this featureRequest and review security information, SBOMs and update commitments directly from your suppliers.
More about this feature
The medical technology industry template preselects the framework for the MDR and IVDR and the building blocks you need for the threat model, vulnerabilities and suppliers.
available
from €476 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
The package for manufacturers is geared to the Cyber Resilience Act. Medical devices are excluded from it and are subject to the MDR and IVDR instead. The medical technology package is therefore built on the framework for medical devices.
Hospitals increasingly expect an SBOM, the minimum requirements for the IT environment and commitments on updates. You maintain this information per product in Complass and keep it up to date for tenders.
Yes, from medium size onwards, because the manufacture of medical devices and in vitro diagnostics is listed in Annex 2 of the German BSI Act. NIS2 then concerns your company, the MDR and IVDR your products. Complass handles both in the same account.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
