The pressure is growing as attacks on essential services become more serious. In the year ending August 2025, the NCSC handled 429 cyber incidents, including 204 that were considered nationally significant.
For manufacturers, the real question is not whether cybersecurity matters. It is what evidence regulators and healthcare buyers expect to see, and how testing supports that evidence.
Understanding UKCA medical device cybersecurity requirements means looking beyond a scan report or testing certificate. This guide explains where VAPT fits, and what manufacturers need to prepare.
The UK MedTech Regulatory Landscape: CE vs. UKCA
Great Britain regulates medical devices under the UK Medical Devices Regulations 2002, as amended. The MHRA oversees the market, while manufacturers are responsible for meeting the rules that apply to their device and keeping the required technical evidence.
The conformity route depends on device type and classification. A UK Approved Body is needed where third-party assessment applies, but many Class I devices can use self-declaration. Manufacturers outside the UK must appoint a UK Responsible Person.
For software and connected devices, UKCA medical device cybersecurity requirements become relevant where security weaknesses could affect safety, performance, data integrity, or intended operation.
Can CE Marked Medical Devices Still Enter Great Britain?
Yes. In 2026, UKCA is not the only route into Great Britain. Eligible CE-marked medical devices can still be placed on the market under transitional rules, with the deadline depending on the legislation and certification route used. EU MDR and EU IVDR-compliant devices are currently accepted until 30 June 2030, while some devices certified under earlier EU directives have shorter timelines.
MHRA also consulted in 2026 on indefinite recognition of devices meeting EU MDR and EU IVDR requirements. That proposal has not yet replaced the current deadlines in law.
Source: https://qualysec.com/ukca-m ...