MDR Cybersecurity Reporting Obligations Close the CRA Gap for Medical Devices
On December 16, 2025, the European Commission presented its simplification proposal COM(2025) 1023 for the Medical Devices Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation (IVDR). Most attention went to the measures on classification, notified bodies, and conformity assessment procedures. Less visible, but important for cybersecurity law, is a block of two new articles. They close a gap that has so far existed between the medical device regulations and the Cyber Resilience Act (CRA).
At a glance
- Proposal COM(2025) 1023 adds Article 87a MDR and Article 82a IVDR. They introduce reporting obligations for actively exploited vulnerabilities and severe incidents in medical devices and in vitro diagnostic medical devices.
- The recipients are the computer security incident response teams (CSIRTs) designated as coordinators in the Member States where the device has been made available, and ENISA, the EU Agency for Cybersecurity. This mirrors reporting under the Cyber Resilience Act.
- Manufacturers report via Eudamed. The CSIRTs and ENISA get direct access to this European database on medical devices for that purpose.
- The reporting deadline is a uniform 30 days after becoming aware. This differs clearly from the staggered CRA deadlines (24 hours, 72 hours, and a final report after 14 days or one month).
- Annex I of the MDR and the IVDR is amended: cybersecurity is named explicitly as part of the general safety and performance requirements.
- The proposal is not yet adopted. The public consultation ended in early May 2026. The European Parliament is expected to set its position in December 2026, and entry into force is realistic at the earliest in the course of 2027.
What happened?
With proposal COM(2025) 1023, the Commission responds to criticism of the MDR and IVDR that has continued since 2024: procedures that are too complex, a lack of predictability, disproportionate burdens on small and medium-sized enterprises (SMEs), and bottlenecks at notified bodies. The proposal is designed as a targeted simplification. Its explanatory memorandum groups the changes into eight topics, from simplification and proportionality to the interplay with other Union legislation.
The new cybersecurity reporting obligations sit in the eighth topic, “Interplay with other Union legislation.” Recital 44 of the proposal names the underlying gap directly. Medical devices are excluded from the Cyber Resilience Act. The MDR and IVDR vigilance system does cover cybersecurity incidents if they qualify as serious incidents, but cybersecurity-related incidents that concern neither public health nor patient safety are not reported. The Commission calls this “an important cybersecurity gap” and closes it with two new articles.
What changes in detail?
The core change has three elements: a precise definition of what must be reported, a new reporting obligation via Eudamed, and an explicit reference to cybersecurity in Annex I. The following sections trace how this works.
What is an actively exploited vulnerability?
Article 3(42) of the Cyber Resilience Act (Regulation (EU) 2024/2847) defines an actively exploited vulnerability as “a vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner.” The new Article 87a MDR refers to exactly this definition.
Today: vigilance based on patient safety, no cybersecurity reporting
Under the current framework, manufacturers of medical devices report serious incidents and field safety corrective actions to the competent authorities under Article 87 MDR. Serious means death or a serious deterioration in a person's state of health, or the potential for either. Cybersecurity incidents that affect the integrity or availability of a device but have no direct impact on patient safety are not covered by this obligation. Because medical devices are also explicitly excluded from the Cyber Resilience Act, there is currently no mandatory reporting channel for these cases.
In future: an additional cybersecurity obligation via Eudamed
The new Article 87a MDR (and in parallel Article 82a IVDR) requires manufacturers to report each of the following events:
- any actively exploited vulnerability in the device within the meaning of Article 3(42) of the CRA
- any severe incident within the meaning of Article 14(5) of the CRA that has an impact on the security of the device
Manufacturers report through the electronic system referred to in Article 92 MDR, that is, through Eudamed. The report is made available at the same time to the CSIRTs designated as coordinators of the Member States in which the device has been made available and to ENISA. A vigilance report under Article 87 MDR is also mirrored to the CSIRTs and ENISA if its subject also qualifies as an actively exploited vulnerability or a severe incident. These bodies get access to Eudamed for this purpose.
Deadlines compared
| Regime | Deadline for actively exploited vulnerabilities and severe incidents |
|---|---|
| Cyber Resilience Act, Article 14 | Early warning notification within 24 hours, notification within 72 hours, final report no later than 14 days after a corrective or mitigating measure is available (vulnerabilities) or within one month after the incident notification (severe incidents) |
| MDR proposal, Article 87a | 30 days after becoming aware |
The proposal takes over the definitions and the types of recipients from the CRA, but not its staggered deadlines. The uniform 30-day deadline is considerably longer than the CRA's early warning deadline. The nature of medical devices and the parallel logic of vigilance reporting can explain this. If you already set up CRA-compliant processes, you will meet this deadline easily. If you work only with MDR vigilance processes, you must extend your vulnerability triage.
