The Cyber Resilience Act exempts your medical device and catches your wellness wearable

The exemption, and where it stops

Article 2(2) of Regulation (EU) 2024/2847 removes from the Act's scope any product with digital elements to which Regulation (EU) 2017/745 or 2017/746 applies. In plain terms, a device regulated under the MDR or the IVDR is out.

The reasoning is in recital 25: those regulations already require risk management, IT security measures and conformity assessment, and cybersecurity guidance for medical devices has been in place since December 2019. Products under them “should not therefore be subject to this Regulation”.

For a manufacturer whose entire portfolio is regulated devices, that is the end of the story.

It is not the end of the story for anyone whose portfolio has a consumer edge.

The annex draws the line itself

Annex III lists important products with digital elements. Class I, item 19 reads:

“Personal wearable products to be worn or placed on a human body that have a health monitoring (such as tracking) purpose and to which Regulation (EU) 2017/745 or (EU) No 2017/746 do not apply, or personal wearable products that are intended for the use by and for children”

The exclusion is written into the entry. A wearable with a health monitoring purpose is an important product precisely when the medical device regulations do not apply to it.

Recital 10 places the same category alongside connected toys, smart door locks and baby monitors, as products performing a function which carries a significant risk of adverse effects and which should undergo a stricter conformity assessment. It names “personal wearable health technology” directly.

So the same heart rate sensor sits on either side of the line depending on what the product claims to be, and both sides carry an EU cybersecurity regime. One is the MDR. The other is the CRA, at its stricter tier.

Why “important” matters more than it sounds

Under Article 32(1), the default route is self-assessment: the internal control procedure based on module A, with no third party involved.

Article 32(2) removes that option for Class I important products in a specific circumstance. Where the manufacturer has not applied, or has applied only in part, harmonised standards, common specifications or a European cybersecurity certification scheme at assurance level at least “substantial”, or where those do not exist, the product must instead go through either EU-type examination based on module B followed by conformity to type based on internal production control under module C, or full quality assurance based on module H.

Both of those involve a notified body. Annex VIII has a notified body examine the technical design under module B, and assess and then keep supervising the quality system under module H. The module A route in Annex VIII Part I has no third party in it at all.

The trigger in Article 32(2) has three limbs, so it is worth taking them separately.

On harmonised standards, we have found none supporting the CRA cited in the Official Journal. The Commission's harmonised standards directory carries no Cyber Resilience Act entry, and the CEN, CENELEC and ETSI work under mandate M/606 was still at draft and enquiry stage during 2026, with first citations forecast for 2027.

On common specifications, the Commission has power under Article 27 to adopt them by implementing act. We have found no record of any being adopted for the CRA. That is a secondary-source position rather than something we can show from a primary document, so treat it as our best reading.

On certification schemes, one does exist. The EUCC, the European cybersecurity certification scheme based on Common Criteria, has been in place since January 2024 and offers assurance levels “substantial” and “high”. So the third limb is not empty, and a manufacturer able to certify under it could in principle stay on the self-assessment route.

That is the qualification the argument needs, and it does not rescue the wearable manufacturer, because EUCC certification is itself carried out by a third party. Whether it is a realistic route for a consumer health wearable, as opposed to the ICT security products the scheme was built around, is the open question, and one worth putting to your notified body or certification body rather than assuming either way.

So the position is narrower than it first looks, and still uncomfortable. A health monitoring wearable outside the MDR and IVDR is a Class I important product. Unless it can apply a certification scheme, there is currently nothing for it to apply, and Article 32(2) then points it away from self-declaration. Every remaining route runs through someone else's assessment.

The date that has already passed

The Regulation itself entered into force in late 2024, but its provisions apply on staggered dates. Under Article 71, the Act applies generally from 11 December 2027, while Article 14 has applied since 11 September 2026. Those reporting duties apply to in-scope products regardless of class, and under Article 69(3) they reach products already placed on the market before the Act's main application date.

So for a wellness wearable already shipping, the vulnerability and incident reporting duty is live now.

The conformity questions are on a different footing, and this is the part that cuts the other way. Article 69(2) provides that products placed on the market before 11 December 2027 are subject to the Regulation's requirements only if, from that date, they undergo a substantial modification. So an existing wearable is not retrospectively pushed into a notified body assessment by the arrival of the main requirements. A new product, or a substantially modified one, is.

That makes this a question about what you ship next, rather than a clean-up exercise on what you have already shipped, and it puts the decision point earlier than December 2027, at whatever design work is happening now.

A note for component suppliers

Article 7(1) contains a rule worth knowing if you supply into other people's products. It makes products with the core functionality of an Annex III category important products, then adds that integrating such a product “shall not in itself render the product in which it is integrated subject to the conformity assessment procedures referred to in Article 32(2) and (3)”. The classification attaches to the component, not automatically to whatever it ends up inside.

What to check

Three questions, in order. One caveat first: the regulation does not define what gives a wearable a “health monitoring purpose”, and that boundary is where most of these decisions will actually be made. We have found no Commission guidance on the point.

Does the MDR or IVDR apply to this product. If yes, the CRA does not, and your cybersecurity obligations sit where they always did.

If no, is it a personal wearable with a health monitoring purpose, or intended for use by children. If yes, it is an Annex III Class I important product.

If it is, which conformity route is actually open to you, given that no harmonised standards have been cited and the only certification scheme on offer was designed for something else. That is a question to answer in 2026, not in late 2027.