--- title: "Medical Device Cybersecurity: FDA, EU, PMDA & 26 More" description: "Compare medical-device cybersecurity across 29 regulators. SBOM, threat modeling, post-market & penalties for FDA, EU MDR, PMDA, NMPA, TGA & more." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "WebSite", "name": "The Medical Device Cybersecurity Crosswalk", "alternateName": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "description": "Compare FDA, EU MDR, MHRA, PMDA, NMPA, TGA, MFDS and Health Canada medical device cybersecurity requirements across 29 jurisdictions." }, { "@context": "https://schema.org", "@type": "Organization", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.com/", "logo": "https://mdccrosswalk.com/favicon.png", "sameAs": [ "https://bluegoatcyber.com" ], "description": "An editorial reference comparing global medical-device cybersecurity regulations. Maintained by Blue Goat Cyber." }, { "@context": "https://schema.org", "@type": "WebSite", "name": "MDC Crosswalk", "url": "https://mdccrosswalk.lovable.app/", "potentialAction": { "@type": "SearchAction", "target": "https://mdccrosswalk.lovable.app/glossary?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "ItemList", "name": "Medical-device cybersecurity by jurisdiction", "itemListElement": [ { "@type": "ListItem", "position": 1, "url": "https://mdccrosswalk.lovable.app/standards/fda", "name": "United States - FDA 524B" }, { "@type": "ListItem", "position": 2, "url": "https://mdccrosswalk.lovable.app/standards/eu", "name": "European Union - EU MDR" }, { "@type": "ListItem", "position": 3, "url": "https://mdccrosswalk.lovable.app/standards/uk", "name": "United Kingdom - MHRA" }, { "@type": "ListItem", "position": 4, "url": "https://mdccrosswalk.lovable.app/standards/jp", "name": "Japan - PMDA" }, { "@type": "ListItem", "position": 5, "url": "https://mdccrosswalk.lovable.app/standards/cn", "name": "China - NMPA" }, { "@type": "ListItem", "position": 6, "url": "https://mdccrosswalk.lovable.app/standards/ca", "name": "Canada - Health Canada" }, { "@type": "ListItem", "position": 7, "url": "https://mdccrosswalk.lovable.app/standards/au", "name": "Australia - TGA" }, { "@type": "ListItem", "position": 8, "url": "https://mdccrosswalk.lovable.app/standards/kr", "name": "South Korea - MFDS" }, { "@type": "ListItem", "position": 9, "url": "https://mdccrosswalk.lovable.app/standards/sg", "name": "Singapore - HSA" }, { "@type": "ListItem", "position": 10, "url": "https://mdccrosswalk.lovable.app/standards/br", "name": "Brazil - ANVISA" }, { "@type": "ListItem", "position": 11, "url": "https://mdccrosswalk.lovable.app/standards/sa", "name": "Saudi Arabia - SFDA" }, { "@type": "ListItem", "position": 12, "url": "https://mdccrosswalk.lovable.app/standards/ch", "name": "Switzerland - Swissmedic" }, { "@type": "ListItem", "position": 13, "url": "https://mdccrosswalk.lovable.app/standards/in", "name": "India - CDSCO" }, { "@type": "ListItem", "position": 14, "url": "https://mdccrosswalk.lovable.app/standards/il", "name": "Israel - AMAR" }, { "@type": "ListItem", "position": 15, "url": "https://mdccrosswalk.lovable.app/standards/tw", "name": "Taiwan - TFDA" }, { "@type": "ListItem", "position": 16, "url": "https://mdccrosswalk.lovable.app/standards/mx", "name": "Mexico - COFEPRIS" }, { "@type": "ListItem", "position": 17, "url": "https://mdccrosswalk.lovable.app/standards/ae", "name": "United Arab Emirates - MOHAP" }, { "@type": "ListItem", "position": 18, "url": "https://mdccrosswalk.lovable.app/standards/za", "name": "South Africa - SAHPRA" }, { "@type": "ListItem", "position": 19, "url": "https://mdccrosswalk.lovable.app/standards/my", "name": "Malaysia - MDA" }, { "@type": "ListItem", "position": 20, "url": "https://mdccrosswalk.lovable.app/standards/th", "name": "Thailand - Thai FDA" }, { "@type": "ListItem", "position": 21, "url": "https://mdccrosswalk.lovable.app/standards/id", "name": "Indonesia - Kemenkes" }, { "@type": "ListItem", "position": 22, "url": "https://mdccrosswalk.lovable.app/standards/ar", "name": "Argentina - ANMAT" }, { "@type": "ListItem", "position": 23, "url": "https://mdccrosswalk.lovable.app/standards/nz", "name": "New Zealand - Medsafe" }, { "@type": "ListItem", "position": 24, "url": "https://mdccrosswalk.lovable.app/standards/tr", "name": "Turkey - TฤฐTCK" }, { "@type": "ListItem", "position": 25, "url": "https://mdccrosswalk.lovable.app/standards/no", "name": "Norway - DMP" }, { "@type": "ListItem", "position": 26, "url": "https://mdccrosswalk.lovable.app/standards/co", "name": "Colombia - INVIMA" }, { "@type": "ListItem", "position": 27, "url": "https://mdccrosswalk.lovable.app/standards/cl", "name": "Chile - ISP" }, { "@type": "ListItem", "position": 28, "url": "https://mdccrosswalk.lovable.app/standards/vn", "name": "Vietnam - DMEC" }, { "@type": "ListItem", "position": 29, "url": "https://mdccrosswalk.lovable.app/standards/ph", "name": "Philippines - FDA-PH" }, { "@type": "ListItem", "position": 30, "url": "https://mdccrosswalk.lovable.app/standards/ua", "name": "Ukraine - SES" }, { "@type": "ListItem", "position": 31, "url": "https://mdccrosswalk.lovable.app/standards/kz", "name": "Kazakhstan - NCEMP" }, { "@type": "ListItem", "position": 32, "url": "https://mdccrosswalk.lovable.app/standards/eg", "name": "Egypt - EDA" }, { "@type": "ListItem", "position": 33, "url": "https://mdccrosswalk.lovable.app/standards/hk", "name": "Hong Kong - MDACS" }, { "@type": "ListItem", "position": 34, "url": "https://mdccrosswalk.lovable.app/standards/kw", "name": "Kuwait - KDFC" }, { "@type": "ListItem", "position": 35, "url": "https://mdccrosswalk.lovable.app/standards/tw", "name": "Taiwan - TFDA Cyber" }, { "@type": "ListItem", "position": 36, "url": "https://mdccrosswalk.lovable.app/standards/th", "name": "Thailand - Thai FDA" }, { "@type": "ListItem", "position": 37, "url": "https://mdccrosswalk.lovable.app/standards/za", "name": "South Africa - SAHPRA" }, { "@type": "ListItem", "position": 38, "url": "https://mdccrosswalk.lovable.app/standards/ru", "name": "Russia - Roszdravnadzor" } ] } ] --- [ The Crosswalk ](/) [Overview](/)[Playbook](/playbook)CompareReference [New Per-page social previews and this changelog ](/changelog "Per-page social previews and this