Cybersecurity in Annex I
Alongside the new reporting obligation, the proposal amends Annex I of the MDR (Section 17.4) and Annex I of the IVDR (Section 16.4). Manufacturers would have to set out minimum requirements concerning hardware, IT networks, IT security measures, and cybersecurity necessary to run the software as intended. So far, these sections mention only IT security measures, including protection against unauthorized access, and the industry has derived further requirements from the general safety provisions and from the MDCG guidance on cybersecurity. The proposal anchors the requirement explicitly.
What this means for manufacturers
Some medical devices are particularly relevant for cybersecurity. Examples are networked infusion pumps with a wireless connection, imaging equipment with remote maintenance, point-of-care (POC) diagnostics with a cloud component, and patient monitors in OT networks. For their manufacturers, the regulatory logic shifts in three places.
First, triage becomes more complex. So far, you had to assess an event against one question: is it a serious incident that must be reported under Article 87 MDR? In future, a second question is added: is there an actively exploited vulnerability or a severe incident that affects the device? The two assessments are independent of each other, and both can trigger reporting obligations, also at the same time.
Second, more people are involved in incident management. Cybersecurity staff and vigilance staff must bring their processes together. Otherwise, a cybersecurity incident without a link to patients never reaches the reporting path. If you currently separate the two roles in terms of staff and organization, you should look at the interfaces.
Third, Eudamed becomes the shared channel for different groups of recipients. The CSIRTs designated as coordinators and ENISA are already known in cybersecurity from the CRA and from the NIS2 Directive. With the proposal, they get a formal channel into the medical device regime for the first time.
The mechanism therefore resembles reporting under the Cyber Resilience Act but remains anchored in sector law. Some companies manufacture products in scope of the CRA as well as medical devices, for example as suppliers of components used in both. They must master both reporting paths without mixing them up.
With CRA-compliant processes, you can meet the 30-day deadline
The templates describe the reporting process under the Cyber Resilience Act: vulnerability triage, responsibilities, escalation paths, and deadline tracking. If you manufacture medical devices as well as products in scope of the CRA, you need this structure for both reporting paths.
When will this apply?
The proposal is not in force. The public consultation ended on May 6, 2026. In the European Parliament, the lead committee's draft report has been available since the end of June 2026, and the plenary vote is provisionally scheduled for December 2026. Only after that can trilogue negotiations begin, so adoption is realistic at the earliest in the course of 2027. Under Article 5(3)(c) of the proposal, the new Articles 87a MDR and 82a IVDR would apply only three years after the amending regulation enters into force. Most other changes, including the amendment of Annex I, would apply six months after entry into force. Until then, the MDR and IVDR continue to apply in their current version, including the existing vulnerability management requirements.
Frequently asked questions
Will medical devices fall under the Cyber Resilience Act in future?
No. The Cyber Resilience Act continues to exclude medical devices and in vitro diagnostic medical devices. Proposal COM(2025) 1023 only takes over the definitions and the recipients of notifications from the CRA. It places the obligation directly in the MDR and the IVDR.
How does Article 87a MDR differ from CRA reporting?
The definitions and the types of recipients come from the CRA, the deadlines do not. Unlike under the CRA, the report goes to the coordinators of all Member States where the device has been made available. The CRA requires an early warning notification within 24 hours and a notification within 72 hours. For a vulnerability, the final report is due no later than 14 days after a corrective or mitigating measure is available. For a severe incident, it is due within one month after the incident notification. The MDR proposal provides for a uniform 30-day deadline after becoming aware.
Which vulnerabilities must be reported?
Only vulnerabilities for which there is reliable evidence of active exploitation by a malicious actor must be reported. A purely theoretical vulnerability, for example one discovered in a penetration test, does not fall under the reporting obligation. It does fall under the regular vulnerability management obligations.
What happens if an incident is relevant for both vigilance and cybersecurity?
You report the incident once via Eudamed, and it is transmitted at the same time to the vigilance authorities, the CSIRTs, and ENISA. According to the explanatory memorandum, the additional obligation covers only events that are not serious incidents, so a second report is not intended.
Do the new obligations also apply to devices already on the market?
The proposal contains transitional provisions for ongoing conformity assessment procedures and for existing certificates. For the new reporting obligations, the proposal contains no specific rule for devices already on the market. Article 87a refers to devices made available in a Member State and would apply three years after the amending regulation enters into force. Whether this changes during the legislative procedure remains to be seen.
