MDCG 2019-16 Rev.2 expectations carry into Notified Body audits

Notified Bodies under EU MDR are increasingly aligning their audits with IEC 81001-5-1 and IEC 62304 cybersecurity processes, layered on top of MDCG 2019-16 guidance. If you have an FDA-aligned SPDF, the gap to a clean CE technical file is smaller than it looks - but you'll need explicit traceability between security risk control measures and design outputs, plus evidence of post-market vulnerability handling tied to your PMS plan.

• MDCG 2019-16 Rev.2 at six months: Notified Body audit patterns

  Six months in, Notified Body audits under MDCG 2019-16 Rev.2 show three clear failure modes - narrative-only SBOMs, CVD policies without operational evidence, and traceability gaps between security risk controls and design outputs.
  Oct 2026
• Three years of Section 524B: the deficiencies that never went away

  Three-year retrospective on Section 524B enforcement: SBOM depth, VEX justification, and CVD operational evidence remain the top three categories of cyber deficiencies. Two new patterns emerged in 2026 - AI/ML threat-model gaps and weak end-of-support labeling.
  Oct 2026
• IEC 81001-5-1 Amendment 1 reaches FDIS - what MedTech teams should track

  Amendment 1 to IEC 81001-5-1 (health software security lifecycle) is in Final Draft International Standard ballot. It sharpens SBOM, CVD, and postmarket vulnerability expectations - and it's the standard EU Notified Bodies are quietly aligning MDCG 2019-16 audits against.
  Sep 2026