Dynamic Certifications for Dynamic Standards Leveraging ENTRUST’s Real-time Conformity Certificates to Strengthen Regulatory Compliance with the GDPR, MDR, CRA and NIS2

Adrian Quesada Rodriguez; André Cardozo Sarli; Renáta Radócz; Sébastien Ziegler; Augusto Díaz-Ordóñez González; Antonio Skarmeta Gómez; Jesús García Rodríguez; Gilson Javier Delgado Rodríguez

doi:10.59490/jos.2026.8348

Dynamic Certifications for Dynamic Standards Leveraging ENTRUST’s Real-time Conformity Certificates to Strengthen Regulatory Compliance with the GDPR, MDR, CRA and NIS2

Authors

Adrian Quesada Rodriguez Mandat International, Geneva, Switzerland; ETSIT, Universidad Politécnica de Madrid, Spain; André Cardozo Sarli UDG Alliance, Geneva, Switzerland; Renáta Radócz Mandat International, Geneva, Switzerland; Sébastien Ziegler Mandat International, Geneva, Switzerland; Augusto Díaz-Ordóñez González Mandat International, Geneva, Switzerland; Antonio Skarmeta Gómez Dept. Ingeniería de la Información y las Comunicaciones Facultad de Informática, University of Murcia, Spain; Jesús García Rodríguez Dept. Ingeniería de la Información y las Comunicaciones Facultad de Informática, University of Murcia, Spain; Gilson Javier Delgado Rodríguez Dept. Ingeniería de la Información y las Comunicaciones Facultad de Informática, University of Murcia, Spain;

DOI:

https://doi.org/10.59490/jos.2026.8348

Keywords:

medical devices, dynamic certification, conformity, regulatory compliance, ICT

Abstract

Recent developments in the European healthcare landscape and the rapidly evolving technologic ecosystem have led to the adoption of a new range of regulations that, amongst other key features, increasingly depend on standardization, and recognize the viability of certifications for demonstrating regulatory compliance. This paper examines shortcomings in existing guidelines and standardization approaches, while showcasing the results of both the ENTRUST project, as well as the Europrivacy and Interprivacy certification schemes, as potential ways forward to enable a streamlined approach to regulatory compliance with cybersecurity and privacy requirements through modular and ICT-supported third-party certification. It presents some perspectives regarding the potential of this approach in broader standardization activities and identifies key advantages of the proposed model for the various players in the healthcare sector.

References

Alslaity, A., Orji, R., Oyebode, O., Fowles, J., Steeves, D., & Suruliraj, B. (2022). Mobile Applications for Health and Wellness: A Systematic Review. Proceedings of the ACM on Human-Computer Interaction, 6(EICS), 1-29. https://doi.org/10.1145/3534525

Amaral, C., Paiva, M., Rodrigues, A. R., Veiga, F., & Bell, V. (2024). Global Regulatory Challenges for Medical Devices: Impact on Innovation and Market Access. Applied Sciences, 14(20), 9304. https://doi.org/10.3390/app14209304

Bakirtzis, G., Carr, S., Danks, D., & Topcu, U. (2023). Dynamic Certification for Autonomous Systems. Communications of the ACM, 66(9), 64–72. https://doi.org/10.1145/3574133

Beckers, R., Kwade, Z., & Zanca, F. (2021). The EU medical device regulation: Implications for artificial intelligence-based medical device software in medical physics. Physica Medica, 83, 1–8. https://doi.org/10.1016/j.ejmp.2021.02.011

Boardman, S. (2021). Creating wellness apps with high patient engagement to close the intention–action gap. International Psychogeriatrics, 33(6), 551–552. https://doi.org/10.1017/S1041610220003385

Commission Implementing Regulation (EU) 2024/482 of 31 January 2024 Laying down Rules for the Application of Regulation (EU) 2019/881 of the European Parliament and of the Council as Regards the Adoption of the European Common Criteria-Based Cybersecurity Certification Scheme (EUCC). (2025). http://data.europa.eu/eli/reg_impl/2024/482/2025-01-08/eng

