--- title: "EU MDR vs MHRA: Cybersecurity Compared" description: "European Union vs United Kingdom medical-device cybersecurity: SBOM, threat modeling, post-market and penalties side by side. Until 30 June 2030 - or later, i" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "Article", "headline": "EU MDR vs MHRA: Medical Device Cybersecurity Compared", "description": "European Union vs United Kingdom medical-device cybersecurity: SBOM, threat modeling, post-market and penalties side by side. Until 30 June 2030 - or later, if MHRA's Feb 2026 consultation on indefinite CE …", "about": [ "European Commission, Medical Device Coordination Group (with national Competent Authorities)", "Medicines and Healthcare products Regulatory Agency" ], "author": { "@type": "Organization", "name": "MDC Crosswalk" }, "publisher": { "@type": "Organization", "name": "MDC Crosswalk" }, "mainEntityOfPage": "https://mdccrosswalk.lovable.app/compare/eu-mdr-vs-uk-mhra" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Will the UK adopt the EU CRA?", "acceptedAnswer": { "@type": "Answer", "text": "No formal adoption is planned. The MHRA's current direction signals divergence on post-market timelines but convergence on harmonised standards (IEC 81001-5-1, IEC 62443-4-1)." } } ] }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://mdccrosswalk.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Compare", "item": "https://mdccrosswalk.lovable.app/compare" }, { "@type": "ListItem", "position": 3, "name": "EU MDR vs MHRA" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") Search⌘K 1. [Home ](/) 2. [Compare](/compare) 3. EU MDR vs MHRA Head to head # ![Flag of European Union](/flags/eu.svg) EU MDRvs ![Flag of United Kingdom](/flags/gb.svg) MHRA European Union and United Kingdom medical-device cybersecurity, compared. Last updated · July 25, 2026 Share Copy link X LinkedIn Email Bottom line Until 30 June 2030 - or later, if MHRA's Feb 2026 consultation on indefinite CE recognition is enacted - MHRA accepts CE-marked devices on the GB market with no additional submission, so the cybersecurity file you built for MDR works as-is. After that, expect a UKCA pathway with UKRP-held technical documentation and a UK SaMD overlay that is currently more permissive than EU CRA. Who this is for · EU-CE-marked sponsors evaluating UK market access after Brexit. ## Where they differ Cyber overlay ![Flag of European Union](/flags/eu.svg) EU MDR MDCG 2019-16 + CRA from Dec 2027. ![Flag of United Kingdom](/flags/gb.svg) MHRA Recognises MDCG 2019-16; UK SaMD roadmap in development. Takeaway EU is moving faster on incident reporting (CRA's 24-hour rule); UK lags. Local rep ![Flag of European Union](/flags/eu.svg) EU MDR EU Authorised Representative. ![Flag of United Kingdom](/flags/gb.svg) MHRA UK Responsible Person (UKRP). Takeaway Two appointments, same document set. [ Full profile ### ![Flag of European Union](/flags/eu.svg)European Union MDR 2017/745 + MDCG 2019-16 Cybersecurity Guidance Open profile ](/standards/eu)[ Full profile ### ![Flag of United Kingdom](/flags/gb.svg)United Kingdom UK MDR 2002 (as amended) + MHRA Cyber Guidance Open profile ](/standards/uk) ## Frequently asked ### Will the UK adopt the EU CRA? No formal adoption is planned. The MHRA's current direction signals divergence on post-market timelines but convergence on harmonised standards (IEC 81001-5-1, IEC 62443-4-1). ## Other head-to-heads [FDA 524B vs EU MDR](/compare/fda-vs-eu-mdr)[FDA 524B vs PMDA](/compare/fda-vs-pmda)[FDA 524B vs MHRA](/compare/fda-vs-mhra)[FDA 524B vs Health Canada](/compare/fda-vs-health-canada)[FDA 524B vs NMPA](/compare/fda-vs-nmpa)[EU MDR vs PMDA](/compare/eu-mdr-vs-pmda)[EU MDR vs Health Canada](/compare/eu-mdr-vs-health-canada)[FDA 524B vs TGA](/compare/fda-vs-tga)[FDA 524B vs MFDS](/compare/fda-vs-mfds) Sponsored note · Blue Goat Cyber Submitting in both European Union and United Kingdom? Blue Goat Cyber has prepared cybersecurity evidence for both markets dozens of times. We'll map your existing package against both, in one 30-minute review. [Talk through your dual submission](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber ↗](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. © 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.