MHRA

United Kingdom - MHRA

GuidanceLast updated · 2026 (Draft Medical Devices (Amendment) Regulations 2026 published; MHRA stakeholder impact survey underway alongside the Feb 2026 CE-recognition consultation)Verified · 2026-10-17

UK MDR 2002 (as amended) + MHRA Cyber Guidance

Authority

Medicines and Healthcare products Regulatory Agency

Enforced

Reform program 2024–26

Legal framework

UK MDR 2002 + DTAC + NHS DSPT

FDA package reuse

~80%

Editorial estimate · how →

Scope

Devices marketed in Great Britain (Northern Ireland follows EU MDR via the Windsor Framework). Software as a Medical Device addressed by separate MHRA Change Programme.

Pre-market

Risk-based, leverages BS EN 81001-5-1 and FDA-aligned evidence. UKCA marking with grace period for CE-marked devices.

Post-market

MORE vigilance reporting + DTAC for NHS deployment + DSPT for connected services.

SBOM

Recommended

Not mandated; encouraged via NCSC guidance and aligns with FDA expectations for dual-market devices.

Vulnerability disclosure

Encouraged via the NCSC Vulnerability Disclosure Toolkit.

Penalty

Market removal, criminal liability under Consumer Protection Act.

Unique requirements

01DTAC clinical safety, data protection, technical assurance for NHS
02DSPT compliance for hosted services
03International recognition route for FDA/Health Canada/TGA approvals (Draft 2026 Regulations codify the pathway; MHRA impact survey open)

Highlights

Pragmatic FDA/EU dual-recognition
DTAC required for NHS deployment
Future divergence from EU MDR

Aligns with

IMDRF N60 BS EN 81001-5-1 NCSC CAF

Timeline

Jan 2021
Brexit transition ends, UKCA introduced
Sep 2021
MHRA SaMD Change Programme launched
2024
International Recognition route consultation
Feb 16 2026
MHRA consultation on indefinite recognition of CE-marked devices launched (closed; analysis underway)
2026
Draft Medical Devices (Amendment) Regulations 2026 published for consultation; MHRA impact survey open

Key documents

MHRA Software & AI as a Medical Device Change Programme

https://www.gov.uk/government/publications/software-and-ai-as-a-medical-device-change-programme

NHS Digital Technology Assessment Criteria (DTAC)

https://transform.england.nhs.uk/key-tools-and-info/digital-technology-assessment-criteria-dtac/

NCSC Vulnerability Disclosure Toolkit

https://www.ncsc.gov.uk/information/vulnerability-disclosure-toolkit

How to submit in United Kingdom

Playbook reviewed · 2026-07-16

Submission route

UKCA marking (or CE recognition through 30 June 2030) with an Approved Body, plus MHRA registration

The UK continues to recognise CE-marked devices through 30 June 2030 while the post-Brexit framework catches up. MHRA's cybersecurity expectations mirror MDCG 2019-16 for now, with additional guidance on connected/AI devices published under the Software and AI as a Medical Device programme.

Authority portal

Step-by-step

Step 01
Decide CE recognition vs UKCA
CE recognition is the low-friction path until 30 June 2030; UKCA is required afterwards and for Northern Ireland-only products.
Step 02
Engage an Approved Body (UKCA path)
AB capacity in the UK is limited; book 6-12 months ahead for Class IIa+ devices.
Step 03
Package cybersecurity evidence
MHRA accepts MDCG 2019-16-style documentation as-is; add UK-specific labeling for the UKRP.
Step 04
Register with MHRA
All devices placed on the GB market must be registered by the UKRP within grace-period deadlines.

Evidence checklist

Item	Level	FDA equivalent	Notes
MDCG 2019-16-style cyber documentation	Required	SPDF
UKRP appointment (non-UK manufacturers)	Required	—
IEC 81001-5-1 evidence	Recommended	—
PSTI-aligned vulnerability disclosure policy	Recommended	—	Not legally required for medical devices but expected best practice.

Common MHRA rejections

UKRP details missing from labeling

Common

Fix · Add UKRP name and address to device labeling and IFU before AB audit.

Reliance on CE certificate near 2030 sunset

Occasional

Fix · Start UKCA transition planning 18-24 months before June 2030 to avoid AB bottleneck.

Typical timeline

End-to-end window: 0-4 weeks (CE recognition) or 10-16 months (UKCA).

Phase 01

CE recognition path

0-4 weeks

MHRA registration only, if you already hold a valid CE certificate.

Phase 02

UKCA path (Class IIa+)

10-16 months

Includes AB queue + review.

MHRA head-to-head

Compare

MHRAvsFDA 524B

Open comparison

Compare

MHRAvsEU MDR

Open comparison

Related markets

Taiwan

~80% FDA reuse

South Africa

~80% FDA reuse

Malaysia

~80% FDA reuse

Philippines

~80% FDA reuse

Frequently asked about United Kingdom

Is SBOM required for medical devices in United Kingdom?

Recommended. Not mandated; encouraged via NCSC guidance and aligns with FDA expectations for dual-market devices.

What does MHRA require for pre-market cybersecurity?

Risk-based, leverages BS EN 81001-5-1 and FDA-aligned evidence. UKCA marking with grace period for CE-marked devices.

What are the post-market cybersecurity obligations under MHRA?

MORE vigilance reporting + DTAC for NHS deployment + DSPT for connected services.

What is the penalty for non-compliance with MHRA cybersecurity rules?

Market removal, criminal liability under Consumer Protection Act.

How much of my FDA cybersecurity package is reusable in United Kingdom?

Roughly 80% - an editorial estimate based on overlapping evidence requirements (threat model, SBOM, security risk assessment, pen-test report).