{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T18:59:24Z","timestamp":1785437964531,"version":"3.56.0"},"reference-count":58,"publisher":"JMIR Publications Inc.","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JMIR Med Inform"],"abstract":"Abstract<\/jats:title>\n \n Background<\/jats:title>\n Software-based and AI-enabled medical devices are increasingly networked and updatable, expanding the attack surface and making cybersecurity governance intersect with quality management and postmarket oversight. Regulated device risk management nevertheless remains primarily oriented toward patient-safety harms under ISO 14971 frameworks, which may not fully capture cybersecurity risks affecting data integrity, system resilience, or service continuity.<\/jats:p>\n <\/jats:sec>\n \n Objective<\/jats:title>\n This study aimed to compare how Korea\u2019s Ministry of Food and Drug Safety (MFDS), the US Food and Drug Administration (FDA), and the European Union\/Medical Device Coordination Group (EU\/MDCG) define and operationalize cybersecurity for medical device software across premarket review and postmarket surveillance, and to identify informatics-relevant gaps between safety vigilance and vulnerability-focused cybersecurity practice.<\/jats:p>\n <\/jats:sec>\n \n Methods<\/jats:title>\n We conducted a qualitative comparative document analysis of 10 jurisdiction-specific regulatory and guidance documents (MFDS: n=2, FDA: n=4, and EU\/MDCG: n=4), supplemented by cross-sectoral instruments and peer-reviewed literature. Using a common analytic framework informed by functional comparative legal analysis, we mapped (1) conceptual scope (definitions and life cycle boundaries), (2) premarket operationalization (required artifacts and evidence such as threat modeling, software bills of materials, and vulnerability management plans), and (3) postmarket operationalization (monitoring, reporting, and update governance).<\/jats:p>\n <\/jats:sec>\n \n Results<\/jats:title>\n Of the 10 documents analyzed (MFDS: n=2, FDA: n=4, and EU\/MDCG: n=4), all 3 jurisdictions converged on protecting confidentiality, integrity, and availability of data and device functions but embedded these expectations in different regulatory architectures. MFDS emphasized documentation completeness aligned with ISO 14971 risk management; the FDA framed cybersecurity as quality-system and design-control activities spanning the total product life cycle, including statutory requirements for \u201ccyber devices\u201d under Federal Food, Drug, and Cosmetic Act section 524B; and the European Union treated cybersecurity as an extension of safety under the Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR), interpreted through MDCG guidance, with additional cross-sector obligations from the Network and Information Security 2 (NIS2) Directive and the General Data Protection Regulation (GDPR). A common limitation was that vigilance pathways were largely triggered by patient-harm thresholds, whereas vulnerabilities and near-miss security events were often managed through parallel information-security processes. Mapping to ISO 13485 Clauses 7.3 and 8 indicated that integration of cybersecurity controls into existing quality management system (QMS) processes is feasible but not consistently mandated.<\/jats:p>\n <\/jats:sec>\n \n Conclusions<\/jats:title>\n Across the 3 jurisdictions examined in this study, regulatory approaches to medical device cybersecurity show definitional alignment but operational fragmentation at the interface between patient-safety vigilance and vulnerability-centric cybersecurity practice. Within the limits of this document-based analysis, the findings suggest that integrating cybersecurity as an interoperable process within the QMS\u2014linking vulnerability monitoring, incident response, and software update controls to corrective and preventive action (CAPA) and change control\u2014and expanding postmarket surveillance to incorporate vulnerability and performance signals could support more trustworthy deployment of regulated AI-enabled medical software.