28 October 2026, 07:46 PM
TL;DR: The IVDR treats cybersecurity as a patient-safety issue: Annex I section 16.2 requires software built to the state of the art including information security, and 16.4 requires you to specify minimum IT security requirements. Notified bodies use MDCG 2019-16 rev.1 as their reference. Class D legacy devices have until 31 December 2027; Class C until 31 December 2028.
Cybersecurity sounds like an IT problem until you picture a lab result that somebody changed on its way to the patient record. Then it’s a patient safety problem, and that’s how the EU IVDR regulation, Regulation (EU) 2017/746, treats it. The rules are scattered across Annex I, and plenty of manufacturers only notice when a notified body asks for security evidence they haven’t produced.
Time matters here. The Class C deadlines have passed (26 May 2026 for the application, 26 September 2026 for the written agreement). Class D devices have until 31 December 2027. The Commission has also proposed changes, which are still working through Parliament and Council. We will cover where security sits in the regulation, what IVDR compliance reviewers ask for and what UK manufacturers need to watch.
Not sure your software even counts as an IVD, or what class it is? Talk to Qualysec’s team before you lock in a certification plan.
What Is the EU IVDR Regulation and Who Does It Cover?
If your product looks at a specimen from the human body and reports something about it, assume the EU IVDR regulation covers you. Reagents, analysers and instruments are in. Software is in too, and that part matters most here. The text names software or a system outright, so a standalone algorithm can be an IVD without any hardware. The EU IVDR regulation replaced the old In Vitro Diagnostic Devices Directive (98/79/EC) on 26 May 2022.
The IVDR applies across EU member states and in Northern Ireland. Great Britain does its own thing, and the UK section below covers it.
Where Do the IVDR Requirements Cover Cybersecurity?
The IVDR requirements live inside the general safety and performance requirements in Annex I, and reviewers read those sections side by side, not one at a time. The Medical Device Coordination Group (MDCG) mapped how they fit together in MDCG 2019-16 rev. 1.
Source: https://qualysec.com/eu-ivdr-compliance/
Cybersecurity sounds like an IT problem until you picture a lab result that somebody changed on its way to the patient record. Then it’s a patient safety problem, and that’s how the EU IVDR regulation, Regulation (EU) 2017/746, treats it. The rules are scattered across Annex I, and plenty of manufacturers only notice when a notified body asks for security evidence they haven’t produced.
Time matters here. The Class C deadlines have passed (26 May 2026 for the application, 26 September 2026 for the written agreement). Class D devices have until 31 December 2027. The Commission has also proposed changes, which are still working through Parliament and Council. We will cover where security sits in the regulation, what IVDR compliance reviewers ask for and what UK manufacturers need to watch.
Not sure your software even counts as an IVD, or what class it is? Talk to Qualysec’s team before you lock in a certification plan.
What Is the EU IVDR Regulation and Who Does It Cover?
If your product looks at a specimen from the human body and reports something about it, assume the EU IVDR regulation covers you. Reagents, analysers and instruments are in. Software is in too, and that part matters most here. The text names software or a system outright, so a standalone algorithm can be an IVD without any hardware. The EU IVDR regulation replaced the old In Vitro Diagnostic Devices Directive (98/79/EC) on 26 May 2022.
The IVDR applies across EU member states and in Northern Ireland. Great Britain does its own thing, and the UK section below covers it.
Where Do the IVDR Requirements Cover Cybersecurity?
The IVDR requirements live inside the general safety and performance requirements in Annex I, and reviewers read those sections side by side, not one at a time. The Medical Device Coordination Group (MDCG) mapped how they fit together in MDCG 2019-16 rev. 1.
Source: https://qualysec.com/eu-ivdr-compliance/