Three cyber deadlines hit the same teams, and the first one has already passed

Anyone tracking cybersecurity obligations for connected products and pharmaceutical sites usually has two dates in the calendar, both in September 2026. They are indeed one day apart, and the first does not apply to medical devices under the MDR or IVDR (Article 2(2) of the Cyber Resilience Act). The real finding is a third date, and it does not lie in the future.

September 11 and 12, 2026

The Cyber Resilience Act, Regulation (EU) 2024/2847, has been in force since December 10, 2024, and bites in stages. The reporting obligations apply from September 11, 2026, the main obligations only from December 11, 2027. Between them lies a year and three months in which you must report what need not yet be fully in place. Conformity assessment bodies have been notifiable since June 11, 2026. The Commission published practical implementation guidance on July 27, 2026.

One day after the CRA date, the Data Act, Regulation (EU) 2023/2854, takes hold. Its Article 50(3) is unusually precise, and the wording decides who is caught: the obligation under Article 3(1) applies to connected products and related services placed on the market after September 12, 2026.

That is not a transition period for the installed base. It is a cut-off tied to placing on the market. A product on the market on September 12, 2026, does not carry the Article 3(1) design obligation. The same product, in a variant placed on the market from September 13, does. For development programs launching in autumn 2026 this is not a footnote but a switch.

One qualification belongs here, and we write it down rather than leave it out: that connected medical devices and health wearables fall within the scope of the Data Act is the consistent reading of several law firms, not a finding we verified against the legal text. Anyone basing an investment decision on it should have the classification of their own product examined legally rather than taken from an article, including this one. The Cyber Resilience Act is different: its Article 2(2) expressly excludes products with digital elements to which the MDR or the IVDR applies.

The third deadline is the oldest, and it is not an announcement

NIS-2, Directive (EU) 2022/2555, had a transposition deadline of October 17, 2024. Germany missed it, along with many others: in November 2024 the Commission opened infringement proceedings against 23 member states, and on May 7, 2025, it sent a reasoned opinion to 19, Germany among them.

That is settled. The Bundestag adopted the NIS2UmsuCG on November 13, 2025, the Bundesrat on November 21, 2025, it was promulgated in Federal Law Gazette 2025 I No 301 of 5 December 2025, and it has applied since December 6, 2025. Implementation runs mainly through the recast BSI Act. The BSI now supervises around 29,500 entities.

From this follows a deadline that has quietly passed in many organizations. Registration with the BSI is due under Section 33 BSIG within three months of an entity first being in scope. For everyone in scope on December 6, 2025, that deadline expired by calculation in early March 2026. This cut-off is our arithmetic from two officially documented figures, the entry into force and the three-month period, and not a date any authority has published as such. The two figures it follows from are documented.

Two annexes, two routes into scope

Being in scope is decided in two steps: first the type of entity under Annex 1 or Annex 2 BSIG, then the size threshold under Section 28.

Annex 1, health sector, covers among others healthcare providers, EU reference laboratories, research and development of medicinal products, the manufacture of pharmaceutical products and the manufacture of critical medical devices.

Annex 2 assigns the manufacture of medical devices and in vitro diagnostics to manufacturing industry.

This is where the most common mistake happens. A device manufacturer looks in the health sector, does not find itself there because it sits in Annex 2, and concludes it is out of scope. Conversely, the same manufacturer may land in Annex 1 after all through the manufacture of critical medical devices. Which products count as critical additionally depends on the thresholds of the BSI-KritisV, and we have not checked those for individual product categories.

For the size threshold we give the figures that appear in the legal text (Section 28 BSIG, read on October 23, 2026). An important entity under Section 28(2) no. 3 BSIG is one with at least 50 employees, or with annual turnover and annual balance sheet total each above €10M. An essential entity under Section 28(1) no. 4 BSIG is an Annex 1 entity with at least 250 employees, or with annual turnover above €50M and an annual balance sheet total above €43M. These thresholds apply only to Annex 1 entities; manufacturers listed in Annex 2, such as of medical devices and in vitro diagnostics, can only be important entities, unless they are covered via Annex 1.

The BSI provides a scope self-assessment. It does not replace a legal review, but within half an hour it answers whether one is needed at all.

Three obligations, and a clock that runs faster than expected

Entities in scope carry three central obligations: registration with the BSI, reporting of significant security incidents, and implementation and documentation of risk management measures.

The reporting chain is the part most often underestimated, because it runs in three stages and the first is very short: 24 hours for the early warning, 72 hours for the incident notification, 30 days for the final or progress report, each from becoming aware. A 24 hour early warning is not a task for an escalation chain that is assembled after something has happened. For operators of critical installations the evidence cycle at least extends from two years to three.

Why the three belong together rather than in sequence

It is tempting to give the three regimes three owners: the CRA to product development, NIS-2 to IT, the Data Act to legal. That is precisely where such programs fail.

The CRA catches the product, NIS-2 the organization, the Data Act the moment of placing on the market. For a connected product that is not a medical device, that is one thing seen from three sides; for a medical device under the MDR or IVDR, the CRA does not apply under its Article 2(2). Vulnerability reporting under the CRA and incident reporting under the BSIG run through the same people, often through the same phone number. Build two separate reporting processes and you have two clocks and one crew when it matters.

What to do now

Four steps, in this order:

1. Answer the registration question in writing, this week. Not whether you are in scope, but whether you are registered. If the answer is no and you are in scope, the Section 33 BSIG deadline has already passed, and that belongs documented and remedied, not deferred.
2. Look for your entity in Annex 1 and Annex 2, in both. Checking only the health sector misses the manufacturing assignment, and the reverse.
3. Design the reporting chain for 24 hours, not 72. With named people, an on-call rota and a form somebody has filled in once already.
4. Hold every development program launching from autumn 2026 against September 12, 2026. A date that is already in the plan decides a design obligation here.

The order is not a matter of style. Step 1 concerns a deadline that is probably already running, step 4 one that can be planned. Start at the other end and you work the visible date while the invisible one sits untouched.

Image notice: The images in this article were generated using artificial intelligence. They do not depict real people, places, or events.