Legal basis
FDA 524B
FD&C §524B.
MHRA
UK MDR 2002 (as amended) + recognition of CE / IMDRF.
Takeaway
MHRA is converging with EU MDR for now; SaMD framework is in flux.
Head to head
FDA 524Bvs MHRA
United States and United Kingdom medical-device cybersecurity, compared.
Last updated ·
Bottom line
MHRA recognises CE marking until June 2030 and broadly aligns with MDCG 2019-16, so an FDA cybersecurity package travels well — about 80% reusable. The active divergence is the UK's emerging post-market vigilance regime and the future Software-as-a-Medical-Device framework, both of which are tightening faster than the US baseline.
Who this is for · US sponsors evaluating the UKCA / MHRA route post-Brexit.
Where they differ
SBOM
FDA 524B
Mandatory.
MHRA
Strongly expected; explicit in draft UK SaMD guidance.
Takeaway
Generate once, file everywhere.
Local presence
FDA 524B
U.S. agent.
MHRA
UK Responsible Person (UKRP) required for non-UK manufacturers.
Takeaway
UKRP holds the technical file including your cyber documentation.
Full profile
United States
FDA Premarket Cybersecurity Guidance & FD&C §524B
Open profileFull profile
United Kingdom
UK MDR 2002 (as amended) + MHRA Cyber Guidance
Open profileFrequently asked
Do I need a separate UK submission if I have CE marking?
Until June 30 2030, CE-marked devices may be placed on the GB market with no further submission. After that date, expect a UKCA / UK SaMD pathway requiring UKRP-held documentation including cybersecurity evidence.