The Crosswalk

The global medical device cybersecurity crosswalk.

The reference RA/QA teams reach for when planning international submissions. Twenty-nine regulators, one device, side by side, without losing a quarter to regulatory whiplash.

Open the matrix Read the playbook

Three questions. We'll route you to the right tool.

Not sure whether to open the matrix, the planner, or a jurisdiction playbook? Answer three quick questions and we'll point you at the shortest path to your answer.

What are you trying to do?

Which markets?

Pick up to 5.

Device risk class?

Take me there Answer question 1 to continue.

What's newJul 25, 2026

Feature

Per-page social previews and this changelog

Every jurisdiction, pair comparison, and control checklist now renders its own Open Graph preview image, so links shared on LinkedIn and Slack show the actual page title and stats. This changelog and an RSS feed at /rss.xml track updates going forward.

See all updates

Jurisdictions

Cross-cutting frameworks

Harmonised baseline

IMDRF N60

EU CRA enforcement

2027

Compare in one click

Pick two. See the deltas.

Choose any two of the 29 jurisdictions to see framework, SBOM, CVD, post-market and penalty rules side by side.

Full matrix

Jurisdiction A

Jurisdiction B

Control-by-control checklist

Dimension	United States U.S. Food and Drug Administration, Center for Devices and Radiological Health Leading tier	European Union European Commission, Medical Device Coordination Group (with national Competent Authorities) Leading tier
Legal framework	FD&C Act §524B + Feb 3 2026 Final Guidance, aligned to QMSR (21 CFR Part 820 / ISO 13485:2016, effective Feb 2 2026). Supersedes Jun 2025 guidance and replaces 2014 premarket cybersecurity guidance.	MDR Annex I GSPR 17.2 + NIS2 Directive (CRA explicitly excludes products covered by MDR/IVDR)
Status	Mandatory	Mandatory
Pre-market expectations	Cybersecurity treated as part of device safety under the QMSR (ISO 13485:2016). Secure Product Development Framework (SPDF) presented as one way to satisfy QMSR. Threat model, SBOM in machine-readable format, security risk management (AAMI TIR57), security architecture views (global system, multi-patient harm, updateability), security testing.	Risk management per ISO 14971, IT security in technical documentation, IEC 81001-5-1, minimum IT requirements in IFU, verification & validation evidence reviewed by Notified Body.
Post-market expectations	Coordinated vulnerability disclosure plan, post-market monitoring, patching commitments and timelines for the supported device lifetime.	PMS plan, PSUR, vigilance reporting within 15 days for serious incidents (2 days for serious public health threats).
SBOM	Required	Recommended
Vulnerability disclosure	Mandatory CVD plan submitted with application. Updates must be free of charge.	Required under NIS2 for essential/important entities; encouraged for all manufacturers.
Penalty / enforcement	Refusal to Accept (RTA) of submission, adds months to clearance.	MDR: market removal + national fines. NIS2: up to €10M or 2% global turnover (where the manufacturer is in scope as an essential/important entity).
	Open full crosswalk	Open full crosswalk

Not sure which two to pick? Try the Planner for a sequenced roadmap based on your device profile.

Coverage at a glance

The map.

Hover any covered jurisdiction for a one-line read on its cybersecurity maturity. Click to open the full profile.

Leading - statutory, SBOM mandated

Advanced - mandatory, robust framework

Developing - guidance, tightening

Emerging - early-stage requirements

Watchlist - regulator known, no cyber crosswalk yet

Sanctions - commercial export restricted

Out of scope. See methodology →

All jurisdictions

Twenty-nine regulators. One device. Twenty-nine different stories.

Status key

MandatoryStatutory or binding regulation. Non-compliance blocks market access.

GuidanceNon-statutory guidance. Typically enforced via review and registration.

EmergingFramework adopted but not yet fully enforced or in active implementation.

Mandatory

FDA / CDRH

United States

Mar 2023

Mandatory

EC / MDCG

European Union

May 2021

The global medical device cybersecurity crosswalk.

Three questions. We'll route you to the right tool.

Per-page social previews and this changelog

Pick two. See the deltas.

The map.

Twenty-nine regulators. One device. Twenty-nine different stories.

United States

European Union

United Kingdom

Japan

China

Canada

Australia

South Korea

Singapore

Brazil

Saudi Arabia

Switzerland

India

Israel

Taiwan

Mexico

United Arab Emirates

South Africa

Malaysia

Thailand

Indonesia

Argentina

New Zealand

Turkey

Norway

Colombia

Chile

Vietnam

Philippines

Ukraine

Kazakhstan

Egypt

Hong Kong

Kuwait

Taiwan

Thailand

South Africa

Russia

The pairings everyone asks about.

FDA 524B vs EU MDR

FDA 524B vs PMDA

FDA 524B vs MHRA

FDA 524B vs Health Canada

FDA 524B vs NMPA

EU MDR vs MHRA

EU MDR vs PMDA

EU MDR vs Health Canada

FDA 524B vs TGA

FDA 524B vs MFDS