ASAPTIC REGULATED INFRASTRUCTURE PLAYBOOK · CRA & MEDICAL 2xMOPP

EU Cyber Resilience Act (2024/2847) Smart PDUs & IEC 60601-1 (2×MOPP) Medical OEM Power Playbook

Q: Does supplying an IEC 60601-1 2xMOPP internal power module require EU MDR 2017/745 registration?

No, provided it is supplied strictly as an internal OEM sub-assembly rather than a standalone finished medical device making clinical claims. However, the medical OEM's Notified Body requires the power supply's full IECEE CB Test Report & Certificate (IEC 60601-1 Ed 3.2), Risk Management File inputs (ISO 14971), and critical-component insulation table—all delivered in Asaptic's OEM documentation pack.

Q: When do EU Cyber Resilience Act obligations apply to networked rack PDUs and industrial gateways?

Article 14 vulnerability and severe-incident reporting obligations became active on 11 September 2026, and full Annex I essential cybersecurity requirements (including SBOM, secure-by-default configuration, and CE marking under CRA) become mandatory on 11 December 2027.

Active vulnerability reporting under the EU Cyber Resilience Act (EU) 2024/2847 began on 11 September 2026 ahead of mandatory CE enforcement on 11 December 2027. Asaptic equips infrastructure and medical-device OEMs with SBOM-documented Redfish/SNMPv3 rack PDUs and IEC 60601-1 Ed 3.2 (2xMOPP, <100 µA leakage) OEM power subsystems backed by full CB/UL insulation coordination files.

1. Navigating CRA (EU 2024/2847) on Networked Power & Infrastructure Hardware

Networked Zero-U rack PDUs, out-of-band IP-KVMs, industrial PoE switches, and smart BMS/EVSE gateways fall squarely within 'products with digital elements' under Regulation (EU) 2024/2847. Procurement teams can no longer buy generic Telnet/default-password management cards: EU market access requires machine-readable CycloneDX/SPDX Software Bills of Materials (SBOM), unique per-unit bootstrap credentials, signed firmware updates (TLS 1.3 / Redfish / SNMPv3), and ENISA/CSIRT vulnerability reporting workflows.

2. IEC 60601-1 Ed 3.2 (2×MOPP) Sub-Assemblies for Medical Equipment OEMs

While finished medical devices require multi-year EU MDR 2017/745 or FDA 510(k) approvals, medical instrument OEMs urgently need ISO 13485-manufactured internal AC/DC power supplies (<100 µA earth leakage, 4,000 VAC reinforced 2×MOPP isolation, IEC 60601-1-2 4th Ed EMC) and custom surgical/endoscope harnesses supplied strictly as non-finished OEM components with complete CB Scheme TRF + UL Recognized Component files.

Frequently Asked Questions

Does supplying an IEC 60601-1 2xMOPP internal power module require EU MDR 2017/745 registration?

No, provided it is supplied strictly as an internal OEM sub-assembly rather than a standalone finished medical device making clinical claims. However, the medical OEM's Notified Body requires the power supply's full IECEE CB Test Report & Certificate (IEC 60601-1 Ed 3.2), Risk Management File inputs (ISO 14971), and critical-component insulation table—all delivered in Asaptic's OEM documentation pack.

When do EU Cyber Resilience Act obligations apply to networked rack PDUs and industrial gateways?

Article 14 vulnerability and severe-incident reporting obligations became active on 11 September 2026, and full Annex I essential cybersecurity requirements (including SBOM, secure-by-default configuration, and CE marking under CRA) become mandatory on 11 December 2027.