Cyber Resilience Act and AI in medical technology

Ki on the Cyber Resilience Act

classification

Artificial intelligence accelerates the development, testing, and operation of digital products. At the same time, the Cyber Resilience Act and relevant standards are increasing the requirements for governance, security, and verification. This article classifies AI capabilities, key risks, and a practical approach for product teams. For years, OWASP has been helping companies position themselves resiliently against cyberattacks through articles, risk rankings, and other guidance materials. They list specific vulnerabilities for LLM applications and low-code platforms. Security requirements must already be embedded in architectures, development, and operation.

Regulatory framework and guidelines

The Cyber Resilience Act defines horizontal security requirements for products with digital elements. Manufacturers must address risks, demonstrate secure development, establish vulnerability management, and provide updates.

For healthcare software and health IT, IEC 81001-5-1 describes security activities throughout the entire product lifecycle. These include threat modeling, secure coding, software bill of materials (SBOM), static and dynamic analyses, penetration testing, and maintenance. Security by design is declared the standard.

AI-specific risks

The OWASP Top 10 for LLM applications include prompt injection, disclosure of sensitive information, supply chain risks, data and model poisoning, excessive nesting of agents, leakage of system prompts, and weaknesses in vector storage. Input and output validation, minimal privileges, containment, monitoring, and cost control are required.

For low-code and no-code platforms, OWASP cites account and connector authorization, misconfigurations, poor privilege management, weaknesses in handling secrets, and incomplete logging as key weaknesses. Misconfigurations are common causes of incidents.

Procedural model for practical application

1. Capture process context and architecture. Model components, data flows, connectors, agents, and rights. Document RAG paths and automation chains.

2. Extend threat modeling to AI scenarios. Consider prompt injection, data leakage via tools and connectors, agent errors, and supply chain issues.

3. Embed security by design. Establish secure coding guidelines, SBOM, secret management, audit logs, and regulated updates.

4. Define test strategy. Static and dynamic analyses, penetration tests, abuse case tests for LLM attacks, and red teaming for agents and workflows.

5. Secure operations. Monitoring of agent actions, rate and cost controls, vulnerability management, and clear shutdown paths.

6. Expand governance and training. Roles and responsibilities, approval processes for new connectors, and training on OWASP risks.

Conclusion

AI increases speed and scope in product development. With CRA-compliant security, OWASP-supported risk analysis, and activities in accordance with IEC 81001-5-1, risks can be managed and approval and operation accelerated.

Sources with links

1. Regulation EU 2024 2847 Cyber Resilience Act. Official Journal of the European Union
   https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng

2. BSI information page on the Cyber Resilience Act
   German
   https://www.bsi.bund.de/DE/ Topics/Companies and Organizations/Information and Recommendations/Cyber Resilience Act/cyber_resilience_act_node.html
   English
   https://www.bsi.bund. en/Themes/Businesses-and-organizations/Information-and-recommendations/Cyber_Resilience_Act/cyber_resilience_act_node.html

3. IEC 81001 5 1 2021 Security activities in the product life cycle
   ISO Catalog
   https://www.iso.org/standard/76097.html
   VDE Verlag
   https://www.vde-verlag.de/iec-normen/250590/iec-81001-5-1-2021.html

4. OWASP Top 10 for LLM Applications
   https://owasp.org/www-project-top-10-for-large-language-model-applications/

5. OWASP Top 10 Low Code No Code Security Risks
   Projektseite
   https://owasp.org/www-project-top-10-low-code-no-code-security-risks/
   Repository
   https://github.com/OWASP/www-project-top-10-low-code-no-code-security-risks

6. Schmidt J, Schutte NM, van Kessel R. Mapping the regulatory landscape for artificial intelligence in health within the European Union. npj Digital Medicine 2024
   Nature
   https://www.nature.com/articles/ s41746-024-01221-6
   PubMed
   https://pubmed.ncbi.nlm.nih.gov/39191937/

7. Menzies J et al. Artificial intelligence for international business. Thunderbird International Business Review 2024
   https://onlinelibrary.wiley.com/doi/abs/10.1002/tie.22370

8. Bimantara Putra R. Artificial Intelligence in Business. ISCEBE 2024
   https://conference.ut.ac.id/index.php/proceeding_iscebe/article/view/4232

9. Gupta S. The Effects of AI on Companies. IJFMR 2025
   PDF
   https://www.ijfmr.com/papers/2025/3/48442. pdf
   product page
   https://www.ijfmr.com/research-paper.php?id=48442

10. Kubiczek J, Roszko Wójtowicz E, Koczy J, Waszkiewicz I, Woś K. Harnessing AI for business transformation. Statistics in Transition new series 2025
    Journal page
    https://sit.stat.gov.pl/ Article/1008
    Full edition PDF
    https://sit.stat.gov.pl/SiT/2025/2/gus_sit_2025_02.pdf

11. Petryshyn N, Novytska S. The key issues of implementing artificial intelligence tools in business operations when entering foreign markets. Economics Finance and Law 2025
    Artikelseite
    https://efp.in.ua/ en/journal-article/1659
    Archiv PDF
    https://journals.indexcopernicus.com/api/file/viewByFileId/2449771

12. Model Context Protocol
    Official website
    https://modelcontextprotocol.io/
    Introduction
    https://www.anthropic.com/news/ model-context-protocol
    Descope Overview
    https://www.descope.com/learn/post/mcp
    Documentation
    https://docs.descope.com/mcp

13. n8n Workflows Security und Audits
    WebSecScan
    https://n8n.io/workflows/ 3314-websecscan-ai-powered-website-security-auditor/
    OTX und OpenAI Web Security Check
    https://n8n.io/workflows/5175 -otx-and-openai-web-security-check/
    SecOps Kategorie
    https://n8n.io/workflows/categories/secops/

14. Lovable Vibe Coding Coverage
    Business Insider Gründerszene
    https://www.businessinsider.de/gruenderszene/technologie/8-monate-nach-launch-ki-startup-lovable-erreicht-unicorn-status/
    Business Insider
    https://www.businessinsider.com/accel-to-lead-funding-round-for-lovable-2025-6