23 October 2026, 09:57 PM
In the cybersecurity area of a software dossier, an ANVISA reviewer reviews it and asks one question: How was the verification of these controls performed? In the architecture diagram, the “Cloud API” requires the hospital to have authentication, and the instructions for using it explain that the hospital should change the default password. But no one attempted to get around either of the controls or documented their attempts. So the app only waits for engineers to find evidence, which should have been done long ago.
This guide is about that gap. ANVISA regulations RDC 657/2022 require cybersecurity information to be included in the technical dossier, and the instructions for use and software in Classes III and IV must describe their cybersecurity controls. The resolution doesn’t say how to prove those controls work; it never mentions penetration testing. However, it is voluntary in accordance with ANVISA’s Guide 38/2020. A well-scoped test translates the security claims in the dossier into evidence. This means fewer exigencies and less rework. No test changes how long ANVISA itself takes to review a file.
Below we cover the rules that apply, what Guide 38 says, what to test, where findings belong in the dossier, how Brazil’s data protection law fits, and what goes on after approval.
ANVISA Medical Device Regulations: The Framework Around RDC 657/2022
RDC 657 does not work alone. Other resolutions set your risk class, your route to market, and the safety requirements against which you’ll be judged long before a reviewer opens the software chapter, and any of them can raise a security question.
The Brazilian health regulatory agency is ANVISA (Agência Nacional de Vigilância Sanitária). If the manufacturer is foreign and has no local entity, a Brazilian registration holder must file on behalf of the foreign manufacturer. The four layers of ANVISA medical device regulation are the most relevant for connected products.
Source: https://qualysec.com/anvisa-regulation/
This guide is about that gap. ANVISA regulations RDC 657/2022 require cybersecurity information to be included in the technical dossier, and the instructions for use and software in Classes III and IV must describe their cybersecurity controls. The resolution doesn’t say how to prove those controls work; it never mentions penetration testing. However, it is voluntary in accordance with ANVISA’s Guide 38/2020. A well-scoped test translates the security claims in the dossier into evidence. This means fewer exigencies and less rework. No test changes how long ANVISA itself takes to review a file.
Below we cover the rules that apply, what Guide 38 says, what to test, where findings belong in the dossier, how Brazil’s data protection law fits, and what goes on after approval.
ANVISA Medical Device Regulations: The Framework Around RDC 657/2022
RDC 657 does not work alone. Other resolutions set your risk class, your route to market, and the safety requirements against which you’ll be judged long before a reviewer opens the software chapter, and any of them can raise a security question.
The Brazilian health regulatory agency is ANVISA (Agência Nacional de Vigilância Sanitária). If the manufacturer is foreign and has no local entity, a Brazilian registration holder must file on behalf of the foreign manufacturer. The four layers of ANVISA medical device regulation are the most relevant for connected products.
Source: https://qualysec.com/anvisa-regulation/