This collection examines cybersecurity obligations affecting technology products, medical devices and life-sciences operations. Topics include the Cyber Resilience Act (CRA), national approaches to NIS2, incident reporting under the Swiss ISG and the relationship between device security and AI regulation.
These articles provide general information and are not legal advice.
The EU Cyber Resilience Act makes cybersecurity a condition of market access: products with digital elements must carry the CE marking and stay supported with security updates, and the vulnerability reporting duty starts 11 September 2026.
Austria's cybersecurity act, the NISG 2026, transposes NIS2 late and applies from 1 October 2026. In-scope entities, pharmaceutical R&D included, must register with a new federal authority within three months, file a self-declaration within a year and prove implementation on request.
Denmark, Finland and Sweden enforce NIS2 on different dates through different authorities, while Norway and Iceland have yet to implement it. A US pharma group with R&D across the region faces a different authority in each country.
NIS2 does not bind Swiss device makers directly, but EU hospitals it covers must address supplier security risks, in practice through procurement contracts. Swiss suppliers may need to comply as if NIS2 bound them, and Swiss law may add its own reporting duty.
Since 1 April 2025 the Swiss information security act (ISG) requires operators of critical infrastructure to report cyberattacks to the federal cybersecurity office (BACS) within 24 hours of discovery, and its statutory catalog captures US subsidiaries by Swiss license rather than sector label.
The MDR requires security to be built into software as a medical device (SaMD) and maintained for its life, and notified bodies treat the international standard IEC 81001-5-1 as the state of the art. A security patch can itself need notified-body review, and one incident can start five reporting clocks.
An AI-enabled device sold from Switzerland into the EU answers to two cybersecurity regimes that measure different things: the MDR secures the device in its IT environment, the AI Act the model against manipulation. Switzerland adds a 24-hour reporting clock.
ENISA, the European Union Agency for Cybersecurity, receives early warnings under the Cyber Resilience Act. In-scope manufacturers face a 24-hour clock. Other EU and Swiss reporting duties remain separate.
For advice on a particular matter, please get in touch.
Make an enquiry