<\/jats:p>\n <\/jats:sec>","DOI":"10.2196\/94846","type":"journal-article","created":{"date-parts":[[2026,6,23]],"date-time":"2026-06-23T14:00:07Z","timestamp":1782223207000},"page":"e94846-e94846","source":"Crossref","is-referenced-by-count":0,"title":["Regulatory Approaches to Cybersecurity Risk Management for AI-Enabled Medical Device Software in Korea, the United States, and the European Union: Comparative Document Analysis"],"prefix":"10.2196","volume":"14","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-1576-4846","authenticated-orcid":false,"given":"Saera","family":"Jung","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4105-9028","authenticated-orcid":false,"given":"Kihong","family":"Son","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1010","published-online":{"date-parts":[[2026,7,30]]},"reference":[{"issue":"4","key":"R1","doi-asserted-by":"publisher","DOI":"10.2196\/20652","article-title":"Tracking the presence of software as a medical device in US food and drug administration databases: retrospective data analysis","volume":"6","author":"Ceross","journal-title":"JMIR Biomed Eng"},{"issue":"3","key":"R2","doi-asserted-by":"publisher","first-page":"221","DOI":"10.3390\/prosthesis3030022","article-title":"Evaluating the presence of software-as-a-medical-device in the Australian therapeutic goods register","volume":"3","author":"Ceross","journal-title":"Prosthesis"},{"issue":"6","key":"R3","doi-asserted-by":"publisher","first-page":"1059","DOI":"10.1007\/s12553-024-00890-3","article-title":"A thematic analysis of ransomware incidents among United States hospitals, 2016\u20132022","volume":"14","author":"Munoz Cornejo","journal-title":"Health Technol"},{"issue":"12","key":"R4","doi-asserted-by":"publisher","DOI":"10.1001\/jamahealthforum.2022.4873","article-title":"Trends in ransomware attacks on US Hospitals, clinics, and other health care delivery organizations, 2016-2021","volume":"3","author":"Neprash","journal-title":"JAMA Health Forum"},{"key":"R5","doi-asserted-by":"publisher","DOI":"10.2147\/MDER.S50048","article-title":"Cybersecurity vulnerabilities in medical devices: a complex environment and multifaceted problem","volume":"8","author":"Williams","journal-title":"Med Devices (Auckl)"},{"issue":"4","key":"R6","doi-asserted-by":"publisher","first-page":"3723","DOI":"10.1109\/COMST.2019.2914094","article-title":"Security vulnerabilities, attacks, countermeasures, and regulations of networked medical devices\u2014a review","volume":"21","author":"Yaqoob","journal-title":"IEEE Commun Surv Tutorials"},{"issue":"1","key":"R7","doi-asserted-by":"publisher","first-page":"257","DOI":"10.1007\/s11517-023-02912-0","article-title":"Security vulnerabilities in healthcare: an analysis of medical devices and software","volume":"62","author":"Mej\u00eda-Granda","journal-title":"Med Biol Eng Comput"},{"issue":"1","key":"R8","doi-asserted-by":"publisher","DOI":"10.1038\/s41598-023-45927-1","article-title":"Cybersecurity vulnerability analysis of medical devices purchased by national health services","volume":"13","author":"Bracciale","journal-title":"Sci Rep"},{"issue":"1","key":"R9","doi-asserted-by":"publisher","DOI":"10.1186\/s12911-020-01259-y","article-title":"Analyzing medical device connectivity and its effect on cyber security in German hospitals","volume":"20","author":"Willing","journal-title":"BMC Med Inform Decis Mak"},{"issue":"1","key":"R10","doi-asserted-by":"publisher","DOI":"10.1038\/s41746-025-01710-2","article-title":"How secure are your health devices-stopping