MDCG 2019-16 Rev.2 expectations carry into Notified Body audits

Notified Bodies under EU MDR are increasingly aligning their audits with IEC 81001-5-1 and IEC 62304 cybersecurity processes, layered on top of MDCG 2019-16 guidance. If you have an FDA-aligned SPDF, the gap to a clean CE technical file is smaller than it looks — but you'll need explicit traceability between security risk control measures and design outputs, plus evidence of post-market vulnerability handling tied to your PMS plan.

• QMSR replaces 21 CFR 820 — what changes for cybersecurity

  FDA's Quality Management System Regulation harmonizes Part 820 with ISO 13485. Cyber design controls and CAPA expectations carry over with subtle scoping changes.
  Feb 2026
• Two years of Section 524B: what FDA reviewers are pushing back on

  Patterns from recent deficiency letters: weak SBOM hygiene, missing VEX statements, and CVD policies that exist on paper but have no real intake.
  Oct 2025
• MedTechCyberTips.com is live

  Nine deeply organized topics, a guided journey, and a glossary covering every acronym in FDA cyber guidance.
  Jun 2025