Last updated: 2026-10-09
For manufacturers in the health space, one of the first and most consequential questions about the Cyber Resilience Act (Regulation (EU) 2024/2847) is: does my product fall under it at all? The CRA expressly excludes medical devices, but the exclusion reaches only as far as the MDR or IVDR applies. This page frames the boundary in technical-organizational terms. It is orientation, not a legally binding classification of your specific product.
Why medical devices are excluded
The CRA is a horizontal cybersecurity regulation for “products with digital elements” (PDE). Under Art. 2(2)(a) it does not apply to products to which the MDR applies, and under Art. 2(2)(b) to products to which the IVDR applies. The rationale is to avoid double regulation: the MDR and IVDR already impose essential requirements on programmable systems, including cybersecurity, for the MDR for example in Annex I section 17. These products therefore remain in a framework of their own with its own cybersecurity requirements.
Excluded vs. in scope
What matters is the product’s intended purpose and whether the MDR or IVDR applies to it. The market segment alone is not a criterion. The following comparison is illustrative and does not replace a regulatory classification:
| Excluded from the CRA (under MDR/IVDR) | Potentially within CRA scope (not a medical device) |
|---|---|
| Software with a medical intended purpose under the MDR (e.g. diagnostic, therapy, findings software) | Wellness, fitness and lifestyle software without a medical intended purpose |
| In-vitro diagnostics and their associated software under the IVDR | General health apps that are not a medical device |
| Programmable medical devices placed on the market as a medical device | Hospital and practice administration IT (billing, scheduling, resources) |
| Accessories for a medical device or IVD within the meaning of the MDR/IVDR, and products listed in Annex XVI MDR | General IT infrastructure, network components, wearables without a medical intended purpose |
The products in the right-hand column are “health-adjacent” but not medical devices. Where they are made available on the market as products with digital elements, the CRA applies to them. Whether a specific product sits left or right is a classification question that must be examined individually.
A decision structure for your product
1. Examine the intended purpose
Does the product, by its intended purpose, fall under the MDR or IVDR, as a medical device, in-vitro diagnostic, accessory or product listed in Annex XVI MDR? Only then does the exclusion under Art. 2(2)(a) or (b) apply. This classification is the core of the question.
2. Separate components and accessories
The PDE assessment is product-based (Art. 3(1)) and covers components placed on the market separately. The CRA excludes all products to which the MDR or IVDR applies. This includes accessories for a medical device, which are not medical devices themselves, and products listed in Annex XVI MDR. A component or add-on that is neither a medical device nor an accessory within the meaning of the MDR/IVDR can, by contrast, be a product with digital elements in its own right within CRA scope, even if the main product falls under the MDR.
3. Weigh integral cloud/backends
Remote data processing (Art. 3(2)), for example a backend without which a product function would not run, is treated as part of the PDE under the CRA. For MDR/IVDR products, the respective regime applies accordingly. The allocation must be documented cleanly for each component.
4. Resolve mixed portfolios
Some providers have a portfolio of medical devices and non-medical devices. Both must be considered separately: one product may fall under the MDR, the next under the CRA. A blanket “we are medtech, so we are out” assumption does not hold.
Where the boundary can go wrong
Two shortcuts lead to misjudgements. First, “health-related” is equated with “medical device” - legally these are separate categories. Second, it is assumed that proximity to the MDR exempts the entire company; in reality, each product is classified on its own. Getting this wrong carries a double risk: either unnecessary CRA effort for a genuine medical device - or, more seriously, placing a product that is actually subject to the CRA on the market without CRA conformity assessment and CE marking.
For health-adjacent products within CRA scope, the Art. 14 reporting obligations have already applied since 11 September 2026, including for products already on the market. Annex I requirements, conformity assessment and CE marking apply from 11 December 2027. Anyone operating at the medtech/IT boundary should therefore settle and document the allocation now, because conformity obligations, documentation and processes differ fundamentally depending on the regime. Our scope check gives a first orientation per product; for classifying CRA-relevant products, the CRA product classes provide further orientation.
Frequently asked questions
Are all health apps excluded from the Cyber Resilience Act?+
What determines whether a product falls under the MDR/IVDR or the CRA?+
Does the CRA exclusion mean medical devices have no cybersecurity duties?+
Can part of my portfolio fall under the CRA and another part under the MDR?+
By when must the boundary be clarified?+
Sources
This content provides general technical and organizational information on the Cyber Resilience Act (Regulation (EU) 2024/2847) and does not constitute legal advice (no legal services within the meaning of the German RDG).