Connected Medical Devices
Connected Medical Device Compliance
Market access for medical devices with wireless connectivity, apps, and cloud services: health authority registration, radio type approval, cybersecurity, and data requirements handled as one program in every market.
The category
A connected medical device answers to the health authority, the communications regulator, and increasingly the cybersecurity regulator, in every market at once.
The convergence
Medical regulation didn't absorb radio and cyber rules. It sits alongside them.
Connected medical devices, from wireless patient monitors and insulin pumps with smartphone apps to imaging equipment with cloud analytics and hospital systems on Wi-Fi, are regulated by three separate authorities in most markets. The health authority governs the device: classification, registration, safety, performance, software, and post-market surveillance. The communications regulator governs the radio: type approval for every transmitter, under rules that don't distinguish medical from any other use. And a growing set of cybersecurity requirements, from medical device cyber guidance to horizontal rules like the EU Cyber Resilience Act and Radio Equipment Directive security provisions, govern the device's behavior on the network.
The three don't coordinate. A device can be fully registered with the health authority and still be illegal to import because its Bluetooth module lacks national type approval. A radio-approved device can fail a health authority review on software lifecycle documentation. A cyber requirement can arrive after both approvals are in hand and apply to the installed base. Manufacturers who treat connectivity as a feature rather than a regulatory dimension discover this at customs or in a field action.
ORBIS Compliance scopes connected medical devices as one program across all three: sanitary registration with the health authority, radio type approval with the communications regulator, and cybersecurity evidence against the requirements each market applies, with one product record holding all of it.
Regulatory dimensions
What a connected medical device is regulated for
Medical device regulation
Classification, registration, IEC 60601 and IEC 62304 software lifecycle, usability, clinical evidence, and post-market obligations with the health authority.
Radio type approval
National approval for Wi-Fi, Bluetooth, cellular, and proprietary medical-band radios, including modular approval review and RF exposure for body-worn devices.
Cybersecurity
Medical device cybersecurity guidance from health authorities, plus horizontal connected-product security law arriving in the EU, UK, US, and elsewhere.
Software and apps
Companion apps and cloud functions that may themselves be regulated as software as a medical device, with their own classification and registration questions.
Data and privacy
Health data protection rules that shape where data is processed and stored, and that health authorities increasingly ask about during registration.
Electrical, battery, and environmental
The standard electronics set: electrical safety, battery certification, substance compliance, and producer registration in every market.
The radio problem in medical programs
The most common gap in connected device launches is the one nobody owns.
Medical device regulatory teams are experts in the health authority process. Radio approval belongs to a different regulator with a different process, and it often isn't anyone's job. The device uses a pre-certified module, the team assumes that covers it, and in several markets it doesn't: modular approval rules differ, some countries require host-level testing or filing regardless, and some require the radio certificate to be held locally. The device is registered, manufactured, shipped, and stopped at customs for a missing radio approval.
The reverse happens too. Radio and electrical teams treat the medical registration as someone else's problem, and a device change that's trivial for the radio grant turns out to be a significant change for the health authority.
ORBIS assigns the whole device to one accountable team. Our regulatory professionals handle the health authority, our engineers handle the radio and electrical file, and ORBIS Intelligent Compliance keeps every approval and its change triggers in one record, so a firmware update is assessed against the radio grant, the medical registration, and the cyber file at the same time.
Cybersecurity
Security is now a market access condition for connected devices.
Health authorities have issued cybersecurity guidance for medical devices for years, and several now treat it as a registration requirement. Horizontal rules add another layer: the EU Radio Equipment Directive's security provisions for connected radio equipment, the Cyber Resilience Act for products with digital elements, the UK's connectable product security regime, and evolving US requirements. Manufacturers need documented secure development, vulnerability handling, update mechanisms, and in some cases third-party assessment.
The requirements are new and still settling, and their application to specific medical devices is often unclear. ORBIS tracks them through law impact analysis, scopes the evidence alongside the medical and radio files, and engages regulators where the application to your device needs confirming.
Questions
Connected medical device compliance
Our device uses a Bluetooth module that's FCC and CE certified. Do we still need radio approvals?
+
In many markets, yes. Some accept the module certification for the host with limited conditions. Others require host-level testing or a national filing regardless, and some require local testing or a local certificate holder. The rules depend on how the module is integrated and on each market's modular approval policy. ORBIS reviews it per market.
Is our companion app a medical device?
+
It depends on what it does and where. An app that displays data may not be regulated; one that calculates a dose or generates an alarm probably is. Classification of software as a medical device differs between jurisdictions. We confirm the position for your app in each target market.
How do we handle the same firmware update across medical, radio, and cyber approvals?
+
By assessing it against all three before release. A change can be insignificant for one regulator and significant for another. ORBIS Intelligent Compliance holds all the approvals for the device, and our team evaluates each update against each of them and files what's required.
Three regulators, one device, one plan.
Bring the device, its radios, its software architecture, and the markets. We'll scope the medical, radio, and cybersecurity approvals together so none of them is discovered late.
Book a Discussion