Topic starter
25/06/2026 2:53 pm
TL;DR: The EU Cyber Resilience Act turns MedTech device compliance into a continuous lifecycle obligation, requiring secure design, software updates, vulnerability remediation, and proof of identity and attestation across the device lifecycle, according to DigiCert. For IAM and NHI practitioners, the important shift is that device trust now depends on managed identity and supportability, not launch-time certification alone.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “From Launch to Lifecycle: Meeting CRA Requirements in MedTech”.
By the numbers:
- The CRA introduces fines of up to €15 million or 2.5% of global annual revenue for non-compliance.
- DigiCert says its Device Trust solutions address 17 of the CRA’s 22 Annex I obligations.
Key questions
Q: How should MedTech teams manage device trust across the full lifecycle?
A: They should treat device trust as an operational governance process, not a launch checkpoint.
Q: Why does the CRA make supported updates a security issue?
A: Because an unsupported device can remain in production even when it can no longer be trusted.
Q: What breaks when device trust is only checked at launch?
A: Supportability breaks first, then remediation, then auditability.
Practitioner guidance
- Map device trust to lifecycle ownership Assign explicit owners for identity proof, software updates, vulnerability remediation, and decommissioning so responsibility does not end at launch.
- Tie attestation to field updates Require proof that secure boot, code signing, and update validation still hold after patches and remote maintenance events.
- Track supportability as a trust signal Maintain an authoritative inventory of which devices are supported, updateable, and eligible for continued trust in production.
Bottom line: The CRA turns MedTech device trust into a lifecycle governance issue, not a one-time compliance event.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:06 pm
CRA compliance creates a lifecycle identity problem, not just a regulatory one. The article shows that MedTech trust now depends on whether a device can continuously prove who it is, what code it runs, and whether it remains supported. That moves the control boundary away from launch certification and toward lifecycle evidence, which is closer to identity governance than product compliance.
A question worth separating out:
Q: How do compliance, supportability, and accountability fit together under the CRA?
A: They become one operating model. Compliance requires evidence that the device is still supported, still identifiable, and still remediable, which means accountability has to persist through the full lifecycle rather than ending at deployment.
👉 Read our full editorial: CRA lifecycle compliance is reshaping MedTech device trust