Two Rulebooks, One Device: FDA 524B and the European Cybersecurity Regime 2026

Two Rulebooks, One Device
A side-by-side reading of the two regimes for teams that have to satisfy both

A connected MedTech product sold in both the United States and Europe now answers to two cybersecurity regimes that were built on different premises and enforce at different moments. The engineering work is close to identical. The operating model is not, and that is where dual-market programs lose time.

From 11 September 2026, an actively exploited vulnerability must be reported to ENISA and the relevant national CSIRT within 24 hours. Reporting failures carry administrative fines up to 15 million euro or 2.5% of total worldwide annual turnover, whichever is higher. MedTech products are currently exempt from those product requirements. The software components inside them are not.

What you’ll get

• How the US moved from a decade of non-binding guidance to statute, and what the February 2026 QMSR-aligned reissue changed
• How Europe assembled its regime across MDR Annex I, MDCG 2019-16, IEC 81001-5-1, NIS2, and the Cyber Resilience Act
• A side-by-side comparison on legal force, who assesses you, when, and where the pain lands
• Why the CRA medical device exemption does not protect your companion app, your cloud dashboard, or your software supply chain
• A five-step, ninety-day action list including the QMSR citation sweep and the 24 hour clock exercise

At Avania, cybersecurity and regulatory sit on one team, so the FDA package and the Notified Body package are two views of one evidence base rather than two projects.

Contact us if you’d like a member of our Sentinel Cybersecurity team walk you through your dual-market gaps. 

Authors

Manager and Practice Lead for Cybersecurity, Nick leads the Sentinel medical device cybersecurity service line within Avania's Quality & Compliance practice.

Nick Butt

Senior Vice President of Advisory Services, Angela brings more than 25 years of FDA regulatory experience spanning regulatory strategy, premarket pathways, software as a medical device, artificial intelligence, and combination products.

Angela Johnson, PhD, RAC, PMP