EU CRA Readiness for Connected Medical Device Ecosystems

Your medical device is exempt. Your ecosystem isn’t.

A vulnerability in the cloud backend behind your medical device is being actively exploited. That backend is not classified as a medical device, so it sits squarely within the CRA and the 24-hour early-warning clock has started. But it shares authentication, data pipelines, and update infrastructure with your MDR-certified device. Can you patch one without disturbing the other? What happens next depends entirely on where your team drew the architectural line between the two.

Devices certified under MDR/IVDR are excluded from the EU Cyber Resilience Act. But the companion apps, cloud backends, OTA infrastructure, and wearables around them all fall within it. Vulnerability reporting for suppliers and non-MDR products begins September 2026, full CRA enforcement follows in December 2027, and the maximum fine is €15M or 2.5% of global turnover.

Where CRA applies

The exemption follows the product, not the company. If you build both MDR-classified devices and non-medical digital products, the device is exempt but the rest is fully in scope:

• Companion apps not classified as medical devices, in scope
• Cloud dashboards, analytics, OTA update servers, in scope
• Body-worn wearables, in scope, even under the current exemption
• Your software supply chain, 24-hour vulnerability reporting from September 2026
• Prototype and research units not yet CE-marked, may fall under CRA

How to use this audit

Every item is a yes/no question. Yes is always the good answer, and each tick is worth one point out of 12.

• Tick it only if your current architecture already satisfies it. Planned does not count. Not sure means do not tick.
• Some items ask for two or three things at once. Tick only if all of them are done. If an item offers a choice with the word or, any one option is enough.
• The role tag on each item shows who can answer it. Engineering, Hardware, or QA/RA. Fill this in together rather than alone.
• Pillar 3 is Critical. If any of its three items is unticked, that alone decides your result.

What the four pillars measure. Pillars 1 and 2 check where the CRA reaches into your ecosystem today: your supply chain, your backends, and your ability to report inside the deadline. Pillars 3 and 4 check the architectural boundary between your device and the components around it. Where the device is exempt, that boundary decides how much regulatory assessment work lands on it when an in-scope component has to be patched. Where the device is in scope, such as a body-worn wearable, those pillars apply to the device directly.

Why Yalantis 

This audit is a self-assessment aid, not legal or regulatory advice. CRA scope depends on your product’s classification and your role in the supply chain, and interaction with MDR/IVDR obligations is product-specific. Confirm scope with qualified counsel and your notified body.