MDR, IEC 62304, ISO 14971, ISO 13485: you already meet more safety and quality requirements than most industries. We build on that instead of duplicating it: we clarify where the CRA and the AI Act additionally apply and what is exempt, and we integrate cybersecurity with your existing QM and risk management.
Book an intro callQuestions we keep hearing from regulatory, quality and R&D teams.
Certain sector-regulated medical devices are exempt from the CRA, but not every product in your portfolio falls under that exemption. Companion software without a medical purpose, platforms or accessories may be in scope. The scoping decision determines your effort.
More than you might think. Risk management, development processes, CAPA and post-market surveillance provide building blocks that can be credited towards cybersecurity. What is usually missing is the security-specific extension, not a rebuild.
Three legal acts, overlapping requirements, different deadlines. Without the full picture you risk duplicate documentation and contradictory processes. You need a map, not a third parallel structure.
Cybersecurity has long been an audit topic, in MDR audits as well as in the technical documentation review. Findings cost time and, in the worst case, market access. Properly integrated security evidence takes the fear out of the topic.
Three legal frameworks, one product. What matters is clean scoping: what applies, what is exempt, and from when.
The MDR's safety requirements already apply today, and your existing standards cover a lot of ground.
Medical devices under the MDR/IVDR are exempt from the CRA. The exemption ends at the product boundary, though.
AI/ML in medical devices qualifies as product-regulated high-risk AI under Annex I of the AI Act.
Scoping is rarely trivial in practice and determines effort and timeline. That is exactly what we clarify together in the intro call.
We build on what your QM system already delivers and add precisely what is missing for cybersecurity.
We classify your product portfolio: what falls under the CRA exemption, what does not, and where the AI Act applies. So you spend effort where it is actually required by regulation.
Risk management per ISO 14971, development processes per IEC 62304, CAPA and post-market surveillance: we identify which artefacts you can reuse for cybersecurity and close only the real gaps.
We set up vulnerability management, PSIRT and reporting processes as extensions of your existing QM processes, with clear responsibilities and audit-proof documentation.
We integrate threat model, security risk analysis, SBOM and test evidence into your technical documentation so that notified bodies and auditors see one consistent picture.
Fixed prices, clearly defined scope, defined deliverables. Each package can be booked individually and builds on your existing QM artefacts.
€2,000
Where does your product stand against the cybersecurity requirements? Crediting what ISO 13485 and ISO 14971 already cover.
from €4,900
The security overview of your product portfolio: within three to five days we test your entire external attack surface for the most critical and most common vulnerabilities, automated and manually validated.
from €2,200
Bring your team up to speed: secure development, threat modeling and regulatory context, in the MedTech variant with greater regulatory depth.
All prices excl. VAT. No package fits exactly? In the intro call we work out which scope makes sense for your product.
Regulatory depth and development practice from a single source.
We know the MDR, IEC 62304, ISO 14971 and ISO 13485 from projects, not from the textbook. We speak the language of your notified body and your QM team.
Over ten years of software development in digital health: threat modeling, secure architectures and security testing that works in day-to-day development rather than just on paper.
Regulatory assessment and technical implementation come from one team, without friction and without the overhead of a large consultancy.
Only partially. The exemption applies to products that are already sector-regulated, in particular under the MDR and IVDR. It ends at the product boundary, though: companion software without a medical purpose, platforms, accessories or products outside the MDR may fall under the CRA. We clarify per product whether and where this affects you in the intro call.
Quite a bit. Your ISO 14971 risk management can be extended to cover security risks instead of building a second risk management system. Development processes per IEC 62304, CAPA, post-market surveillance and your documentation structure provide further building blocks. In the gap analysis we state precisely what can be credited and what needs a security-specific addition.
Annex I of the MDR already requires state-of-the-art IT security; MDCG 2019-16 and IEC 81001-5-1 specify what that means in practice. Cybersecurity is therefore not a new rulebook next to the MDR but part of your conformity. We align the security evidence with your technical documentation so the notified body sees one consistent picture.
For products in scope of the CRA, reporting obligations have applied since 11 September 2026, and the full requirements follow from 11 December 2027. For high-risk AI in product-regulated areas (Annex I of the AI Act, including medical devices), the obligations apply from August 2028 after the postponement. The MDR's IT security requirements, however, already apply today.
AI/ML features in medical devices are generally classified as high-risk AI under Annex I of the AI Act. This brings requirements on risk management, data governance, robustness and cybersecurity, which can be aligned with your MDR conformity assessment. Our AI-based security scan gives you the security overview of your attack surface and shows where deeper testing is needed.
Not if it is set up properly. That is exactly what most of our clients are rightly wary of. Our approach is to integrate security requirements into existing processes and documents: one risk management system, one set of technical documentation, extended rather than duplicated.
In a free intro call we clarify whether you are affected, what the sensible next steps are, and which package fits your situation. No strings attached.
info@actsecure.eu