LIVE — Last crawled: 2026-11-14 07:06 JST
Vol.1 — November 15, 2026
MSC Portal ›Regulatory Watch› All Entries (134)
Standards, Guidance & Notices
Showing 31–40 of 134
NIST
CSWP
CSWP 34
Mitigating Cybersecurity and Privacy Risks in Telehealth Smart Home Integration
PUBLISHED Risk Management
In-patient service demands have increased during a time when patients have experienced reduced access to hospital care. Hospital-at-Home (HaH) solutions are a form of telehealth that provide an in-patient care experience in patients’ homes, offering the potential for improved outcomes. While these are desirable benefits, HaH involves privacy and cybersecurity risks by introducing hospital-grade medical or biometric devices and information systems outside the hospital’s direct control (i.e., the patient’s home). Patient homes increasingly feature Internet of Things (IoT) devices, such as voice assistants (e.g., smart speakers), as part of a broader “smart home” ecosystem. These devices may not have capabilities that support privacy and security practices and may be used as pivot points for attackers to gain access to a hospital’s information system. This paper introduces a notional high-level smart home integration reference architecture to better un
Published: 2025-12-17
IEC
IEC TS 81001-2-2:2025
Health software and health IT systems safety, effectiveness and security — Part 2-2: Coordination — Guidance for the implementation, disclosure and communication of security needs, risks and controls
PUBLISHED Cybersecurity
Withdraws and replaces IEC TR 80001-2-2. Provides guidance for communication of security needs, risks and controls for health software connected to IT networks.
Published: 2025-10-01
NIST
IR
IR 8259 Rev. 1 (2pd)
Foundational Cybersecurity Activities for IoT Product Manufacturers
DRAFT Cybersecurity
Internet of Things (IoT) products often lack product cybersecurity capabilities their customers—organizations and individuals—can use to help mitigate their cybersecurity risks. Manufacturers can help their customers by improving the securability of their IoT products by providing necessary cybersecurity functionality and by providing customers with the cybersecurity-related information they need. This publication describes recommended activities related to cybersecurity that manufacturers should consider performing before their IoT products are sold to customers. These foundational cybersecurity activities can help manufacturers lessen the cybersecurity-related efforts needed by customers, which in turn can reduce the prevalence and severity of compromises.
Published: 2025-09-30
JFMDA
Notice
jfmda_20250929_33bce5c8
Alert Regarding the Expiration of Windows Secure Boot Certificates
PUBLISHED Cybersecurity
For medical devices running Windows under an embedded license agreement, from Windows Embedded 8 Standard onward, that use the Secure Boot function, the expiration of the Secure Boot certificates in June 2026 may have serious impacts, such as the devices no longer being able to receive subsequent security updates or becoming unstable all at once. JFMDA asks readers to read the attached alert and take action. Issued by the Medical Device Cybersecurity WG of the JFMDA Liaison and Coordination Meeting.
Published: 2025-09-29
JFMDA
Notice
jfmda_20250827_AI
Final Study Report for Review of SaMD Utilizing AI
PUBLISHED AI / Machine Learning
In October 2022, the JFMDA Regulatory System Committee set up a working group on review of AI-enabled SaMD under its review-related subcommittee. Its purpose was to discuss the requirements for the review of AI-enabled SaMD (including medical devices that contain software), such as what to describe in the application and which documents are needed, with PMDA review and standards staff, based on the outputs of AMED research on regulation of software medical devices using AI and other advanced technologies and on current review practice, and to improve the transparency of review by publishing the results. This report summarizes the activities of the working group.
Published: 2025-08-27
ISO
ISO/IEC 42006:2025
Information technology — Artificial intelligence — Requirements for bodies providing audit and certification of artificial intelligence management systems
PUBLISHED AI / Machine Learning
Specifies requirements for bodies providing audit and certification of AI management systems conforming to ISO/IEC 42001. Forms the foundation for AI conformity assessment schemes. Referenced in the context of EU AI Act harmonized standards development.
