Cyber overlay
EU MDR
MDCG 2019-16 + CRA from Dec 2027.
MHRA
Recognises MDCG 2019-16; UK SaMD roadmap in development.
Takeaway
EU is moving faster on incident reporting (CRA's 24-hour rule); UK lags.
Head to head
EU MDRvs MHRA
European Union and United Kingdom medical-device cybersecurity, compared.
Last updated ·
Bottom line
Until 30 June 2030 MHRA accepts CE-marked devices on the GB market with no additional submission — so the cybersecurity file you built for MDR works as-is. After that, expect a UKCA pathway with UKRP-held technical documentation and a UK SaMD overlay that is currently more permissive than EU CRA.
Who this is for · EU-CE-marked sponsors evaluating UK market access after Brexit.
Where they differ
Local rep
EU MDR
EU Authorised Representative.
MHRA
UK Responsible Person (UKRP).
Takeaway
Two appointments, same document set.
Full profile
European Union
MDR 2017/745 + MDCG 2019-16 Cybersecurity Guidance
Open profileFull profile
United Kingdom
UK MDR 2002 (as amended) + MHRA Cyber Guidance
Open profileFrequently asked
Will the UK adopt the EU CRA?
No formal adoption is planned. The MHRA's current direction signals divergence on post-market timelines but convergence on harmonised standards (IEC 81001-5-1, IEC 62443-4-1).