CRA Compliance for Medical Device Software: SaMD & Connected Health Devices

CRA-MDR Interaction

• MDR-regulated devices (Class IIa, IIb, III): Exempt from CRA cybersecurity requirements IF they meet MDR cybersecurity requirements. However, the CRA's vulnerability reporting obligations still apply.
• Class I medical devices: May fall under CRA for cybersecurity requirements not covered by MDR
• Health & wellness software (non-medical): Not MDR-regulated. Fully under CRA. This includes fitness trackers, wellness apps, and connected health devices not classified as medical devices.
• SaMD (Class IIa+): MDR takes precedence for cybersecurity, but CRA vulnerability reporting and SBOM requirements apply additionally

Key date: September 2026 — CRA vulnerability reporting obligations begin. Manufacturers must report actively exploited vulnerabilities within 24 hours.

Vulnerability Handling (CRA Art. 11)

• Coordinated vulnerability disclosure: Establish a process for receiving and handling vulnerability reports from researchers and users
• Security updates: Provide timely security patches throughout the product's support period (minimum 5 years or product lifetime)
• ENISA reporting: Report actively exploited vulnerabilities to ENISA within 24 hours of awareness
• User notification: Inform users of vulnerabilities and available patches without undue delay

SBOM & Supply Chain (CRA Art. 13)

• Software Bill of Materials: Machine-readable SBOM listing all components (minimum: top-level dependencies)
• Third-party component management: Monitor all dependencies for known vulnerabilities
• Secure development lifecycle: Documented SDLC with security testing at each stage
• Open-source component governance: Track and assess open-source components for security and licence compliance

• Threat modelling: STRIDE analysis for each component — patient safety risks must be elevated above typical IT risk
• Static analysis: SAST tools integrated into CI/CD pipeline
• Dependency scanning: Continuous vulnerability monitoring of all software dependencies (Trivy, Snyk)
• Penetration testing: Annual (minimum) penetration testing by independent testers
• Fuzzing: Protocol and API fuzzing for connected devices — especially for communication protocols

1. Now — Q3 2026: Establish vulnerability handling process and ENISA reporting capability (September 2026 deadline)
2. Q3 2026 — Q4 2026: Implement SBOM generation in CI/CD pipeline. Inventory all third-party components.
3. 2027: Full CRA compliance — secure development lifecycle, conformity assessment, technical documentation
4. Ongoing: Continuous vulnerability monitoring, security update delivery, and incident response