Finalisation of GL-10 R1 Best Practices Guide on Medical Device Cybersecurity
HSA's Medical Devices Cluster (MDC) has published the finalised GL-10 R1 following consideration of feedback and recommendations received during the public consultation. The consultation commenced on 10 March 2025 and closed on 13 May 2025, with HSA receiving 123 responses from 16 stakeholders.
The guide provides medical device manufacturers and healthcare providers with best practice recommendations and considerations on general cybersecurity principles to help ensure that medical devices remain secure throughout the TPLC.
Key cybersecurity considerations
GL-10 R1 addresses cybersecurity considerations across the medical device life cycle, including shared responsibilities, transparency and communication, secure-by-design principles, cybersecurity risk management, security assessment and testing, user information and post-market planning. The guide also addresses Software Bill of Materials (SBOM), additional considerations for devices incorporating Artificial Intelligence, post-market support, limited support and end-of-support considerations.
Scope of the guide
GL-10 R1 is intended to provide cybersecurity best practices for connected General medical devices and in vitro diagnostic medical devices. Relevant stakeholders include medical device manufacturers, product registrants, importers, local authorised representatives and healthcare providers.
HSA clarifies that GL-10 R1 provides best practice recommendations and does not constitute regulatory guidance or establish regulatory requirements or expectations for pre-market submission or registration.
Public consultation feedback
HSA published a summary of responses alongside the finalised guide. Feedback received during the consultation included editorial, technical and other recommendations, which HSA considered in finalising the document and improving its clarity.
Implications and Significance
The publication of GL-10 R1 provides stakeholders with a structured reference for addressing cybersecurity risks throughout the medical device life cycle. Although the guide does not introduce mandatory registration requirements, manufacturers and other relevant stakeholders should consider its recommendations when developing and maintaining cybersecurity practices for connected medical devices. The guidance also reflects increasing regulatory attention to cybersecurity throughout the TPLC, including post-market support and management of evolving cybersecurity risks.
Qualtech brings 26+ years of experience as a trusted partner to medical device manufacturers. We've successfully guided clients through countless dynamic regulatory and authority platform shifts across diverse international landscapes.
Whether you're a local startup or an international player, we empower your devices to enhance lives.
Contact us to unlock your medical device potential.