Blog
Notes on FDA, EU MDR and UK cybersecurity expectations for medical devices, written for QA/RA and software leads.
Alan ParkinsonSince the MDR came into force, ISO 27001 has become common advice for medical device manufacturers. It's a sensible place to start, but it isn't the standard your notified body is checking against. Here's how ISO 27001 and IEC 81001-5-1 fit together as two gates with shared evidence.
Alan ParkinsonQuick answer: You can export an SBOM from GitHub's dependency graph and use Dependabot alerts to flag known vulnerabilities. For repositories using supported package managers (npm, pip, Maven, NuGet), this gives you a reasonable starting point. But an SBOM export and a list of dismissed alerts is not what the FDA expects in your eSTAR cybersecurity section. The gaps are significant, and they tend to surface at exactly the wrong moment.
Alan ParkinsonThe FDA published an updated version of its premarket cybersecurity guidance on 3rd February 2026, one day after the QMSR took effect. If you spotted it and felt a familiar twinge of "what's changed now?", the short version: this is a terminology update, not a new set of requirements.
Alan ParkinsonThe UK Medical Devices Regulations 2002 contain no explicit cybersecurity requirements. The word doesn't appear once. Yet new postmarket surveillance rules now require reporting security incidents within 15 days and treating security patches as Field Safety Corrective Actions. Where UK medical device cybersecurity stands in 2026, and where it doesn't.
Alan ParkinsonThe first-of-its-kind cybersecurity settlement shows the DoJ is serious about backing up FDA requirements with real consequences. Here's what QA and RA teams need to know.
Newsletter
Practical cybersecurity regulatory insights and guides for medical device teams. Free, no spam, unsubscribe anytime.