Published: 2025-07-07
EU
MDCG
MDCG 2025-6
FAQ on Interplay between the Medical Devices Regulation (MDR) & In vitro Diagnostic Medical Devices Regulation (IVDR) and the Artificial Intelligence Act (AIA)
PUBLISHED AI / Machine Learning
FAQ-style guidance issued jointly by the Medical Device Coordination Group (MDCG) and the Artificial Intelligence Board (AIB 2025-1 / MDCG 2025-6, June 2025) on the interplay between the MDR, the IVDR and the EU Artificial Intelligence Act (AIA), addressed primarily to manufacturers, notified bodies and competent authorities. It is not legally binding. Medical device AI (MDAI) is high-risk under the AIA where it is a safety component of a device, or is itself a device, and is subject to third-party conformity assessment by a notified body. The document explains how AI-specific requirements, such as data governance with attention to bias, transparency, human oversight, and accuracy, robustness and cybersecurity, can be integrated into a single set of MDR/IVDR technical documentation and the conformity assessment. It also covers post-market monitoring and pre-determined changes for MDAI that continue to learn after being placed on the market, noting that guidance on pre-determined change control plans was still under development. The AIA high-risk application date cited in the document (2 August 2027) reflects the law at the time of issue; under Regulation (EU) 2026/1744 it is now 2 August 2028 for Annex I products, which include medical devices.
Published: 2025-06-01
EU
MDCG
MDCG 2025-4
Guidance on the safe making available of medical device software (MDSW) apps on online platforms
PUBLISHED AI / Machine Learning
Guidance (MDCG 2025-4, published 16 June 2025) clarifying the responsibilities of online platforms that make medical device software (MDSW) apps available, and how the MDR, the IVDR, and the Digital Services Act (DSA) interact. Where a platform merely connects a manufacturer with users, it is treated as an online marketplace under the DSA rather than a distributor or importer under the MDR/IVDR, but it still carries DSA obligations such as a mechanism for reporting illegal content, ensuring manufacturers provide transparent safety and compliance information, and, for very large platforms, risk assessment and mitigation. Where a platform itself supplies the app directly to users, it is instead treated as a distributor or importer under the MDR/IVDR, the DSA no longer applies, and the platform must verify compliance and cooperate with authorities. The guidance also recommends that platforms create a dedicated category for MDSW apps, separate from general health and wellness apps, and lists the information manufacturers should provide, including the device name, manufacturer details (including the Single Registration Number, SRN), the MD or IVD symbol, intended purpose, warnings, a link to the electronic instructions for use (eIFU), and the UDI-DI.
Published: 2025-06-01
EU
MDCG
MDCG 2019-11 rev.1
Qualification and classification of software - Regulation (EU) 2017/745 and Regulation (EU) 2017/746
PUBLISHED AI / Machine Learning
Revision 1 of MDCG 2019-11 (published 17 June 2025), the core guidance on qualifying software as a medical device (MDSW) and classifying it under the MDR (Regulation (EU) 2017/745) and the IVDR (Regulation (EU) 2017/746). The revision clarifies the scope of the guidance, adds considerations on establishing a clear intended purpose and on modular MDSW (defining intended purpose at the level of individual functional modules), and clarifies the interpretation of Classification Rule 11 sub-rule (a) concerning devices intended to prevent the risk of illness, with additional reference material and examples. It also adds a new Class I example to Annex IV and updates Annex I to reflect the interplay with the European Health Data Space Regulation.
Published: 2025-06-01
ISO
ISO/IEC 42005:2025
Information technology — Artificial intelligence — AI system impact assessment
PUBLISHED AI / Machine Learning
Specifies processes and requirements for assessing the impacts of AI systems on society, individuals and the environment. Intended for use in conjunction with ISO/IEC 42001. Serves as a framework for impact assessment in medical AI development.
Published: 2025-05-28
‹ 1 2 3 4 5 6 … 14 ›