Issue: July 12, 2026

1. U.S. Congress - Senate Bill Targets Chinese-Made Networked Medical Devices

Senator Tom Cotton (R-Ark.) introduced the “Countering Chinese Cyberthreats for Patients Act” (“Countering CCP Act,” S. ____) on 25 June 2026. Although introduced two and a half weeks ago, the bill has not previously appeared in this briefing and represents a significant potential compliance obligation for manufacturers with China-linked supply chains, so it is flagged here on first substantive review of the bill text.

What it would do: Direct the FDA Commissioner, in consultation with CISA, to review all “covered devices” - networked devices cleared/approved on or before 28 March 2023 and manufactured by a company headquartered in, or owned/controlled by, the People’s Republic of China - for cybersecurity risk.

Disclosure mandate: Within 180 days of enactment, HHS must request from each covered manufacturer a software bill of materials (commercial, open-source, and off-the-shelf components), data-mapping/architecture documentation, and the physical locations of systems and servers holding patient data.

Recall authority: Within 18 months of enactment, FDA must order cessation of distribution, notify providers and facilities, and notify affected individuals for any covered device found to pose a cybersecurity risk - or for any device whose manufacturer fails to provide the requested information within the 180-day window.

Status: Introduced and referred to committee; no markup or hearing has yet been scheduled. The bill follows Sen. Cotton’s May 2026 letter urging FDA to expand review of Chinese-manufactured devices after the Contec CMS8000 recall.

Manufacturer relevance: Companies headquartered in or controlled by China-based entities - or that rely on China-based component suppliers or data-hosting arrangements - should assess exposure now. The SBOM and data-mapping documentation the bill would require mirrors expectations already emerging under FDA’s Section 524B premarket review, so manufacturers with mature SBOM/VEX practices are better positioned regardless of the bill’s ultimate fate.

Source: Countering Chinese Cyberthreats for Patients Act - bill text, Sen. Cotton

2. EU Cyber Resilience Act - ENISA Consultation on Secure Update Mechanisms Closes

ENISA’s public consultation on its draft Technical Advisory covering secure update mechanisms closed on 10 July 2026, within this briefing’s coverage week. The advisory is aimed primarily at micro, small, and medium-sized manufacturers and sets out common update-lifecycle threats and practical controls for secure delivery of software updates - a topic directly relevant to post-market vulnerability remediation under both the CRA and MDR/IVDR.

This is a distinct, newer work item from the CRA Single Reporting Platform (SRP) coverage in prior briefings; it addresses update-mechanism security controls rather than incident/vulnerability reporting.

The SRP itself remains not yet live as of this week, with the 11 September 2026 mandatory reporting deadline now 61 days away; no additional platform status change was identified this week beyond what was previously reported.

Manufacturer relevance: Even though medical devices under MDR/IVDR remain formally exempt from CRA product requirements, the update-mechanism advisory reflects the baseline ENISA expects of connected-product software generally, and provides a useful reference point for manufacturers benchmarking their own secure-update and patch-delivery processes against EU regulatory expectations.

Source: Updates from Europe: Single Reporting Platform, Public Consultations, New Publications - OpenSSF