System

Under the MDR, whoever combines CE-marked devices into a system for placing on the market takes on the duties in Article 22. In cybersecurity, the system view decides which connected parts are in scope of the threat model.

‘system’ means a combination of products, either packaged together or not, which are intended to be inter-connected or combined to achieve a specific medical purpose;

EU MDR, Article 2(11)

integrated composite consisting of one or more of the PROCESSES, hardware, software, facilities, and people, that provides a capability to satisfy a stated need or objective NOTE Based on ISO/IEC ISO/IEC 12207:2008, 4.48.

IEC 62304:2006+AMD1:2015, clause 3.30

the combination of interacting elements or assets organized to achieve one or more function.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology

The MDR defines a system as a combination of products, packaged together or not, intended to be interconnected or combined for a specific medical purpose. The FDA cybersecurity guidance uses a general engineering definition: interacting elements or assets organized to achieve one or more functions.