changelog") SearchโŒ˜K ![](/assets/hero-globe-CkIz79Ly.jpg) The Crosswalk # The global _medical device_ cybersecurity crosswalk. The reference RA/QA teams reach for when planning international submissions. Twenty-nine regulators, one device, side by side, without losing a quarter to regulatory whiplash. [Open the matrix](/compare) [Read the playbook](/playbook) Sponsored by [Blue Goat Cyber](https://bluegoatcyber.com) Last updated ยท July 25, 2026 Start here ## Three questions. We'll route you to the right tool. Not sure whether to open the matrix, the planner, or a jurisdiction playbook? Answer three quick questions and we'll point you at the shortest path to your answer. 1 What are you trying to do? Enter one new marketPlan multi-market expansionGet an evidence checklistJust exploring 2 Which markets? FDA 524BEU MDRMHRAPMDANMPAHealth CanadaTGAHSAMFDSANVISACDSCO Pick up to 5. 3 Device risk class? Low (Class I / IIa)Moderate (Class II / IIb)High (Class III) [Take me there](/compare) Answer question 1 to continue. What's new Jul 25, 2026 Feature ## Per-page social previews and this changelog Every jurisdiction, pair comparison, and control checklist now renders its own Open Graph preview image, so links shared on LinkedIn and Slack show the actual page title and stats. This changelog and an RSS feed at /rss.xml track updates going forward. [See all updates](/changelog) Jurisdictions 38 Cross-cutting frameworks 7 Harmonised baseline IMDRF N60 EU CRA enforcement 2027 Compare in one click ## Pick two. See the deltas. Choose any two of the 29 jurisdictions to see framework, SBOM, CVD, post-market and penalty rules side by side. [Full matrix](/compare) Jurisdiction A ๐Ÿ‡ฆ๐Ÿ‡ท Argentina - ANMAT ๐Ÿ‡ฆ๐Ÿ‡บ Australia - TGA ๐Ÿ‡ง๐Ÿ‡ฉ Bangladesh - DGDA ๐Ÿ‡ง๐Ÿ‡ท Brazil - ANVISA ๐Ÿ‡จ๐Ÿ‡ฆ Canada - Health Canada ๐Ÿ‡จ๐Ÿ‡ฑ Chile - ISP ๐Ÿ‡จ๐Ÿ‡ณ China - NMPA ๐Ÿ‡จ๐Ÿ‡ด Colombia - INVIMA ๐Ÿ‡ช๐Ÿ‡ฌ Egypt - EDA ๐Ÿ‡ช๐Ÿ‡บ European Union - EU MDR ๐Ÿ‡ญ๐Ÿ‡ฐ Hong Kong - MDACS ๐Ÿ‡ฎ๐Ÿ‡ณ India - CDSCO ๐Ÿ‡ฎ๐Ÿ‡ฉ Indonesia - Kemenkes ๐Ÿ‡ฎ๐Ÿ‡ฑ Israel - AMAR ๐Ÿ‡ฏ๐Ÿ‡ต Japan - PMDA ๐Ÿ‡ฐ๐Ÿ‡ฟ Kazakhstan - NCEMP ๐Ÿ‡ฐ๐Ÿ‡ช Kenya - PPB ๐Ÿ‡ฐ๐Ÿ‡ผ Kuwait - KDFC ๐Ÿ‡ฒ๐Ÿ‡พ Malaysia - MDA ๐Ÿ‡ฒ๐Ÿ‡ฝ Mexico - COFEPRIS ๐Ÿ‡ฒ๐Ÿ‡ฆ Morocco - DMP ๐Ÿ‡ณ๐Ÿ‡ฟ New Zealand - Medsafe ๐Ÿ‡ณ๐Ÿ‡ฌ Nigeria - NAFDAC ๐Ÿ‡ณ๐Ÿ‡ด Norway - DMP ๐Ÿ‡ต๐Ÿ‡ฐ Pakistan - DRAP ๐Ÿ‡ต๐Ÿ‡ช Peru - DIGEMID ๐Ÿ‡ต๐Ÿ‡ญ Philippines - FDA-PH ๐Ÿ‡ท๐Ÿ‡บ Russia - Roszdravnadzor ๐Ÿ‡ธ๐Ÿ‡ฆ Saudi Arabia - SFDA ๐Ÿ‡ธ๐Ÿ‡ฌ Singapore - HSA ๐Ÿ‡ฟ๐Ÿ‡ฆ South Africa - SAHPRA ๐Ÿ‡ฟ๐Ÿ‡ฆ South Africa - SAHPRA ๐Ÿ‡ฐ๐Ÿ‡ท South Korea - MFDS ๐Ÿ‡ฑ๐Ÿ‡ฐ Sri Lanka - NMRA ๐Ÿ‡จ๐Ÿ‡ญ Switzerland - Swissmedic ๐Ÿ‡น๐Ÿ‡ผ Taiwan - TFDA ๐Ÿ‡น๐Ÿ‡ผ Taiwan - TFDA Cyber ๐Ÿ‡น๐Ÿ‡ญ Thailand - Thai FDA ๐Ÿ‡น๐Ÿ‡ญ Thailand - Thai FDA ๐Ÿ‡น๐Ÿ‡ท Turkey - TฤฐTCK ๐Ÿ‡บ๐Ÿ‡ฆ Ukraine - SES ๐Ÿ‡ฆ๐Ÿ‡ช United Arab Emirates - MOHAP ๐Ÿ‡ฌ๐Ÿ‡ง United Kingdom - MHRA ๐Ÿ‡บ๐Ÿ‡ธ United States - FDA 524B ๐Ÿ‡ป๐Ÿ‡ณ Vietnam - DMEC Jurisdiction B ๐Ÿ‡ฆ๐Ÿ‡ท Argentina - ANMAT ๐Ÿ‡ฆ๐Ÿ‡บ Australia - TGA ๐Ÿ‡ง๐Ÿ‡ฉ Bangladesh - DGDA ๐Ÿ‡ง๐Ÿ‡ท Brazil - ANVISA ๐Ÿ‡จ๐Ÿ‡ฆ Canada - Health Canada ๐Ÿ‡จ๐Ÿ‡ฑ Chile - ISP ๐Ÿ‡จ๐Ÿ‡ณ China - NMPA ๐Ÿ‡จ๐Ÿ‡ด Colombia - INVIMA ๐Ÿ‡ช๐Ÿ‡ฌ Egypt - EDA ๐Ÿ‡ช๐Ÿ‡บ European Union - EU MDR ๐Ÿ‡ญ๐Ÿ‡ฐ Hong Kong - MDACS ๐Ÿ‡ฎ๐Ÿ‡ณ India - CDSCO ๐Ÿ‡ฎ๐Ÿ‡ฉ Indonesia - Kemenkes ๐Ÿ‡ฎ๐Ÿ‡ฑ Israel - AMAR ๐Ÿ‡ฏ๐Ÿ‡ต Japan - PMDA ๐Ÿ‡ฐ๐Ÿ‡ฟ Kazakhstan - NCEMP ๐Ÿ‡ฐ๐Ÿ‡ช Kenya - PPB ๐Ÿ‡ฐ๐Ÿ‡ผ Kuwait - KDFC ๐Ÿ‡ฒ๐Ÿ‡พ Malaysia - MDA ๐Ÿ‡ฒ๐Ÿ‡ฝ Mexico - COFEPRIS ๐Ÿ‡ฒ๐Ÿ‡ฆ Morocco - DMP ๐Ÿ‡ณ๐Ÿ‡ฟ New Zealand - Medsafe ๐Ÿ‡ณ๐Ÿ‡ฌ Nigeria - NAFDAC ๐Ÿ‡ณ๐Ÿ‡ด Norway - DMP ๐Ÿ‡ต๐Ÿ‡ฐ Pakistan - DRAP ๐Ÿ‡ต๐Ÿ‡ช Peru - DIGEMID ๐Ÿ‡ต๐Ÿ‡ญ Philippines - FDA-PH ๐Ÿ‡ท๐Ÿ‡บ Russia - Roszdravnadzor ๐Ÿ‡ธ๐Ÿ‡ฆ Saudi Arabia - SFDA ๐Ÿ‡ธ๐Ÿ‡ฌ Singapore - HSA ๐Ÿ‡ฟ๐Ÿ‡ฆ South Africa - SAHPRA ๐Ÿ‡ฟ๐Ÿ‡ฆ South Africa - SAHPRA ๐Ÿ‡ฐ๐Ÿ‡ท South Korea - MFDS ๐Ÿ‡ฑ๐Ÿ‡ฐ Sri Lanka - NMRA ๐Ÿ‡จ๐Ÿ‡ญ Switzerland - Swissmedic ๐Ÿ‡น๐Ÿ‡ผ Taiwan - TFDA ๐Ÿ‡น๐Ÿ‡ผ Taiwan - TFDA Cyber ๐Ÿ‡น๐Ÿ‡ญ Thailand - Thai FDA ๐Ÿ‡น๐Ÿ‡ญ Thailand - Thai FDA ๐Ÿ‡น๐Ÿ‡ท Turkey - TฤฐTCK ๐Ÿ‡บ๐Ÿ‡ฆ Ukraine - SES ๐Ÿ‡ฆ๐Ÿ‡ช United Arab Emirates - MOHAP ๐Ÿ‡ฌ๐Ÿ‡ง United Kingdom - MHRA ๐Ÿ‡บ๐Ÿ‡ธ United States - FDA 524B ๐Ÿ‡ป๐Ÿ‡ณ Vietnam - DMEC [Control-by-control checklist](/compare/checklist/fda/eu "See the FDA-derived control checklist for these two jurisdictions") Dimension ![Flag of United States](/flags/us.svg) United States U.S. Food and Drug Administration, Center for Devices and Radiological Health Leading tier ![Flag of European Union](/flags/eu.svg) European Union European Commission, Medical Device Coordination Group (with national Competent Authorities) Leading tier Legal framework FD&C Act ยง524B + Feb 3 2026 Final Guidance, aligned to QMSR (21 CFR Part 820 / ISO 13485:2016, effective Feb 2 2026). Supersedes Jun 2025 guidance and replaces 2014 premarket cybersecurity guidance. MDR Annex I GSPR 17.2 + NIS2 Directive (CRA explicitly excludes products covered by MDR/IVDR) Status Mandatory Mandatory Pre-market expectations Cybersecurity treated as part of device safety under the QMSR (ISO 13485:2016). Secure Product Development Framework (SPDF) presented as one way to satisfy QMSR. Threat model, SBOM in machine-readable format, security risk management (AAMI TIR57), security architecture views (global system, multi-patient harm, updateability), security testing. Risk management per ISO 14971, IT security in technical documentation, IEC 81001-5-1, minimum IT requirements in IFU, verification & validation evidence reviewed by Notified Body. Post-market expectations Coordinated vulnerability disclosure plan, post-market monitoring, patching commitments and timelines for the supported device lifetime. PMS plan, PSUR, vigilance reporting within 15 days for serious incidents (2 days for serious public health threats). SBOM Required Recommended Vulnerability disclosure Mandatory CVD plan submitted with application. Updates must be free of charge. Required under NIS2 for essential/important entities; encouraged for all manufacturers. Penalty / enforcement Refusal to Accept (RTA) of submission, adds months to clearance. MDR: market removal + national fines. NIS2: up to โ‚ฌ10M or 2% global turnover (where the manufacturer is in scope as an essential/important entity). [Open full crosswalk](/standards/fda) [Open full crosswalk](/standards/eu) Not