Cybersecurity by Law: What new regulations are coming for Wearables?

Digital devices—including wearables—are becoming increasingly important in healthcare and everyday life. But with growing connectivity come higher security requirements. The European Union and other jurisdictions are responding with new legal frameworks. These will require manufacturers to integrate cybersecurity into the design of their devices. This article outlines the most important upcoming regulations for wearable cybersecurity.

1. Why Are New Cybersecurity Laws Needed?

Wearables process sensitive personal data, often in real time and continuously. Without sufficient protection, this data is vulnerable to:

• Data breaches and identity theft
• Manipulation of health metrics
• Unauthorized surveillance
• Malware and ransomware attacks

Until now, security standards have largely been voluntary. New laws aim to close this gap.

2. EU Cyber Resilience Act (CRA)

The Cyber Resilience Act is a draft EU regulation that introduces mandatory security requirements for digital products—especially those with software components. Key points:

• Applies to all devices with digital elements, including wearables
• Requires secure-by-design development
• Obligates manufacturers to monitor and fix vulnerabilities over the product’s lifecycle
• Demands incident reporting and risk documentation

Violations can result in high fines or product bans across the EU market.

3. EU Medical Device Regulation (MDR) and Cybersecurity

Medical-grade wearables must already comply with the MDR. This regulation also includes cybersecurity aspects:

• Devices must be protected against unauthorized access and data manipulation
• Risk assessments must include cybersecurity threats
• Secure update mechanisms and access controls are mandatory
• Documentation of cyber incidents is required

4. U.S. Legislation and International Developments

In the U.S., the FDA has updated its cybersecurity guidelines for medical devices. These include:

• Threat modeling during development
• Secure update procedures
• Software bill of materials (SBOM)
• Post-market surveillance

Similar regulations are also emerging in Canada, Japan, and Australia, with a focus on transparency and resilience.

5. What Does This Mean for Manufacturers?

Manufacturers must rethink their development processes:

• Introduce cybersecurity teams during product design
• Implement penetration testing and vulnerability scans
• Maintain update support even after product launch
• Communicate risks and security measures clearly to users
• Prepare for legal audits and compliance checks

6. Challenges for Startups and Smaller Vendors

New requirements can be overwhelming, especially for small companies. However:

• Modular security frameworks can reduce the burden
• Partnerships with certified cloud providers help with compliance
• Security certifications (e.g., ISO 27001, IEC 62443) build trust and reduce legal risk

7. Conclusion: Cybersecurity Is Becoming a Legal Obligation

The era of voluntary self-regulation is ending. With the Cyber Resilience Act and other legal frameworks, cybersecurity is becoming a mandatory feature of digital health products. Manufacturers must adapt early, or risk losing market access. For users, these laws offer long-overdue protection in an increasingly connected world.