Question 1

Is a medical device an important product under the Cyber Resilience Act, and what does it still have to do?

Accepted Answer

No. Regulation (EU) 2017/745 applies, so the Act does not (Art. 2(2)(a)). The Cyber Resilience Act's classes do not apply; the UK PSTI rules and California's law are read by where it is sold.

Question 2

What does a medical device sold to UK consumers or in California have to show?

Accepted Answer

Under the UK PSTI rules: no universal default password, a published point of contact for security issues, a published defined support period, and a statement of compliance with the product. Under California Civil Code 1798.91.04: a reasonable security feature, and for authentication outside a local area network a password unique to each device or one the user sets before first access.

Medical device

A line that places here

Other functions in out of scope (article 2)