--- title: "MDCG 2019-16 Rev.2 lands - Notified Body audits are…" description: "The latest revision to MDCG 2019-16 tightens expectations around SBOMs, post-market vulnerability handling, and traceability between security risk controls…" lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://medtechcybertips.com/#website", "url": "https://medtechcybertips.com/", "name": "MedTech Cyber Tips", "description": "The ultimate organized guide to medical device cybersecurity.", "inLanguage": "en-US", "publisher": { "@id": "https://medtechcybertips.com/#org" }, "potentialAction": { "@type": "SearchAction", "target": "https://medtechcybertips.com/topics?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@type": "Organization", "@id": "https://medtechcybertips.com/#org", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com/", "logo": "https://medtechcybertips.com/icon-512.png", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com", "sameAs": [ "https://home.bluegoatcyber.com/", "https://codebluechart.com/", "https://why.bluegoatcyber.com/", "https://spdf.bluegoatcyber.com/", "https://threatmodel.bluegoatcyber.com/", "https://pentesting.bluegoatcyber.com/", "https://premarket.bluegoatcyber.com/", "https://fdaresponse.bluegoatcyber.com/", "https://postmarket.bluegoatcyber.com/", "https://goatwatch.bluegoatcyber.com/" ] } } ] }, { "@context": "https://schema.org", "@type": "BlogPosting", "headline": "MDCG 2019-16 Rev.2 lands - Notified Body audits are catching up", "description": "The latest revision to MDCG 2019-16 tightens expectations around SBOMs, post-market vulnerability handling, and traceability between security risk controls and design outputs. Here's the FDA-to-CE gap, condensed.", "datePublished": "2026-04-18", "dateModified": "2026-04-18", "url": "https://medtechcybertips.com/updates/mdcg-2019-16-rev2", "mainEntityOfPage": "https://medtechcybertips.com/updates/mdcg-2019-16-rev2", "author": { "@type": "Person", "@id": "https://medtechcybertips.com/authors/editorial-team", "name": "MedTech Cyber Tips Editorial Team" }, "reviewedBy": { "@type": "Person", "@id": "https://medtechcybertips.com/authors/editorial-team", "name": "MedTech Cyber Tips Editorial Team" }, "publisher": { "@type": "Organization", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com", "sponsor": { "@type": "Organization", "name": "Blue Goat Cyber" } }, "articleSection": "EU MDR" }, { "@context": "https://schema.org", "@type": "Person", "@id": "https://medtechcybertips.com/authors/editorial-team", "url": "https://medtechcybertips.com/authors/editorial-team", "name": "MedTech Cyber Tips Editorial Team", "jobTitle": "Medical Device Cybersecurity Editors", "description": "The MedTech Cyber Tips editorial team is a group of practitioners with hands-on experience across FDA premarket cybersecurity submissions, Secure Product Development Framework (SPDF) implementation, medical device threat modeling, and postmarket vulnerability management. Every article, checklist, and update on this site is reviewed for accuracy against the FDA's February 3, 2026 final premarket cybersecurity guidance, Section 524B of the FD&C Act, MDCG 2019-16 Rev.2, IEC 81001-5-1, ISO 14971, and the EU Cyber Resilience Act. The team also tracks 510(k) deficiency patterns and CVE trends affecting connected medical devices so guidance on the site stays current.", "knowsAbout": [ "Medical device cybersecurity", "FDA Section 524B", "FDA premarket cybersecurity guidance (Feb 3, 2026)", "Secure Product Development Framework", "SBOM and VEX", "Medical device threat modeling", "Postmarket vulnerability management", "EU MDR cybersecurity (MDCG 2019-16 Rev.2)", "EU Cyber Resilience Act", "IEC 81001-5-1", "ISO 14971 risk management" ], "sameAs": [ "https://bluegoatcyber.com/about" ], "worksFor": { "@type": "Organization", "name": "MedTech Cyber Tips", "url": "https://medtechcybertips.com/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://medtechcybertips.com" }, { "@type": "ListItem", "position": 2, "name": "Updates", "item": "https://medtechcybertips.com/updates" }, { "@type": "ListItem", "position": 3, "name": "MDCG 2019-16 Rev.2 lands - Notified Body audits are catching up", "item": "https://medtechcybertips.com/updates/mdcg-2019-16-rev2" } ] } ] --- [Skip to main content](#main) [ MedTech Cyber Tips The Ultimate Guide ](/) [Home](/)[Find Your Path](/journey)[All Topics](/topics)Reference[About](/about) Search ⌘K [Updates](/updates) EU MDR April 18, 2026 # MDCG 2019-16 Rev.2 lands - Notified Body audits are catching up The latest revision to MDCG 2019-16 tightens expectations around SBOMs, post-market vulnerability handling, and traceability between security risk controls and design outputs. Here's the FDA-to-CE gap, condensed. Reviewed by [MedTech Cyber Tips Editorial Team](/authors/editorial-team) · Published Apr 18, 2026 · Last reviewed July 2026 MDCG 2019-16 Rev.2 brings EU expectations closer to FDA's Feb 2026 cyber premarket guidance, but with three notable deltas: 1\. [SBOM](/glossary/sbom) is now an explicit expectation, not just an implied 'state-of-the-art' artifact. Notified Bodies are asking for CycloneDX or SPDX with version pinning. 2\. Coordinated Vulnerability Disclosure must be documented as an operating capability - a published policy alone is insufficient. 3\. Traceability between security risk control measures and design outputs must be demonstrable in the technical file, not just narrated. If you have a clean FDA [524B](/glossary/524b) package, you are 70–80% of the way to [MDR](/glossary/mdr) cyber. The remaining work is mostly traceability plumbing and PMS process evidence. Source [MDCG guidance index](https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en) More updates - [ MDCG 2019-16 Rev.2 at six months: Notified Body audit patterns Six months in, Notified Body audits under MDCG 2019-16 Rev.2 show three clear failure modes - narrative-only SBOMs, CVD policies without operational evidence, and traceability gaps between security risk controls and design outputs. Oct 2026](/updates/mdcg-2019-16-rev2-six-month-retrospective) - [ Three years of Section 524B: the deficiencies that never went away Three-year retrospective on Section 524B enforcement: SBOM depth, VEX justification, and CVD operational evidence remain the top three categories of cyber deficiencies. Two new patterns emerged in 2026 - AI/ML threat-model gaps and weak end-of-support labeling. Oct 2026](/updates/524b-three-year-checkin) - [ IEC 81001-5-1 Amendment 1 reaches FDIS - what MedTech teams should track Amendment 1 to IEC 81001-5-1 (health software security lifecycle) is in Final Draft International Standard ballot. It sharpens SBOM, CVD, and postmarket vulnerability expectations - and it's the standard EU Notified Bodies are quietly aligning MDCG 2019-16 audits against. Sep 2026](/updates/iec-81001-5-1-amendment-1-fdis) MedTech Cyber Tips The organized, end-to-end guide to medical device cybersecurity, from concept through postmarket. Part of the Blue Goat Cyber family. Topics - [Overview](/topics/home) - [Why It Matters](/topics/why) - [SPDF](/topics/spdf) - [Threat Modeling](/topics/threatmodel) - [Pentesting](/topics/pentesting) Reference - [Glossary](/glossary) - [FDA vs MDR](/compare) - [Resources](/resources) - [Updates](/updates) - [RSS feed](/rss.xml) © 2026 medtechcybertips.com. An educational resource sponsored by Blue Goat Cyber. Not legal or regulatory advice.