sure which two to pick? [Try the Planner](/planner) for a sequenced roadmap based on your device profile. Coverage at a glance ## The map. Hover any covered jurisdiction for a one-line read on its cybersecurity maturity. Click to open the full profile. No country selected Click any country on the map to see whether it's covered, watchlisted, sanctioned, or out of scope - and why. Leading - statutory, SBOM mandated Advanced - mandatory, robust framework Developing - guidance, tightening Emerging - early-stage requirements Watchlist - regulator known, no cyber crosswalk yet Sanctions - commercial export restricted Out of scope. [See methodology โ†’](/methodology) All jurisdictions ## Twenty-nine regulators. One device. Twenty-nine different stories. Status key Mandatory Statutory or binding regulation. Non-compliance blocks market access. Guidance Non-statutory guidance. Typically enforced via review and registration. Emerging Framework adopted but not yet fully enforced or in active implementation. [ ![Flag of United States](/flags/us.svg)Mandatory FDA / CDRH ### United States Mar 2023 ](/standards/fda)[ ![Flag of European Union](/flags/eu.svg)Mandatory EC / MDCG ### European Union May 2021 ](/standards/eu)[ ![Flag of United Kingdom](/flags/gb.svg)Guidance MHRA ### United Kingdom Reform program 2024โ€“26 ](/standards/uk)[ ![Flag of Japan](/flags/jp.svg)Mandatory PMDA / MHLW ### Japan Apr 2024 (cybersecurity notification) ](/standards/jp)[ ![Flag of China](/flags/cn.svg)Mandatory NMPA ### China 2022 ](/standards/cn)[ ![Flag of Canada](/flags/ca.svg)Mandatory Health Canada ### Canada Jun 2019 ](/standards/ca)[ ![Flag of Australia](/flags/au.svg)Guidance TGA ### Australia Jul 2019 (rev. 2022) ](/standards/au)[ ![Flag of South Korea](/flags/kr.svg)Mandatory MFDS ### South Korea 2019 (rev. 2023); Digital Medical Products Act (DMPA) enforced Jan 24 2025 ](/standards/kr)[ ![Flag of Singapore](/flags/sg.svg)Guidance HSA ### Singapore Apr 2022 (rev.) ](/standards/sg)[ ![Flag of Brazil](/flags/br.svg)Mandatory ANVISA ### Brazil Mar 2023 (RDC 751) ](/standards/br)[ ![Flag of Saudi Arabia](/flags/sa.svg)Guidance SFDA ### Saudi Arabia 2022 ](/standards/sa)[ ![Flag of Switzerland](/flags/ch.svg)Mandatory Swissmedic ### Switzerland May 2021 (MedDO) ](/standards/ch)[ ![Flag of India](/flags/in.svg)Guidance CDSCO ### India Oct 2023 (full notified-device coverage) ](/standards/in)[ ![Flag of Israel](/flags/il.svg)Mandatory AMAR / MoH ### Israel 2019 (cybersecurity circular) ](/standards/il)[ ![Flag of Taiwan](/flags/tw.svg)Guidance TFDA ### Taiwan Jul 2021 ](/standards/tw)[ ![Flag of Mexico](/flags/mx.svg)Guidance COFEPRIS ### Mexico Dec 2021 (NOM-241) ](/standards/mx)[ ![Flag of United Arab Emirates](/flags/ae.svg)Mandatory MOHAP / DHA / DoH ### United Arab Emirates 2020 (DoH ADHICS) ](/standards/ae)[ ![Flag of South Africa](/flags/za.svg)Guidance SAHPRA ### South Africa 2017 (licensing); cyber guidance 2022 ](/standards/za)[ ![Flag of Malaysia](/flags/my.svg)Guidance MDA ### Malaysia 2021 (cybersecurity guidance) ](/standards/my)[ ![Flag of Thailand](/flags/th.svg)Guidance Thai FDA ### Thailand 