wearables becoming a personal and national security risk?","volume":"8","author":"Ostermann","journal-title":"NPJ Digit Med"},{"key":"R11","unstructured":"IEC 81001-5-1:2021. health software and health IT systems safety, effectiveness and security\u2014part 5-1: security\u2014activities in the product life cycle. International Electrotechnical Commission; 2021. URL: https:\/\/www.iso.org\/standard\/76097.html [Accessed 15-07-2026]"},{"key":"R12","unstructured":"Principles for medical device security\u2014risk management. Association for the Advancement of Medical Instrumentation; 2023. URL: https:\/\/array.aami.org\/doi\/10.2345\/9781570206122 [Accessed 20-07-2026]"},{"key":"R13","doi-asserted-by":"crossref","unstructured":"The NIST Cybersecurity Framework (CSF) 2.0. National Institute of Standards and Technology; 2024. URL: https:\/\/doi.org\/10.6028\/NIST.CSWP.29 [Accessed 07-03-2026]","DOI":"10.6028\/NIST.CSWP.29.pol"},{"key":"R14","doi-asserted-by":"crossref","unstructured":"IEEE\/UL. Standard for Wireless Diabetes Device Security\u2014Information Security Requirements for Connected Diabetes Solutions. Institute of Electrical and Electronics Engineers; 2022:1-29. [doi: 10.1109\/IEEESTD.2022.9773069]","DOI":"10.1109\/IEEESTD.2022.9773069"},{"key":"R15","unstructured":"International Electrotechnical Commission. Medical electrical equipment\u2014part 4-5: guidance and interpretation\u2014safety-related technical security specifications. International Electrotechnical Commission; 2021. IEC TR 60601-4-5. URL: https:\/\/cdn.standards.iteh.ai\/samples\/103054\/238d13c1fb034cf7b9e2d765f95dc568\/IEC-TR-60601-4-5-2021.pdf [Accessed 01-07-2026]"},{"key":"R16","unstructured":"IEEE\/UL Standard for Clinical Internet of Things (IoT) Data and Device Interoperability with TIPPSS--Trust, Identity, Privacy, Protection, Safety, and Security. IEEE; 2023. URL: https:\/\/standards.ieee.org\/ieee\/2933\/7592\/ [Accessed 20-07-2026]"},{"key":"R17","unstructured":"European Parliament, Council of the European Union. Regulation (EU) 2024\/2847 on horizontal cybersecurity requirements for products with digital elements (cyber resilience act). European Union. 2024. URL: https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/2847\/oj [Accessed 07-03-2026]"},{"key":"R18","unstructured":"European Parliament, Council of the European Union. Directive (EU) 2022\/2555 on measures for a high common level of cybersecurity across the union (NIS 2 directive). European Union. 2022. URL: https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj [Accessed 07-03-2026]"},{"key":"R19","unstructured":"European Parliament, Council of the European Union. Regulation (EU) 2024\/1689 laying down harmonised rules on artificial intelligence (artificial intelligence act). European Union. Jun 13, 2024. URL: https:\/\/eur-lex.europa.eu\/eli\/reg\/2024\/1689\/oj [Accessed 07-03-2026]"},{"key":"R20","unstructured":"European Parliament, Council of the European Union. Regulation (EU) 2019\/881 on ENISA (the european union agency for cybersecurity) and on information and communications technology cybersecurity certification (cybersecurity act). Off J Eur Union. 2019. URL: https:\/\/eur-lex.europa.eu\/eli\/reg\/2019\/881\/oj [Accessed 07-03-2026]"},{"key":"R21","unstructured":"European Parliament, Council of the European Union. Regulation (EU) 2016\/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (general data protection regulation). Off J Eur Union. 