Crosswalks
US vs EU medical device cybersecurity, side by side
Since March 2023 the US has a device-specific cybersecurity law, section 524B of the FD&C Act, enforced through FDA's premarket review. The EU has no separate device cybersecurity law; cybersecurity sits inside the MDR's general safety and performance requirements and is explained by MDCG guidance. Manufacturers selling in both markets can usually build one security file, but the US expects it to be submitted and the EU expects it to be audited.
By Christian Espinosa, Founder, Blue Goat Cyber
Legal basis and scope
| Topic | United States (FDA) | European Union (MDR) | What differs |
|---|---|---|---|
| Primary law | FD&C Act section 524B, for cyber devices21 U.S.C. 360n-2 | MDR GSPRs on IT security and protection against unauthorised accessMDR Annex I, sections 14.2(d), 17.2, 17.4, 18.8 | 524B applies to devices that include software, can connect to the internet and could be vulnerable. The MDR requirements apply to all devices with software or electronic programmable systems. |
| Main guidance | FDA premarket cybersecurity guidance (Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions)FDA guidance | MDCG 2019-16, Guidance on Cybersecurity for medical devicesMDCG 2019-16 | Both are guidance, not law, but reviewers and notified bodies use them as the yardstick. |
| Related horizontal laws | None specific to devices beyond 524B- | Cyber Resilience Act excludes MDR devices; NIS2 can apply to manufacturers as entitiesRegulation (EU) 2024/2847, Directive (EU) 2022/2555 | Check NIS2 national transposition for whether your company is in scope. |
Premarket evidence
| Topic | United States (FDA) | European Union (MDR) | What differs |
|---|---|---|---|
| Secure development process | Secure product development framework (SPDF)524B(b)(2) | Secure lifecycle per IEC 81001-5-1MDR Annex I 17.2, harmonisation pending | IEC 81001-5-1 satisfies both expectations in practice and is FDA-recognized. |
| Threat and risk analysis | Threat modeling and security risk managementFDA premarket guidance | Security risk management integrated with ISO 14971MDCG 2019-16 section 3 | AAMI TIR57 is the common method for linking security risk to safety risk. |
| Software bill of materials | SBOM required in the submission524B(b)(3) | Not named in the MDR; expected by notified bodies as good practiceMDCG 2019-16 | An SBOM built for FDA can be reused in the EU technical documentation. |
| Security testing | Penetration testing, fuzzing and vulnerability scanning evidenceFDA premarket guidance | Verification and validation of security controlsMDR Annex I 17.2, MDCG 2019-16 | Report formats differ little; the US reviewer reads the results, the EU notified body audits them. |
| Labeling | Cybersecurity information for users and an end-of-support dateFDA premarket guidance | Minimum IT requirements and security information in the IFUMDR Annex I 23.4(ab) | Both expect users to be told how to operate the device securely. |
Post-market
| Topic | United States (FDA) | European Union (MDR) | What differs |
|---|---|---|---|
| Vulnerability handling | Plan to monitor, identify and address vulnerabilities, including coordinated disclosure524B(b)(1) | Post-market surveillance must cover security; vulnerabilities handled through PMS and vigilanceMDR Articles 83 to 92, MDCG 2019-16 | Both expect a public way for researchers to report vulnerabilities. |
| Updates and patches | Updates and patches on a reasonably justified cycle, and out of cycle for critical risks524B(b)(2) | Changes assessed under the QMS and, if significant, by the notified bodyMDR Article 120 and Annex IX | In both markets, a security patch rarely needs a new submission, but document the assessment. |
| Scoring | CVSS commonly used, with a medical device rubricFDA-recognized CVSS rubric (MITRE) | CVSS commonly used; no mandated methodMDCG 2019-16 | Translate exploitability into patient harm before prioritising fixes. |
| Incident reporting | Reported through MDR or corrections and removals when safety is affected21 CFR Parts 803 and 806 | Serious incident or FSCA under vigilance when safety is affectedMDR Articles 87 and 89 | A vulnerability alone is not always reportable; the safety impact decides. |
Primary sources
- FD&C Act section 524B (21 U.S.C. 360n-2)
- Regulation (EU) 2017/745 (MDR), Annex I
- MDCG endorsed guidance (includes MDCG 2019-16)
Educational summary, not legal advice. Always check the current text of the law and guidance.