EU Cybersecurity Reporting Requirements for Connected Medical Devices Take Effect

New European Union regulations under the Cyber Resilience Act (CRA) mandate vulnerability and incident reporting for connected products with digital elements, including medical devices, starting September 11, 2026. Article 14 of the CRA requires manufacturers to report vulnerabilities and incidents, marking a significant shift towards mandatory cybersecurity compliance for devices on the EU market.