2016. URL: https:\/\/eur-lex.europa.eu\/eli\/reg\/2016\/679\/oj [Accessed 07-03-2026]"},{"key":"R22","doi-asserted-by":"publisher","DOI":"10.2196\/65528","article-title":"Consideration of cybersecurity risks in the benefit-risk analysis of medical devices: scoping review","volume":"26","author":"Freyer","journal-title":"J Med Internet Res"},{"key":"R23","doi-asserted-by":"publisher","DOI":"10.1016\/j.csi.2017.10.001","article-title":"Cybersecurity and medical devices: Are the ISO\/IEC 80001-2-2 technical controls up to the challenge?","volume":"56","author":"Anderson","journal-title":"Comput Stand Interfaces"},{"key":"R24","doi-asserted-by":"crossref","unstructured":"Granlund T Vedenpaa J Stirbu V Mikkonen T . On medical device cybersecurity compliance in EU. Presented at: 2021 IEEE\/ACM 3rd International Workshop on Software Engineering for Healthcare (SEH); Jun 3, 2021:20-23; Madrid, Spain. [doi: 10.1109\/SEH52539.2021.00011]","DOI":"10.1109\/SEH52539.2021.00011"},{"key":"R25","doi-asserted-by":"crossref","unstructured":"Androutsos C Taylor S Bernsmed K et al. MDCG 2019-16 guidelines: case study-based assessment and path forward. In: Pra\u00e7a I Bernardi S In\u00e1cio PRM , editors. Communications in Computer and Information Science. Springer; 2025:338-355. [doi: 10.1007\/978-3-031-94855-8_22]","DOI":"10.1007\/978-3-031-94855-8_22"},{"key":"R26","doi-asserted-by":"crossref","unstructured":"Taylor S Gilje Jaatun M Bernsmed K et al. A way forward for the MDCG 2019-16 medical device security guidance. Presented at: Proceedings of the 17th International Conference on Pervasive Technologies Related to Assistive Environments; Jun 26-28, 2024:593-599; Crete, Greece. URL: https:\/\/dl.acm.org\/doi\/proceedings\/10.1145\/3652037 [Accessed 01-07-2026] [doi: 10.1145\/3652037.3663894]","DOI":"10.1145\/3652037.3663894"},{"issue":"2","key":"R27","doi-asserted-by":"publisher","DOI":"10.1056\/AIra2400657","article-title":"Not all clinical AI monitoring systems are created equal: review and recommendations","volume":"2","author":"Feng","journal-title":"NEJM AI"},{"issue":"5","key":"R28","doi-asserted-by":"publisher","first-page":"15","DOI":"10.17691\/stm2022.14.5.02","article-title":"Methodology for conducting post-marketing surveillance of software as a medical device based on artificial intelligence technologies","volume":"14","author":"Zinchenko","journal-title":"Sovrem Tekhnologii Med"},{"issue":"3","key":"R29","doi-asserted-by":"publisher","first-page":"241","DOI":"10.1001\/jama.2024.21451","article-title":"FDA Perspective on the regulation of artificial intelligence in health care and biomedicine","volume":"333","author":"Warraich","journal-title":"JAMA"},{"issue":"6","key":"R30","doi-asserted-by":"publisher","first-page":"519","DOI":"10.3348\/kjr.2025.0257","article-title":"Overview of South Korean guidelines for approval of large language or multimodal models as medical devices: key features and areas for improvement","volume":"26","author":"Park","journal-title":"Korean J Radiol"},{"key":"R31","unstructured":"Guidelines for approval and review of generative AI medical devices [Webpage in Korean]. Ministry of Food and Drug Safety (MFDS). MFDS; Jan 24, 2025. URL: https:\/\/www.mfds.go.kr\/brd\/m_1060\/view.do?seq=15628 [Accessed 07-03-2026]"},{"issue":"3","key":"R32","doi-asserted-by":"publisher","DOI":"10.1148\/radiol.241703","article-title":"Challenges and proposed additional considerations for medical device approval of large language models beyond conventional AI","volume":"312","author":"Park","journal-title":"Radiology"},{"key":"R33","unstructured":"Medical Devices \u2014 Application of Risk Management to Medical Devices. 3rd ed. International Organization for Standardization; 2019. URL: https:\/\/www.kmedhealth.com\/wp-content\/uploads\/2024\/03\/EN-ISO-14971-2019-Application-of-risk-management.pdf [Accessed 01-07-2026]"},{"key":"R34","doi-asserted-by":"crossref","unstructured":"Michaels R . The functional method of comparative law. In: Reimann M Zimmermann R , editors. The Oxford Handbook of Comparative Law. Oxford University Press; 2006:339-382. [doi: 10.1093\/oxfordhb\/9780199296064.001.0001]","DOI":"10.1093\/oxfordhb\/9780199296064.013.0011"},{"key":"R35","unstructured":"Medical Devices \u2014 Quality Management Systems \u2014 Requirements for Regulatory Purposes. 