Your leading voice in digital health news
Twitter X Logo

Concessions sought for cybersecurity disclosures

7 May 2026
By Dawn O'Shea
Image: iStock

MedTech Europe is calling for an amendment to the proposed Medical Devices Regulation (MDR) and In Vitro Diagnostics Regulation (IVDR) which would allow manufacturers to delay making vulnerability disclosures until a patch has been developed.

The recommendation is one of several amendments recommended by the trade association in a new position statement. While the organisation broadly welcomes the reduce unpredictability and administrative duplication within the regulatory system, it says specific measures are needed to “maintain high levels of patient safety while meaningfully cutting unnecessary red tape”. 

“In several areas, the legislative text, as drafted, does not yet fully deliver on the proposal’s own stated ambition,” according to the position statement. “Without targeted safeguards, there is a risk that positive reforms will be diluted through inconsistent implementation, regulatory overlap or insufficient operational detail.” 

Targeted amendments

MedTech Europe is the European trade association for the medical technology industry including diagnostics, medical devices and digital health, and has been vocal about shortcomings in the proposed legislation. The latest position statement proposes several targeted amendments. It calls for the use of open-validity certificates with periodic risk-based reviews which, the organisation says, will remove fixed five-year recertification cycles, eliminating “an artificial bottleneck while maintaining ongoing oversight proportionate to the device’s risk profile”.

The organisation is also calling for clearer distinction between product changes manufacturers can implement without prior notification and those requiring approval, and proportionate scrutiny for lower and medium-risk devices to remove duplicative procedural steps.

Furthermore, Medtech Europe calls for broader recognition of clinical evidence, including “explicit” recognition of well-established technologies, and acceptance of non-clinical evidence including modelling and simulation. It also urges reconsideration of proposals related to near-patient IVD tests in order to align the regulatory pathway for near-patient tests with other professional-use diagnostics.

In addition, the trade association advocates for the electronic submission of technical files, digital EU declarations of conformity, digital labelling and digital provision of information to healthcare professionals and patients.

The organisation also cautions that IVDR amendments have so far received insufficient attention, given their importance to healthcare systems.

Breakthrough

The proposed breakthrough and orphan device pathways need refinement in two areas, according to Medtech Europe. It recommends that paediatric devices should be explicitly included in the scope of Article 52a of the regulations, which would permit adapted assessment pathways. Additionally, it warns that the current proposals risk excluding diagnostics for rare conditions. The proposed IVDR rare disease threshold of one in 12,000 individuals per year differs from the established European threshold for rare diseases, which is five in 10,000.

It cautions that two distinct cybersecurity scenarios require different regulatory responses. It advises that patient safety incidents should follow established vigilance reporting channels, while vulnerability disclosures must allow manufacturers time to develop patches before disclosure.

Furthermore, it calls for amendments to Article 58(1) which categorises blood draws as having the same risk as biopsies or spinal taps in performance studies. MedTech Europe proposes amending the text to clarify that full authorisation requirements are triggered only where the invasive procedure poses a major clinical risk to subjects.

“MedTech Europe fully supports the European Commission’s objective to streamline the EU regulatory system for medical devices and in vitro diagnostics and urges Parliament and Council to bring these much-needed improvements swiftly,” according to the position statement. 

Act “now”

It calls for these amendments to be made as a matter of urgency, saying the regulations “were designed to raise the bar for patient protection and strengthen trust in medical technologies. Yet, nearly a decade into implementation, the very goals these regulations were meant to achieve are being undermined by structural shortcomings: slow and unpredictable conformity assessment timelines, disproportionate and costly administrative burdens, and inconsistent interpretation across Member States.”

The organisation says ongoing delays in revising the regulations are leading to “concrete and cumulative” costs, with several companies already redirecting investment away from Europe. It says, “the window to act is now”.

Explore similar topics

Leave a Reply

Your leading voice in digital health news

Twitter X

Your leading voice in digital health news 

Keep your finger on the pulse with full access to all articles published on 
pulseit.news
Subscribe from only $39
magnifiercrossmenuchevron-down