German Bundestag approves CRA implementation law ahead of December 2027 requirements

The German Bundestag has approved the Cyber Resilience Act implementation legislation. The legislation establishes national oversight responsibilities for the EU’s cybersecurity requirements for products with digital elements. This parliamentary approval should not be confused with those requirements already applying in full.

The MedTech Angle

Medical device ecosystem can include device gateways, imaging software, laboratory systems and vendor service applications. These are useful starting points for a scope assessment, but not a list of products confirmed as covered by this announcement.

The clinical stakes depend on deployment for example, a compromised supporting technology can interrupt care, undermine diagnostic-data integrity or provide a route into clinical networks. Manufacturers and healthcare delivery organisations should therefore distinguish regulatory scope from operational dependency. A product’s scope assessment does not replace assessment of the risks it creates for connected clinical services.

The BSI announcement does not establish that every medical device falls under the CRA. Start by checking product classification and it's applicable sector-specific exclusions rather than treating the presence of software as sufficient.

From The Agency's Perspective

The BSI announcement describes cybersecurity obligations across the product lifecycle, beginning with development. It assigns the BSI market-surveillance powers to inspect products, require remediation, impose sanctions and remove non-compliant products from the market, alongside notifying-authority and complaints-handling roles.

For medical-device manufacturers, keep CRA applicability analysis separate from existing EU MDR post-market cybersecurity work. Document which requirement applies to each product and how vulnerability handling, maintenance and customer communications support that assessment.

A few recommended actions:

1. Start by building a scope register, classify products and review SBOMs. Ensure to record the rationale for inclusion, exclusion or unresolved status.

2. Identify systems that cannot be updated before validation and assess segmentation, restricted service access and consider all other compensating controls.

3. Review relevant security logs and confirm who assesses vulnerabilities and incidents for potential reporting.

4. Then establish a December 2027 readiness plan covering evidence, validated updates, supplier commitments and customer communications.

Further reading:
BSI announcement on the CRA implementation legislation.