Cybersecurity of medical devices: new challenges arising from the AI Act and NIS 2 Directive proposals

Abstract

Cyberattacks on the IT infrastructure of hospitals, electronic health records or medical devices that have taken place during the COVID-19 pandemic reaffirmed how crucial it is to ensure cybersecurity in the healthcare sector. Medical devices are regulated in the European Union (EU) through vertical product-specific legislation, such as the Medical Device Regulation (MDR), among others. The MDR foresees safety requirements implying cybersecurity obligations for medical device manufacturers. In 2021, the EU legislator put forward the Network and Information Security System Directive reform (NIS 2) and the Artificial Intelligence Act (AIA) proposal, containing additional cybersecurity requirements applicable to medical devices. This article analyses how the new reforms interact with the existing legislation from a cybersecurity perspective. The research finds that parallel provision of analogous cybersecurity requirements (especially on notification requirements) could lead to regulatory overlapping, fragmentation, and uneven levels of protection of individuals in the EU internal market. In the “Recommendations and conclusions”, the article provides policy recommendations to the EU legislator to help mitigate these risks.

Transformative Potential of AI in Healthcare: Definitions, Applications, and Navigating the Ethical Landscape and Public Perspectives

“…The reliance on electronic health records and other core systems in healthcare means that an effective cybersecurity framework is necessary to protect these systems from threats [141]. In contrast to physical breaches, which involve accessing patient records directly, a single medical device can serve as an entry point into the health record software of any hospital [142]. The use of AI introduces new opportunities for attackers to compromise patient privacy and undermine healthcare security, which is already vulnerable; therefore, it is crucial to develop legislation that protects patient information and to implement effective digital safeguards before the widespread adoption of AI algorithms in medicine [143].…”

Blockchain for Artificial Intelligence (AI): enhancing compliance with the EU AI Act through distributed ledger technology. A cybersecurity perspective

“…While the AI Act primarily focuses on ethical and legal aspects of AI, it also addresses the importance of cybersecurity in AI systems. In relation, the AI Act emphasises the need for AI systems to be designed and developed with cybersecurity in mind 6 . It requires that AI systems incorporate appropriate technical and organisational measures to ensure their security and resilience against cyber threats.…”

“…It also encourages cooperation and information sharing among stakeholders to address 5 Nonetheless, it remains unclear when the AI Act will come into force, given anticipated debate over a number of contentious issues, including biometrics and foundation models. 6 See Article 15 of the Proposal for a Regulation of the European Parliament and of the Council laying down Harmonised Rules on Artificial Intelligence and amending certain Union Legislative Acts (Artificial Intelligence Act), COM(2021) 206 (April 21, 2021). 7 Procedures related to the reporting of serious incidents and of malfunctioning in accordance with Article 62 of the proposed AI Act.…”

“…For example, a study by Andraško et al (2021) analyses the regulatory intersections between AI, data protection and cyber security within the EU legal framework [4]. Biasin and Kamenjasevié (2022) [6] examine cybersecurity issues of medical devices from a regulatory standpoint, underlining novel challenges arising from the AI Act and NIS 2 Directive proposals. Comiter (2019) [8] has highlighted the disconnect between cyber policy and AI systems.…”

Threats and Opportunities with AI-based Cyber Security Intrusion Detection: A Review

“…AI automation makes it an effective technology in detection [11]. AI systems could be programmed to detect specific steps and behavior and sound an alarm if available [12]. Since AI systems can monitor the system 24/7, they are considered very effective detection systems [13].This factor is why most organizations have implemented AI-based security protocols [13] see figure.4.…”