Topic starter
25/06/2026 2:53 pm
TL;DR: MedTech device trust now has to be maintained across the full lifecycle, DigiCert reports, as the EU Cyber Resilience Act requires secure design, updates, remediation, identity proof, and attestation after deployment. Device governance now has to keep identity, supportability, and remediation evidence current once devices are in production.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “From Launch to Lifecycle: Meeting CRA Requirements in MedTech”.
By the numbers:
- The CRA introduces fines of up to €15 million or 2.5% of global annual revenue for non-compliance.
- DigiCert says its Device Trust solutions address 17 of the CRA’s 22 Annex I obligations.
Key questions
Q: Why does the CRA make supported updates a security issue?
A: Because an unsupported device can remain in production even when it can no longer be trusted.
Q: What breaks when device trust is only checked at launch?
A: Supportability breaks first, then remediation, then auditability.
Q: How should MedTech teams manage device trust across the full lifecycle?
A: They should treat device trust as an operational governance process, not a launch checkpoint.
Practitioner guidance
- Map device trust to lifecycle ownership Assign explicit owners for identity proof, software updates, vulnerability remediation, and decommissioning so responsibility does not end at launch.
- Tie attestation to field updates Require proof that secure boot, code signing, and update validation still hold after patches and remote maintenance events.
- Track supportability as a trust signal Maintain an authoritative inventory of which devices are supported, updateable, and eligible for continued trust in production.
Bottom line: The CRA turns MedTech device trust into a lifecycle governance issue, not a one-time compliance event.
Glossary terms: Lifecycle Trust Continuity, Device Attestation, Supportability, Device Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 4:06 pm
CRA compliance creates a lifecycle identity problem, not just a regulatory one. The article shows that MedTech trust now depends on whether a device can continuously prove who it is, what code it runs, and whether it remains supported. That moves the control boundary away from launch certification and toward lifecycle evidence, which is closer to identity governance than product compliance.
A question worth separating out:
Q: How do compliance, supportability, and accountability fit together under the CRA?
A: They become one operating model. Compliance requires evidence that the device is still supported, still identifiable, and still remediable, which means accountability has to persist through the full lifecycle rather than ending at deployment.
👉 Read our full editorial: CRA lifecycle compliance is reshaping MedTech device trust