2021 (revised MD Act) ](/standards/th)[ ![Flag of Indonesia](/flags/id.svg)Guidance Kemenkes ### Indonesia 2017 ](/standards/id)[ ![Flag of Argentina](/flags/ar.svg)Guidance ANMAT ### Argentina 2002 (rev. 2022) ](/standards/ar)[ ![Flag of New Zealand](/flags/nz.svg)Guidance Medsafe ### New Zealand WAND active; reform Bill repealed Dec 2024; replacement Medical Products Bill planned ~2026 ](/standards/nz)[ ![Flag of Turkey](/flags/tr.svg)Mandatory TฤฐTCK ### Turkey Jun 2021 ](/standards/tr)[ ![Flag of Norway](/flags/no.svg)Mandatory DMP / Helsetilsynet ### Norway May 2021 ](/standards/no)[ ![Flag of Colombia](/flags/co.svg)Guidance INVIMA ### Colombia 2005 (rev. 2023) ](/standards/co)[ ![Flag of Chile](/flags/cl.svg)Emerging ISP / ANID ### Chile 2024 (Ley 21.541 in implementation); Exempt Decree No. 25/2026 published Mar 19 2026 ](/standards/cl)[ ![Flag of Vietnam](/flags/vn.svg)Mandatory DMEC / MoH ### Vietnam Jan 2022 ](/standards/vn)[ ![Flag of Philippines](/flags/ph.svg)Guidance FDA Philippines ### Philippines 2018 ](/standards/ph)[ ![Flag of Ukraine](/flags/ua.svg)Mandatory SES ### Ukraine 2013 (Resolution 753), revised 2023 ](/standards/ua)[ ![Flag of Kazakhstan](/flags/kz.svg)Mandatory NCEMP ### Kazakhstan 2016 (EAEU Decision 46) ](/standards/kz)[ ![Flag of Egypt](/flags/eg.svg)Guidance EDA ### Egypt 2019 (Law 151/2019 - EDA establishment) ](/standards/eg)[ ![Flag of Hong Kong](/flags/hk.svg)Guidance MDD ### Hong Kong 2004 (voluntary MDACS launched) ](/standards/hk)[ ![Flag of Kuwait](/flags/kw.svg)Guidance KDA ### Kuwait 2017 (KDFC medical device circulars) ](/standards/kw)[ ![Flag of Taiwan](/flags/tw.svg)Guidance TFDA ### Taiwan 2021 (v1); v2 issued Nov 2023 ](/standards/tw)[ ![Flag of Thailand](/flags/th.svg)Guidance Thai FDA ### Thailand 2008 (Medical Device Act); classification rules 2021 ](/standards/th)[ ![Flag of South Africa](/flags/za.svg)Guidance SAHPRA ### South Africa 2017 (medical-device licensing under SAHPRA) ](/standards/za)[ ![Flag of Russia](/flags/ru.svg)Mandatory Roszdravnadzor ### Russia 2012 (Gov. Decree 1416) ](/standards/ru) Head to head ## The pairings everyone asks about. Six in-depth comparisons of the most-searched regulator pairings - bottom-line, deltas, and answers to the questions that come up in every dual-submission planning call. [ ![Flag of United States](/flags/us.svg)vs ![Flag of European Union](/flags/eu.svg) ### FDA 524B vs EU MDR The FDA's ยง524B regime and the EU MDR cybersecurity expectations (MDCG 2019-16 + GSPR Annex I ยง17) share a common backbone - SPDF-style lifecycle, SBOM, threat โ€ฆ Compare ](/compare/fda-vs-eu-mdr)[ ![Flag of United States](/flags/us.svg)vs ![Flag of Japan](/flags/jp.svg) ### FDA 524B vs PMDA PMDA's 2024 cybersecurity guidance is the closest international mirror of FDA ยง524B - same SPDF logic, same SBOM expectation, same lifecycle commitments. The diโ€ฆ Compare ](/compare/fda-vs-pmda)[ ![Flag of United States](/flags/us.svg)vs ![Flag of United Kingdom](/flags/gb.svg) ### FDA 524B vs MHRA MHRA recognises CE marking until June 2030 - and following a Feb 2026 targeted consultation, is considering