KR | EN | JP | CN

Specialized Sectors

Advanced regulatory compliance solutions for extreme environments and cybersecurity.

Medical Device MDR Consulting & Cybersecurity (EU MDR & FDA)

Product-specific consulting for medical device regulation and cybersecurity

Overview

We provide consulting for product-specific regulatory strategy, technical documentation, clinical evaluation and post-market activities under the EU Medical Device Regulation, Regulation (EU) 2017/745 (MDR).

EU MDR legislation

We support medical-device cybersecurity risk management throughout development and premarket and postmarket activities. Applicability of FD&C Act section 524B to cyber devices, FDA recommendations and relevant EU MDR requirements is reviewed for each product.

Core Services

  • FDA Premarket Submission Expert preparation of cybersecurity-related technical documentation (PMA/510k) and security risk management.
  • EU MDR Strategy & Technical Documentation Support device classification and conformity assessment route reviews, GSPR compliance, Annex II/III technical documentation and risk management documentation.
  • Clinical Evaluation (CER) & PMS/PMCF Review clinical evaluation plans and reports (CER), post-market surveillance (PMS), and post-market clinical follow-up (PMCF) plans and evidence according to product-specific requirements, and support audit preparation.
  • SBOM (Software Bill of Materials) Establishment of software component management systems and comprehensive vulnerability analysis.
  • IEC 81001-5-1 Support for establishing security lifecycle processes for medical device software.

Machinery Cybersecurity (EU MR)

Addressing machinery safety and cybersecurity under the EU Machinery Regulation

Overview

The main requirements of Regulation (EU) 2023/1230 (EU MR) apply from 20 January 2027. Annex III section 1.1.9 addresses protection of safety-critical hardware, software and data against accidental or intentional corruption. Section 1.2.1 addresses control-system safety and reliability under external influences, including reasonably foreseeable malicious attempts.

We review how connectivity, remote access and software changes can affect safety functions, and support risk assessment, protective measures and verification evidence. Concurrent CRA applicability and conformity assessment procedures are reviewed for each product.

EU MR legislation ยท European Commission guidance

Key Services

  • EU MR Requirements and Cyber Risk Assessment Review the machinery and control-system scope and analyse safety-related cyber threats and requirement gaps across network connections, remote access and update paths.
  • Protection of Safety-Related Software and Data Review access permissions, software identification and version control, intervention and change records, and update integrity as measures against corruption.
  • Control-System Verification and CE Technical Documentation Review hazardous scenarios involving malicious access or communication failures, and support linking protective-measure verification plans, results and risk assessments to CE technical documentation.

Explosion-Proof Quality Systems (ISO/IEC 80079-34)

Systematic manufacturing quality for explosion-protected products

Overview

For ATEX, manufacturer quality-assessment requirements depend on the product category and chosen conformity assessment procedure. For IECEx, we support the ExTR and QAR requirements of the applicable certification scheme. Services include ISO/IEC 80079-34 quality-system preparation and applicable QAN/QAR audit support.

Core Services

  • ISO/IEC 80079-34 Consulting Development of specialized quality manuals and procedure documents for Ex product manufacturing.
  • QAN/QAR Audit Preparation Pre-audit rehearsals and gap closures for factory audits conducted by European and international Ex certification bodies.
  • Traceability & Supply Chain Management Establishment of supply chain systems to maintain technical consistency of Ex-critical components.

Advanced Cybersecurity Regulations (EU CRA & RED)

"Navigating rapidly changing digital regulations: turning business risks into opportunities."

Overview

CRA vulnerability and incident reporting obligations apply from 11 September 2026; its main product obligations apply from 11 December 2027. The RED cybersecurity delegated regulation has applied to specified radio equipment since August 2025 and will be repealed from 11 December 2027 in coordination with the CRA. Product scope and exclusions are reviewed individually.

Core Services

  • EU CRA (Cyber Resilience Act) Diagnostics of mandatory security requirements and conformity assessment support for CE marking.
  • RED (Radio Equipment Directive) Security Compliance strategies for network protection and privacy requirements for wireless communication devices.
  • Vulnerability Management Support for establishing vulnerability reporting structures and secure update distribution processes.

How we work

  1. Confirm product or organization and target markets
  2. Review applicable requirements and current status
  3. Support documentation, procedures and risk management
  4. Support test or audit preparation and follow-up actions

Deliverables agreed for your scope

We agree the appropriate deliverables, such as a requirements matrix, gap analysis, risk assessment, quality procedures or technical documentation.

Prepare product specifications and operating conditions, target markets, and existing certification, test and quality documentation.