DIGITALEUROPE. (2024, December 13). Strengthening healthcare cybersecurity: Focus on implementation, not new legislation. DIGITALEUROPE. Retrieved March 4, 2025, from https://www.digitaleurope.org/resources/strengthening-healthcare-cybersecurity-focus-on-implementation-not-new-legislation/

ENTRUST. (n.d.). Secure & Safe Connected Medical Devices. Retrieved March 5, 2025, from https://www.entrust-he.eu

European Medicines Agency (EMA). (2018, November 26). Medical devices [Text]. https://www.ema.europa.eu/en/human-regulatory/overview/medical-devices

European Commission. (n.d.). ENsuring Secure and Safe CMD Design with Zero TRUST Principles (ENTRUST). CORDIS. Retrieved March 5, 2025, from https://cordis.europa.eu/project/id/101095634

European Commission. (2020, January 7). Guidance on Cybersecurity for medical devices (MDCG 2019-16 Rev. 1). https://health.ec.europa.eu/system/files/2022-01/md_cybersecurity_en.pdf

European Commission. (2021, July 19). Commission implementing decision (EU) 2021/1182 of 16 July 2021 on the harmonised standards for medical devices drafted in support of Regulation (EU) 2017/745 of the European Parliament and of the Council. https://eur-lex.europa.eu/eli/dec_impl/2021/1182/oj

European Commission. (2024, July 26). Medical Devices—Dialogue between interested parties. https://health.ec.europa.eu/medical-devices-dialogue-between-interested-parties_en

European Union Agency for Cybersecurity. (n.d.). About EU Cybersecurity Certification. ENISA. Retrieved May 19, 2023, from https://certification.enisa.europa.eu/about-eu-cyber-certification_en

Europrivacy. (n.d.). Europrivacy Certification. Retrieved April 28, 2022, from https://europrivacy.com/en/frontpage

Freyer, O., Jahed, F., Ostermann, M., Rosenzweig, C., Werner, P., & Gilbert, S. (2024). Consideration of Cybersecurity Risks in the Benefit-Risk Analysis of Medical Devices: Scoping Review. Journal of Medical Internet Research, 26, e65528. https://doi.org/10.2196/65528

Granlund, T., Vedenpaa, J., Stirbu, V., & Mikkonen, T. (2021). On Medical Device Cybersecurity Compliance in EU. 2021 IEEE/ACM 3rd International Workshop on Software Engineering for Healthcare (SEH), 20–23. https://doi.org/10.1109/SEH52539.2021.00011

Han, Y., Ceross, A., & Bergmann, J. (2024). More than red tape: Exploring complexity in medical device regulatory affairs. Frontiers in Medicine, 11, 1415319. https://doi.org/10.3389/fmed.2024.1415319

Hemanth, D. J., Anitha, J., & Tsihrintzis, G. A. (Eds.). (2021). Internet of Medical Things: Remote Healthcare Systems and Applications. Springer International Publishing. https://doi.org/10.1007/978-3-030-63937-2

International Electrotechnical Commission. (2020a, July 27). IEC 60601-1-6:2010 Medical electrical equipment—Part 1-6: General requirements for basic safety and essential performance—Collateral standard: Usability. https://webstore.iec.ch/publication/67381

International Electrotechnical Commission. (2020b, June 17). IEC 62366-1:2015 Medical devices—Part 1: Application of usability engineering to medical devices. https://webstore.iec.ch/publication/67220

International Electrotechnical Commission. (2021, September 21). IEC 80001-1:2021 Application of risk management for IT-networks incorporating medical devices—Part 1: Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software. https://webstore.iec.ch/publication/34263

International Medical Device Regulators Forum. (2023, April 13). Medical Device Cybersecurity Guide. https://www.imdrf.org/working-groups/medical-device-cybersecurity-guide

