Medical Device Cybersecurity: A New Challenge for Ukrainian Manufacturers

Update (July 2026): On 10 June 2026, the Cabinet of Ministers of Ukraine approved new MDR/IVDR-aligned Technical Regulations (Resolutions No. 758 and No. 759). They will apply from 31 December 2030; until then, Technical Regulations No. 753, 754 and 755 remain in force. Read more in our article “Ukraine Adopts EU MDR-Aligned Medical Device Regulations”.

Why does it matter?

Modern medical devices more and more often include software, network connectivity and data exchange with other systems. This opens up new possibilities — process automation, integration with laboratory information systems (LIS), remote monitoring — but it also creates new cybersecurity risks.

In the European Union, cyber protection has long been part of the regulatory framework: the relevant requirements are in the MDR (2017/745) and IVDR (2017/746), as well as in many guidance documents (MDCG, IMDRF) and standards (for example, IEC 81001-5-1).

This means that manufacturers have to take cyber threats into account already at the design stage (the security-by-design principle) and document all actions taken to manage these risks.

Which devices does it apply to?

Cybersecurity is not limited to complex information systems. Most risks arise with devices that:

• contain software or microprocessor control units;
• send or receive data over a network;
• can be accessed or updated remotely;
• store sensitive information (for example, test results).

For Ukrainian manufacturers this may include:

• automated hematology analyzers with software;
• digital endoscopes that can connect to an LIS;
• telemedicine devices;
• diagnostic platforms that process patient names or medical data.

What do European manufacturers do?

Under the MDR/IVDR, European manufacturers must:

• identify cyber threats as part of the risk analysis;
• assess the level of hazard and put technical and organisational controls in place;
• consider potential vulnerabilities, including those related to user errors or interaction with other systems;
• document the measures in sections of the technical file such as the Risk Management File, the instructions for use (IFU) and the Summary of Safety and Clinical Performance (SSCP);
• give clear limitations of use (for example, network or access mode requirements);
• plan post-market monitoring of cyber threats: tracking incidents, software updates, monitoring national vulnerability databases.

They also use sources such as:

• IEC 81001-5-1:2021 — a standard with security requirements for health software;
• MDCG 2019-16, MDCG 2020-1, IMDRF guidance — detailed cybersecurity guidance.

What is the situation in Ukraine?

The current Technical Regulations (No. 753, No. 754, No. 755) do not yet contain direct cybersecurity requirements. But the situation is changing fast:

• conformity assessment bodies already pay attention to security functions in software and to how they are justified in the technical file;
• the risk management file, software validation and instructions describing network requirements have all become a normal part of reviews during conformity assessment of Class IIa/IIb devices;
• cybersecurity is part of the upcoming harmonisation of the regulations with the MDR/IVDR — so in future these requirements will become mandatory.

At the moment there is no separate state document or standard in Ukraine that sets out the approach to cyber protection of medical devices. But this area will certainly be covered as the regulatory framework is updated.

What should a manufacturer consider?

If your device:

• contains embedded or standalone software;
• connects to a network;
• interacts with other systems;
• works with personal or medical data —

cyber protection should be part of your overall risk management system.

We recommend that you:

• describe possible threats and vulnerabilities in the risk management file;
• document the technical limitations of use related to the network, cloud services and external devices;
• give users clear instructions on how to avoid unsafe scenarios (for example, connecting to public Wi-Fi);
• prepare the technical file with the future MDR/IVDR requirements in mind, even if you are not planning to enter the EU market right now.

This will not only reduce risks when the technical documentation is reviewed, but also increase the trust of hospitals, distributors and end users.

Summary

Cybersecurity is already an essential part of the technical requirements in the EU — and it will inevitably become one in Ukraine. This is not a temporary recommendation but a long-term trend driven by the digitalisation of medical devices.

Manufacturers who start applying these practices now will gain real advantages — both in conformity assessment and when entering international markets.

Need help with risk analysis, updating your instructions for use or preparing a technical file? The ukraine-raa.com team advises manufacturers on MDR/IVDR requirements and is ready to support you at every stage.