making that recognition indefinite (outcome expectedโ€ฆ Compare ](/compare/fda-vs-mhra)[ ![Flag of United States](/flags/us.svg)vs ![Flag of Canada](/flags/ca.svg) ### FDA 524B vs Health Canada Health Canada's 2024 pre-market cybersecurity guidance is the highest-reuse target on the planet for FDA-cleared devices - roughly 95% of the FDA evidence transโ€ฆ Compare ](/compare/fda-vs-health-canada)[ ![Flag of United States](/flags/us.svg)vs ![Flag of China](/flags/cn.svg) ### FDA 524B vs NMPA NMPA is the largest reformat on the crosswalk. FDA evidence stays useful, but China overlays MLPS 2.0 (cybersecurity classification), PIPL (personal informationโ€ฆ Compare ](/compare/fda-vs-nmpa)[ ![Flag of European Union](/flags/eu.svg)vs ![Flag of United Kingdom](/flags/gb.svg) ### EU MDR vs MHRA Until 30 June 2030 - or later, if MHRA's Feb 2026 consultation on indefinite CE recognition is enacted - MHRA accepts CE-marked devices on the GB market with noโ€ฆ Compare ](/compare/eu-mdr-vs-uk-mhra)[ ![Flag of European Union](/flags/eu.svg)vs ![Flag of Japan](/flags/jp.svg) ### EU MDR vs PMDA PMDA's 2024 cybersecurity guidance is closer to MDCG 2019-16 than most regulators - both anchor on IMDRF N60 and SPDF logic. About 80% of an EU technical file tโ€ฆ Compare ](/compare/eu-mdr-vs-pmda)[ ![Flag of European Union](/flags/eu.svg)vs ![Flag of Canada](/flags/ca.svg) ### EU MDR vs Health Canada Health Canada's 2024 pre-market cybersecurity guidance is one of the highest-reuse targets for an EU technical file - roughly 85% lifts cleanly. The additions aโ€ฆ Compare ](/compare/eu-mdr-vs-health-canada)[ ![Flag of United States](/flags/us.svg)vs ![Flag of Australia](/flags/au.svg) ### FDA 524B vs TGA TGA's 2024 cybersecurity guidance v2 is closely aligned to FDA ยง524B - both reference IMDRF N60, both expect SPDF-style lifecycle evidence, both want an SBOM. Aโ€ฆ Compare ](/compare/fda-vs-tga)[ ![Flag of United States](/flags/us.svg)vs ![Flag of South Korea](/flags/kr.svg) ### FDA 524B vs MFDS MFDS's 2024 cybersecurity notification is broadly aligned to FDA ยง524B at the principles level - same lifecycle expectations, same threat-model and SBOM logic. โ€ฆ Compare ](/compare/fda-vs-mfds) Sponsored note ยท Blue Goat Cyber Planning a global launch? Talk to the people who've cleared 250+ submissions. Blue Goat Cyber handles the full cybersecurity stack, penetration testing, SBOMs, threat modeling, SPDF and submission-ready documentation, for FDA, EU MDR, and beyond. The Crosswalk shows you the map; we walk it with you. [Book a 30-min strategy session](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) The Crosswalk An independent reference for global medical device cybersecurity standards. A field guide for MedTech innovators and RA/QA teams charting an international path. Resource - [Comparison matrix](/compare) - [Global playbook](/playbook) - [Glossary](/glossary) - [FAQ](/faq) Sponsored by [Blue Goat Cyber โ†—](https://bluegoatcyber.com) Editorially independent. Sponsorship keeps it free. ยฉ 2026 The Crosswalk. Not legal advice. Validate every requirement against current regulator publications.