Cyber Resilience Act

The Cyber Resilience Act exempts your medical device and catches your wellness wearable

The Cyber Resilience Act does not apply to products regulated under the MDR or IVDR. It does apply to health-monitoring wearables that fall outside them, and its own annex says so in as many words. Those products are classed as important, and with no harmonised standards yet cited, every conformity route currently open to them runs through a third party.

EU Cyber Resilience Act: Article 14 reporting duties have applied since 11 September 2026

Since 11 September 2026, manufacturers of in-scope connected products must report exploited vulnerabilities and severe incidents under Article 14 of the EU Cyber Resilience Act, with an early warning due within 24 hours. Medical devices regulated under the MDR or IVDR are excluded from the Act. Within scope, the duty reaches products already on the market.