International Organization for Standardization. (2004). Health informatics—Point-of-care medical device communication—Part 20101: Application profiles—Base standard (ISO/IEEE 11073-20101:2004). https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/03/63/36347.html

International Organization for Standardization. (2007). Health informatics — Use of mobile wireless communication and computing technology in healthcare facilities — Recommendations for electromagnetic compatibility (management of unintentional electromagnetic interference) with medical devices (ISO/TR 21730: 2007). https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/04/48/44865.html

International Organization for Standardization. (2009). Medical device software—Part 1: Guidance on the application of ISO 14971 to medical device software (IEC/TR 80002-1:2009). https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/05/41/54146.html

International Organization for Standardization. (2011a). Guidelines for auditing management systems (ISO 19011:2011). https://www.iso.org/standard/50675.html

International Organization for Standardization. (2011b). Information technology—Security techniques—Guidelines for information security management systems auditing (ISO/IEC 27007:2011). https://www.iso.org/standard/42506.html

International Organization for Standardization. (2012). Information technology — W3C Web Content Accessibility Guidelines (WCAG) 2.0 (ISO/IEC 40500:2012). https://www.iso.org/standard/58625.html

International Organization for Standardization. (2015). Conformity assessment—Requirements for bodies providing audit and certification of management systems—Part 1: Requirements (ISO/IEC 17021-1:2015). https://www.iso.org/standard/61651.html

International Organization for Standardization. (2016). Medical devices—Quality management systems—Requirements for regulatory purposes (ISO 13485:2016). https://www.iso.org/standard/59752.html

International Organization for Standardization. (2019a). Security techniques—Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management—Requirements and guidelines (ISO/IEC 27701:2019). https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/07/16/71670.html

International Organization for Standardization. (2019b). Medical devices—Application of risk management to medical devices (ISO 14971:2019). https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/07/27/72704.html

International Organization for Standardization. (2020a). Medical devices—Guidance on the application of ISO 14971 (ISO/TR 24971:2020). https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/07/44/74437.html

International Organization for Standardization. (2020b). Medical devices — Post-market surveillance for manufacturers (ISO/TR 20416:2020). https://www.iso.org/standard/67942.html

International Organization for Standardization. (2021). Health software—Part 2: Health and wellness apps—Quality and reliability (ISO/TS 82304-2:2021). https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/07/81/78182.html

International Organization for Standardization. (2022a). Trustworthiness—Vocabulary (ISO/IEC TS 5723:2022). https://www.iso.org/standard/81608.html

International Organization for Standardization. (2022b). Information security, cybersecurity and privacy protection—Information security management systems—Requirements (ISO/IEC 27001:2022). https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/08/28/82875.html

Interprivacy. (n.d.). The international data protection certification scheme. https://www.interprivacy.org/

Lie, M. F., Sánchez-Gordón, M., & Colomo-Palacios, R. (2020). DevOps in an ISO 13485 Regulated Environment: A Multivocal Literature Review. Proceedings of the 14th ACM / IEEE International Symposium on Empirical Software Engineering and Measurement (ESEM), 1–11. https://doi.org/10.1145/3382494.3410679

Marinovic, I., Skrzypacz, A., & Varas, F. (2018). Dynamic certification and reputation for quality. American Economic Journal: Microeconomics, 10(2), 58–82. https://doi.org/10.1257/mic.20160282

Marotta, A., & Madnick, S. (2021). Convergence and divergence of regulatory compliance and cybersecurity. Issues in Information Systems, 22(1), 10–50. https://doi.org/10.48009/1_iis_2021_10-50

Matheu, S. N., Hernández-Ramos, J. L., Pérez, S., & Skarmeta, A. F. (2019). Extending MUD Profiles Through an Automated IoT Security Testing Methodology. IEEE Access, 7, 149444–149463. IEEE Access. https://doi.org/10.1109/ACCESS.2019.2947157

MedEnvoy Global. (2025, November 18). How much does it cost to sell medical devices in Europe? https://medenvoyglobal.com/blog/how-much-does-it-cost-to-sell-medical-devices-in-europe/

