NIS2 & Executive Liability – A Critical Priority for Medical Device Manufacturers

Nadine Lewis
May 13
2 min read

NIS2 Is Here. Are You Ready to Be Held Personally Accountable?

The NIS2 Directive, in force across the EU from October 2024, introduces one of the most significant regulatory shifts in cybersecurity governance in over a decade. Replacing the original NIS Directive, NIS2 expands its scope to include medical device manufacturers as “important entities” under EU law.

What does that mean for you?

You are now legally obligated to implement rigorous cybersecurity risk management and incident reporting processes.
Your executive leadership can face personal civil, or even criminal, liability for failures in ensuring compliance.
National regulators can impose penalties, conduct audits, and even issue binding orders.

With the healthcare sector classified as critical infrastructure, medical device manufacturers – particularly those supplying hospital systems, imaging technology, diagnostics, and connected health solutions – face unprecedented scrutiny.

Why NIS2 Matters to Medical Device Manufacturers

Medical devices are increasingly software-driven, connected to networks, and integrated into critical clinical workflows. This connectivity introduces risk vectors that, if exploited, can lead to patient harm, operational shutdowns, or reputational damage. NIS2 directly acknowledges this by holding manufacturers accountable not just for device safety, but for systemic cyber resilience.

Non-compliance is not just a technical issue — it’s a boardroom issue.

How The AbedGraham Group Can Help

With deep roots in healthcare cybersecurity and regulatory strategy, The AbedGraham Group offers a suite of ISO-aligned cybersecurity services to help you:

Conduct NIS2 readiness assessments mapped to ISO 27001, ISO22301, ISO27036, MDR and sector-specific security standards
Develop risk management frameworks and incident response plans tailored to medical device operations
Support board-level governance structures to demonstrate executive oversight and minimise liability exposure
Prepare for inspections and enforcement actions by national competent authorities

We offer board level advisory services and end-to-end implementation support, working with both technical and executive teams to embed cybersecurity governance across your product lifecycle.