Cyber Resilience Act readiness for healthtech products

The CRA covers products with digital elements - hardware and software commercially made available on the EU market whose intended or reasonably foreseeable use includes a direct or indirect data connection to a device or network. Remote data-processing solutions required for the product to perform a function form part of the product’s scope. Products regulated under certain other EU regimes, such as MDR and IVDR, are excluded to avoid duplication.

Software products supplied commercially and made available on the EU market can fall within the CRA. Pure services are outside the product-focused scope, but the boundary between a service and a product with digital elements is not always obvious. A product-level assessment is required to determine whether a given SaaS offering, on-premise application or component is treated as a CRA product.

Medical devices regulated under MDR and IVDs regulated under IVDR are excluded from CRA for those regulated products. This avoids duplicative cybersecurity conformity between the two regimes. MDR and IVDR cybersecurity duties continue to apply, and the exclusion does not extend to unrelated products or accessories.

Yes. A company may have an MDR-regulated medical application excluded from CRA while a separate customer portal, integration gateway, device-management tool or non-medical product remains in scope. Applicability must be assessed product by product, not company by company.

The reporting obligations for actively exploited vulnerabilities and severe incidents affecting product security apply from 11 September 2026. The main product-security, vulnerability-handling, documentation and conformity requirements apply from 11 December 2027.

Within 24 hours of becoming aware of an actively exploited vulnerability or severe incident, the manufacturer submits an early warning. Within 72 hours, the manufacturer provides the full notification with available information about the product, vulnerability or incident and its impact. Reports are submitted through the CRA Single Reporting Platform to the relevant CSIRT.

The main CRA requirements - product security, vulnerability handling, technical documentation, conformity assessment and market obligations - apply from 11 December 2027. Products placed on the market before that date are generally subject to the main requirements only if they undergo a substantial modification afterwards. Reporting obligations also apply to in-scope products already on the market.

No. Most ordinary products remain in the default category and manufacturer self-assessment is generally available. Important products in Class II and critical products typically require third-party conformity assessment. Being a healthtech or health-data product does not automatically place a product in a higher category.

Important products are those the CRA lists as having a higher cybersecurity risk profile, split into Class I and Class II. Critical products are subject to the strictest route and may require an applicable recognised certification. Classification depends on the product’s core functionality, not on the sector in which it is used.

The manufacturer defines a support period reflecting the expected use of the product, its dependencies and users’ reasonable expectations, and communicates the end date. Short support commitments can conflict with hospital procurement and clinical deployment cycles. The support model must be defensible against actual customer use.

No. ISO 27001 is an organisation-level information-security management system and does not replace CRA product conformity. It can, however, provide reusable governance and controls that support the CRA lifecycle, secure-development and vulnerability-handling work.

CRA is a product-security regulation that applies directly across the EU to products with digital elements. NIS2 is an organisational-cybersecurity directive implemented through national laws and focused on qualifying entities in essential and important sectors. A company can be affected by both, or by only one, depending on its products and its entity status.

The screening covers one defined product or closely related product family, determines whether it is likely in scope, identifies the applicable economic-operator role, checks whether an exclusion needs deeper analysis and highlights the CRA deadlines that matter. It ends with one of three clear outcomes: likely out of scope, likely in scope, or uncertain and requiring specialist legal or regulatory analysis.

CRA implementation is scoped individually after the CRA applicability screening (EUR 1,900, defined scope and output). Price depends on the number of products, product category, components, development maturity, support model, existing technical documentation, reporting readiness and any required conformity-assessment route. Notified-body fees, if applicable, are contracted and paid by the client directly. Prices exclude VAT where applicable.