3rd ed. International Organization for Standardization; 2016. URL: https:\/\/www.bonnier.net.cn\/download\/d_20170812100731.pdf [Accessed 01-07-2026]"},{"issue":"6","key":"R36","doi-asserted-by":"publisher","DOI":"10.1136\/bmjopen-2018-025374","article-title":"Cybersecurity features of digital medical devices: an analysis of FDA product summaries","volume":"9","author":"Stern","journal-title":"BMJ Open"},{"key":"R37","doi-asserted-by":"publisher","DOI":"10.2196\/67552","article-title":"Regulatory insights from 27 years of artificial intelligence\/machine learning-enabled medical device recalls in the United States: implications for future governance","volume":"13","author":"Chen","journal-title":"JMIR Med Inform"},{"key":"R38","unstructured":"Guideline for cybersecurity in medical devices premarket submissions. Ministry of Food and Drug Safety (MFDS) [Webpage in Korean]. MFDS; 2024. URL: https:\/\/www.mfds.go.kr\/brd\/m_1060\/view.do?seq=15625 [Accessed 07-03-2026]"},{"key":"R39","unstructured":"Cybersecurity in medical devices: quality system considerations and content of premarket submissions. US Food and Drug Administration. Silver Spring, MD: FDA; 2026. URL: https:\/\/www.fda.gov\/regulatory-information\/search-fda-guidance-documents\/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions [Accessed 07-03-2026]"},{"key":"R40","unstructured":"European Parliament, Council of the European Union. Regulation (EU) 2017\/745 on medical devices (medical device regulation). Official Journal of the European Union. 2017. URL: https:\/\/eur-lex.europa.eu\/eli\/reg\/2017\/745\/oj [Accessed 07-03-2026]"},{"key":"R41","unstructured":"European Parliament, Council of the European Union. Regulation (EU) 2017\/746 on in vitro diagnostic medical devices (in vitro diagnostic regulation). Official Journal of the European Union. 2017. URL: https:\/\/eur-lex.europa.eu\/eli\/reg\/2017\/746\/oj [Accessed 07-03-2026]"},{"key":"R42","unstructured":"MDCG 2019-16 rev1: guidance on cybersecurity for medical devices. Medical Device Coordination Group Document. European Commission; 2020. URL: https:\/\/health.ec.europa.eu\/system\/files\/2022-01\/md_cybersecurity_en.pdf [Accessed 07-03-2026]"},{"key":"R43","unstructured":"MDCG 2025-6: FAQ on the interplay between the medical devices regulation (MDR), the in vitro diagnostic medical devices regulation (IVDR), and the AI act. Medical Device Coordination Group. European Commission; 2025. URL: https:\/\/health.ec.europa.eu\/latest-updates\/mdcg-2025-6-faq-interplay-between-medical-devices-regulation-vitro-diagnostic-medical-devices-2025-06-19_en [Accessed 07-03-2026]"},{"key":"R44","unstructured":"Industrie-Gemeinschaft Niederbayern [Archived]. Questionnaire \u201ccybersecurity for medical devices\u2014audit. IGNB; 2023. URL: https:\/\/web.archive.org\/web\/20260520034800\/https:\/\/www.ig-nb.de\/fileadmin\/user_upload\/ig-nb\/Questionnaire_Cybersecurity_for_Medical_Devices_-_Audit_-_Version_1.pdf [Accessed 07-03-2026]"},{"issue":"6433","key":"R45","doi-asserted-by":"publisher","first-page":"1287","DOI":"10.1126\/science.aaw4399","article-title":"Adversarial attacks on medical machine learning","volume":"363","author":"Finlayson","journal-title":"Science"},{"key":"R46","unstructured":"Application of risk management for IT-networks incorporating medical devices \u2014 part 1: safety, effectiveness and security in the implementation and use of connected medical devices or connected health software. International Electrotechnical Commission; 2021. IEC 80001-1. URL: https:\/\/cdn.standards.iteh.ai\/samples\/23742\/d4db769296ac4179ba018ddbaf7c6b93\/IEC-80001-1-2021.pdf [Accessed 01-07-2026]"},{"key":"R47","unstructured":"US