# Cybersecurity of AI medical devices: risks, legislation, and challenges

**Authors:** Elisabetta Biasin, Erik Kamenjasevic, Kaspar Rosager Ludvigsen  
**arXiv:** [2303.03140](https://arxiv.org/abs/2303.03140)  
**Date:** 2023-03-06  
**Summary page:** https://www.summarizepaper.com/en/paper/2303.03140v1/

## Key points

- Cybersecurity and healthcare intersect in the context of medical devices and AI systems
- These technologies have the potential to transform healthcare, but also pose significant risks to patient safety and security if exposed to cyberattacks
- Part one provides an overview of cybersecurity in healthcare and defines AI that is considered a medical device or supports one, with examples of risks posed by such devices
- Part two examines the European Union's regulatory framework for ensuring cybersecurity of AI as or in medical devices, including relevant legislation such as MDR, NIS Directive, Cybersecurity Act, GDPR, AI Act proposal, and NIS 2 Directive proposal
- Part three examines possible challenges stemming from this regulatory framework, including how the AI Act will interact with MDR regarding cybersecurity and safety requirements; interpretation of incident notification requirements from NIS 2 Directive proposal and MDR; and consequences arising from evolving definitions of critical infrastructures
- Draws on a range of sources including academic articles and relevant books
- Offers valuable insights into how cybersecurity concerns intersect with healthcare provisions involving medical devices and AI systems
- Highlights key challenges facing regulators as they seek to ensure patient safety and security while fostering innovation within their respective jurisdictions.

## Summary

This draft chapter explores the intersection of cybersecurity and healthcare in the context of medical devices and artificial intelligence (AI) systems. While these technologies have the potential to transform healthcare, they also pose significant risks to patient safety and security if exposed to cyberattacks. The chapter is divided into three parts. The first part provides an overview of cybersecurity in healthcare and defines what is meant by AI that is considered a medical device or supports one. The authors illustrate the risks posed by such devices through three examples: poisoning datasets, social engineering, and data or source code extraction. In the second part, the chapter examines the European Union's regulatory framework for ensuring the cybersecurity of AI as or in medical devices. This includes an overview of relevant legislation such as the Medical Devices Regulation (MDR), NIS Directive, Cybersecurity Act, General Data Protection Regulation (GDPR), AI Act proposal, and NIS 2 Directive proposal. Finally, in the third part of the chapter, possible challenges stemming from this regulatory framework are examined. Specifically, the authors explore how the AI Act will interact with MDR regarding cybersecurity and safety requirements; how incident notification requirements from NIS 2 Directive proposal and MDR should be interpreted; and what consequences may arise from evolving definitions of critical infrastructures. The chapter draws on a range of sources including academic articles on topics such as adversarial attacks on camera-LiDAR models for car detection, phishing during COVID-19 pandemic, targeted attacks on teleoperated surgical robots, machine learning in image defogging techniques among others. It also cites relevant books like Security Engineering: A Guide to Building Dependable Distributed Systems by Ross Anderson and The Palgrave Handbook of International Cybercrime and Cyberdeviance edited by Thomas J Holt and Adam M Bossler. Overall, this draft chapter offers valuable insights into how cybersecurity concerns intersect with healthcare provisions involving medical devices and AI systems. It highlights key challenges facing regulators as they seek to ensure patient safety and security in an increasingly complex technological landscape while fostering innovation within their respective jurisdictions.