The role of software in society has changed drastically since the start of the twenty-first century. Software can now partially or fully facilitate diagnosis and treatment of a disease, regardless of whether it is psychological or pathological. Consequently, software plays a role comparable to medical equipment with a physical footprint. Understanding when software as a medical device must comply with applicable rules is vital for both manufacturers and regulators. We therefore examine the Medical Device Regulation to expand on the notion of intention, as this is the key basis for the classification of medical devices. Finally, we develop objective criteria that software must fulfil to be considered a medical device under European Union law.

No abstract

No abstract

Being connected to a network exposes surgical robots to cyberattacks, which can damage the patient or the operator. These injuries are normally caused by safety failures, such as accidents with industrial robots, but cyberattacks are caused by security failures instead. Surgical robots are increasingly sold and used in the European Union, so we decide to uncover whether this change has been considered by EU law, and which legal remedies and actions a patient or manufacturer would have in a single national legal system in the union. We first conduct a case study, where we analyse which legal remedies a patient can make use of, if they are injured by a surgical robot caused by a cyberattack in the national legal system. We also explore whether cybersecurity and cyberattacks are considered by the upcoming Medical Device Regulation of the EU. We show that the selected national legal system is adequate. This is because of its flexibility and in a certain approach even to ignore the distinction between safety and security to the benefit of the patient, and in one situation to remove liability from the manufacturer by erasing its status as party. Otherwise, unless the operator or other parties have made the cyberattack more likely to occur, the manufacturer is liable. We find that the regulation does not directly consider security defects, requiring interpretation and use of guidance to show it. Due to the risk cyberattacks pose on medical equipment, we find this to not be adequate. We further find that the regulators of medical devices, including surgical robots, will not necessarily have adequate staff or rules of enforcement, as this has been left to the member states to solve. But, we also find, due to the comprehensive number of rules that can be applied cumulatively, together with the possibility for further rules and compliance later on, that these issues could be solved in the future.

Safety is becoming cybersecurity under most circumstances. This should be reflected in the Cybersecurity Resilience Act whenever it is proposed and agreed upon in the European Union. In this paper, we define a range of principles which this future Act should build upon, a structure and argue why it should be as all encompassing as possible. We do this on the basis of what the cybersecurity research community for long have asked for, and on what constitutes clear hard legal rules instead of soft. Important areas such as cybersecurity should be taken seriously, by regulating it in the same way we see other types of critical infrastructure and physical structures, and be uncompromising and logical, to encompass the risks and potential for chaos which its ubiquitous nature entails.We find that principles which regulate cybersecurity systems' life-cycles in detail are needed, as is clearly stating what technology is being used, due to Kirkhoffs principle, and dismissing the idea of technosolutionism. Furthermore, carefully analysing risks is always necessary, but so is understanding when and how the systems manufacturers may fail or almost fail, all of these details must be expected and detailed. We do this through the following principles:Ex ante and Ex post assessment, Safety and Security by Design, Denial of Obscurity, Dismissal of Infallibility, Systems Acknowledgement, Full Transparency, Movement towards a Zero-trust Security Model, Cybersecurity Resilience, Enforced Circular Risk Management, Dependability, Hazard Analysis and mitigation or limitation, liability, A Clear Reporting Regime, Enforcement of Certification and Standards, Mandated Verification of Security and Continuous Servicing.To this, we suggest that the Act employs similar authorities and mechanisms as the GDPR, and create strong national authorities to coordinate inspection and enforcement in each Member State, with ENISA being the top and coordinating organ. 1