The Crosswalk
    NewPer-page social previews and this changelog

    MHRA

    Flag of United KingdomUnited Kingdom - MHRA

    GuidanceLast updated · 2026 (Draft Medical Devices (Amendment) Regulations 2026 published; MHRA stakeholder impact survey underway alongside the Feb 2026 CE-recognition consultation)Verified · 2026-07-16

    UK MDR 2002 (as amended) + MHRA Cyber Guidance

    Share

    Authority

    Medicines and Healthcare products Regulatory Agency

    Enforced

    Reform program 2024–26

    Legal framework

    UK MDR 2002 + DTAC + NHS DSPT

    FDA package reuse

    ~80%

    Scope

    Devices marketed in Great Britain (Northern Ireland follows EU MDR via the Windsor Framework). Software as a Medical Device addressed by separate MHRA Change Programme.

    Pre-market

    Risk-based, leverages BS EN 81001-5-1 and FDA-aligned evidence. UKCA marking with grace period for CE-marked devices.

    Post-market

    MORE vigilance reporting + DTAC for NHS deployment + DSPT for connected services.

    SBOM

    Recommended

    Not mandated; encouraged via NCSC guidance and aligns with FDA expectations for dual-market devices.

    Vulnerability disclosure

    Encouraged via the NCSC Vulnerability Disclosure Toolkit.

    Penalty

    Market removal, criminal liability under Consumer Protection Act.

    Unique requirements

    • 01DTAC clinical safety, data protection, technical assurance for NHS
    • 02DSPT compliance for hosted services
    • 03International recognition route for FDA/Health Canada/TGA approvals (Draft 2026 Regulations codify the pathway; MHRA impact survey open)

    Highlights

    • Pragmatic FDA/EU dual-recognition
    • DTAC required for NHS deployment
    • Future divergence from EU MDR

    Aligns with

    IMDRF N60 BS EN 81001-5-1 NCSC CAF

    Timeline

    1. Jan 2021

      Brexit transition ends, UKCA introduced

    2. Sep 2021

      MHRA SaMD Change Programme launched

    3. 2024

      International Recognition route consultation

    4. Feb 16 2026

      MHRA consultation on indefinite recognition of CE-marked devices launched (closed; analysis underway)

    5. 2026

      Draft Medical Devices (Amendment) Regulations 2026 published for consultation; MHRA impact survey open

    Key documents

    How to submit in United Kingdom

    Playbook reviewed · 2026-07-16

    Submission route

    UKCA marking (or CE recognition through 30 June 2030) with an Approved Body, plus MHRA registration

    The UK continues to recognise CE-marked devices through 30 June 2030 while the post-Brexit framework catches up. MHRA's cybersecurity expectations mirror MDCG 2019-16 for now, with additional guidance on connected/AI devices published under the Software and AI as a Medical Device programme.

    Authority portal

    Step-by-step

    1. Step 01

      Decide CE recognition vs UKCA

      CE recognition is the low-friction path until 30 June 2030; UKCA is required afterwards and for Northern Ireland-only products.

    2. Step 02

      Engage an Approved Body (UKCA path)

      AB capacity in the UK is limited; book 6-12 months ahead for Class IIa+ devices.

    3. Step 03

      Package cybersecurity evidence

      MHRA accepts MDCG 2019-16-style documentation as-is; add UK-specific labeling for the UKRP.

    4. Step 04

      Register with MHRA

      All devices placed on the GB market must be registered by the UKRP within grace-period deadlines.

    Evidence checklist

    Item Level FDA equivalent Notes
    MDCG 2019-16-style cyber documentation Required SPDF
    UKRP appointment (non-UK manufacturers) Required —
    IEC 81001-5-1 evidence Recommended —
    PSTI-aligned vulnerability disclosure policy Recommended — Not legally required for medical devices but expected best practice.

    Common MHRA rejections

    UKRP details missing from labeling

    Common

    Fix · Add UKRP name and address to device labeling and IFU before AB audit.

    Reliance on CE certificate near 2030 sunset

    Occasional

    Fix · Start UKCA transition planning 18-24 months before June 2030 to avoid AB bottleneck.

    Typical timeline

    End-to-end window: 0-4 weeks (CE recognition) or 10-16 months (UKCA).

    Phase 01

    CE recognition path

    0-4 weeks

    MHRA registration only, if you already hold a valid CE certificate.

    Phase 02

    UKCA path (Class IIa+)

    10-16 months

    Includes AB queue + review.

    MHRA head-to-head

    Related markets

    Frequently asked about United Kingdom

    Is SBOM required for medical devices in United Kingdom?

    Recommended. Not mandated; encouraged via NCSC guidance and aligns with FDA expectations for dual-market devices.

    What does MHRA require for pre-market cybersecurity?

    Risk-based, leverages BS EN 81001-5-1 and FDA-aligned evidence. UKCA marking with grace period for CE-marked devices.

    What are the post-market cybersecurity obligations under MHRA?

    MORE vigilance reporting + DTAC for NHS deployment + DSPT for connected services.

    What is the penalty for non-compliance with MHRA cybersecurity rules?

    Market removal, criminal liability under Consumer Protection Act.

    How much of my FDA cybersecurity package is reusable in United Kingdom?

    Roughly 80% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).