Code of Federal Regulations. Title 21, Chapter I, Subchapter H, Part 820 \u2014 Quality System Regulation, \u00a782030(g) Design Validation. US Government Publishing Office; URL: https:\/\/www.ecfr.gov\/current\/title-21\/chapter-I\/subchapter-H\/part-820 [Accessed 15-07-2026]"},{"key":"R48","unstructured":"ISO\/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection \u2014 Information Security Management Systems \u2014 Requirements. ISO\/IEC; 2022. URL: https:\/\/www.iso.org\/standard\/27001 [Accessed 15-07-2026]"},{"key":"R49","unstructured":"ISO\/IEC 42001:2023 Information Technology \u2014 Artificial Intelligence \u2014 Management System. ISO\/IEC; 2023. URL: https:\/\/www.iso.org\/standard\/42001 [Accessed 15-07-2026]"},{"key":"R50","unstructured":"Guidelines on Security against Electronic Intrusion for Digital Medical Devices | MFDS Notice no2025-30; Ministry of Food and Drug Safety (MFDS); Apr 29, 2025. URL: https:\/\/www.mfds.go.kr [Accessed 07-07-2026]"},{"issue":"2","key":"R51","doi-asserted-by":"publisher","first-page":"59","DOI":"10.5204\/lthj.3080","article-title":"The role of cybersecurity in medical devices regulation: future considerations and solutions","volume":"5","author":"Ludvigsen","journal-title":"Law Tech Hum"},{"key":"R52","unstructured":"BSI TR-03161: anforderungen an anwendungen im gesundheitswesen, version 20. Bundesamt f\u00fcr Sicherheit in der Informationstechnik. Bonn: BSI; 2022. URL: https:\/\/www.bsi.bund.de [Accessed 07-03-2026]"},{"issue":"5","key":"R53","doi-asserted-by":"publisher","first-page":"817","DOI":"10.1177\/1932296819865655","article-title":"The first recall of a diabetes device because of cybersecurity risks","volume":"13","author":"Klonoff","journal-title":"J Diabetes Sci Technol"},{"key":"R54","doi-asserted-by":"publisher","DOI":"10.3389\/fdgth.2026.1701551","article-title":"Cybersecurity breaches in medical devices: analyzing FDA safety communications in response to patient security concerns","volume":"8","author":"Menon","journal-title":"Front Digit Health"},{"key":"R55","unstructured":"European action plan on the cybersecurity of hospitals and healthcare providers communication from the commission. European Commission. Jan 15, 2025. URL: https:\/\/health.ec.europa.eu\/publications\/european-action-plan-cybersecurity-hospitals-and-healthcare-providers_en [Accessed 07-03-2026]"},{"key":"R56","unstructured":"US Food and Drug Administration. Marketing submission recommendations for a predetermined change control plan for artificial intelligence-enabled device software functions: guidance for industry and FDA staff. Silver Spring, MD: FDA; Dec 2024. URL: https:\/\/www.fda.gov\/media\/166704\/download [Accessed 01-07-2026]"},{"key":"R57","unstructured":"Mammography quality standards act (MQSA) and MQSA program. US Food and Drug Administration. URL: https:\/\/www.fda.gov\/radiation-emitting-products\/mammography-quality-standards-act-mqsa-and-mqsa-program [Accessed 07-03-2026]"},{"key":"R58","unstructured":"Risk Management \u2014 Guidelines. International Organization for Standardization; 2018. URL: https:\/\/lpm.uin-suka.ac.id\/media\/dokumen_akademik\/011_20191007_ISO%2031000.2018%20-%20Risk%20Management%20-%20Guidelines.pdf [Accessed 01-07-2026]"}],"container-title":["JMIR Medical Informatics"],"original-title":[],"language":"en","deposited":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T18:12:35Z","timestamp":1785435155000},"score":1,"resource":{"primary":{"URL":"https:\/\/medinform.jmir.org\/2026\/1\/e94846"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,30]]},"references-count":58,"URL":"https:\/\/doi.org\/10.2196\/94846","relation":{},"ISSN":["2291-9694"],"issn-type":[{"value":"2291-9694","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,30]]},"article-number":"v14i4e94846"}}