MedTech Europe. (2023, May). MedTech Europe’s vision for cybersecurity in the medical technology ecosystem—Position paper. https://www.medtecheurope.org/resource-library/medtech-europes-vision-for-a-resilient-medical-technology-ecosystem-position-paper/

Quigley, W. C., Rahouti, M., & Weiss, G. M. (2025). A Secure Blockchain-Assisted Framework for Real-Time Maritime Environmental Compliance Monitoring (Version 1). arXiv. https://doi.org/10.48550/ARXIV.2503.08707

Regulation (Eu) 2017/745 Of The European Parliament And Of The Council of 5 April 2017 on Medical Devices, Amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and Repealing Council Directives 90/385/EEC and 93/42/EEC, 117/1 OJ L (2021). https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0745

Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on Medical Devices, Amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and Repealing Council Directives 90/385/EEC and 93/42/EEC (Text with EEA Relevance. ), 117 OJ L (2017). http://data.europa.eu/eli/reg/2017/745/oj/eng

Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity) and on Information and Communications Technology Cybersecurity Certification and Repealing Regulation (EU) No 526/2013 (Cybersecurity Act) (2019). https://eur-lex.europa.eu/eli/reg/2019/881/oj

Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on Horizontal Cybersecurity Requirements for Products with Digital Elements and Amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) (Text with EEA Relevance) (2024). http://data.europa.eu/eli/reg/2024/2847/oj/eng

Ruohonen, J., Hjerppe, K., & Kang, E.-Y. (2025). A mapping analysis of requirements between the CRA and the GDPR. arXiv. https://doi.org/10.48550/arXiv.2503.01816

Schwartz, S., Ross, A., Carmody, S., Chase, P., Coley, S. C., Connolly, J., Petrozzino, C., & Zuk, M. (2018). The Evolving State of Medical Device Cybersecurity. Biomedical Instrumentation & Technology, 52(2), 103–111. https://doi.org/10.2345/0899-8205-52.2.103

Tartaro, A. (2024). Value-laden challenges for technical standards supporting regulation in the field of AI. Ethics and Information Technology, 26(4). https://doi.org/10.1007/s10676-024-09809-y

Taylor, S., Gilje Jaatun, M., Bernsmed, K., Androutsos, C., Frey, D., Favrin, S., Rodrigues, J., Milojević, D., Karras, D., Siachos, I., Epiphaniou, G., Moukafih, N., Messinis, S., Rallis, I., Protonotarios, N., Gedeon, P., Castillo, A., Maple, C., Matragkas, N., … Katzis, K. (2024). A Way Forward for the MDCG 2019-16 Medical Device Security Guidance. Proceedings of the 17th International Conference on PErvasive Technologies Related to Assistive Environments, 593–599. https://doi.org/10.1145/3652037.3663894

World Health Organization (WHO). (n.d). Quality of care. Retrieved March 5, 2025, from https://www.who.int/health-topics/quality-of-care

Ziegler, S., Huamani, A. M. P., Miteva, S.-M., Quesada Rodriguez, A., & Radocz, R. (2022). Europrivacy Paradigm Shift in Certification Models for Privacy and Data Protection Compliance. In S. Schiffner, S. Ziegler, & A. Quesada Rodriguez (Eds.), Privacy Symposium 2022 (pp. 73–84). Springer International Publishing. https://doi.org/10.1007/978-3-031-09901-4_5

Ziegler, S., Radócz, R., Quesada Rodriguez, A., & Matheu Garcia, S. N. (Eds.). (2024). Springer Handbook of Internet of Things. Springer International Publishing. https://doi.org/10.1007/978-3-031-39650-2

Dynamic Certifications for Dynamic Standards Leveraging ENTRUST’s Real-time Conformity Certificates to Strengthen Regulatory Compliance with the GDPR, MDR, CRA and NIS2

Authors

DOI:

Keywords:

Abstract

References

Downloads

Published

How to Cite

Issue

Section

Categories

License