1. IoMT as a medical device under European Union law

IoMT is a broad category of devices of a strictly consumer nature (such as the extremely popular smartwatches), as well as those used in the clinical process. From a legal point of view, this distinction is of considerable importance, as the legislation in force in the European Union clearly distinguishes between devices that are medical devices and those that, despite their function, do not have such status,Footnote ¹⁹ which directly translates into the scope of obligations of manufacturers and their distributors, and thus also the level of protection of their users.

For those IoMT devices that are medical devices, the provisions of MDR on medical devices apply. The question then becomes which IoMT devices will correspond to the concept of medical devices?

According to the definition proposed by the EU legislator in Article 2 MDR, “medical device” means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes:

1. (1) diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease,

2. (2) diagnosis, monitoring, treatment, alleviation of, or compensation for, an injury or disability,

3. (3) investigation, replacement or modification of the anatomy or of a physiological or pathological process or state,

4. (4) providing information by means of in vitro examination of specimens derived from the human body, including organ, blood and tissue donations,

5. (5) and which does not achieve its principal intended action by pharmacological, immunological or metabolic means, in or on the human body, but which may be assisted in its function by such means.

As Greser points out,Footnote ²⁰ the concept of medical devices includes those IoMT devices that meet two types of premises together. The first premise is related to the form of impact on the patient, which includes tools, apparatus, devices, implants, reagents, materials or software. A medical device will not be a product that does not achieve its intended primary action through pharmacological, immunological, or metabolic means (in or on the human body), but whose action may be assisted by such means.

The second premise is related to the purpose of use of the device in question. Such a device must firstly be intended for human beings and secondly used for one of the purposes indicated in Article 2 MDR.Footnote ²¹

In light of the above, there should be no doubt that wearable medical devices will not fall within the definition of medical devices referred to MDR, because they do not have the purposes indicated in the Regulation. Indeed, the data that the devices in question collect and then process are not subsequently used in the treatment process and are not assessed in terms of medical data. The assessment of whether an IoMT device is a medical device must therefore be made in each case by assessing whether the device serves a medical process.

In turn, those IoMT devices that fall into the MDR will have to guarantee the highest possible level of safety for patients, which the EU legislature intends to do by setting high quality and safety standards for medical devices and by laying down rules for the placing, making available on the market and putting into service in the Union.

The MDR defines a regulatory regime distinguishing four stages, each of which is of considerable importance for the overall safety of the user.

The first stage focuses on the placing of the device on the market and into use. Article 5 MDR provides that a device may only be placed on the market or put into service if, when duly supplied and properly installed, maintained and used in accordance with its intended purpose, it complies with this Regulation and must meet the general safety and performance requirements set out in Annex I relating thereto, taking account of the intended use of the device. Annex I specifies that the devices shall achieve the performance intended by their manufacturer and shall be designed and manufactured so as to be suitable for their intended use under normal conditions of use. The devices shall be safe and effective and shall not jeopardise the clinical condition or the safety of patients, the safety or health of users or, where appropriate, other persons, and any risks which may be associated with their use shall, when weighed against the benefits to the patient, represent an acceptable risk and shall be compatible with a high level of protection of health and safety, taking account of the generally acknowledged state of the art. In particular, it is a requirement to establish and maintain a risk management system, conduct clinical evaluation of the product, including post-market clinical follow-up, draw up and keep up to date the technical documentation, draw up the EU declaration of conformity and affix the CE conformity marking.Footnote ²² Manufacturers are therefore required to determine the intended use of the device, carry out clinical trials and performance evaluation, establish a risk assessment and classify their medical devices according to a four-stage qualification system (ie Class I, IIa, IIb, III), where the higher the class the more stringent the product conformity assessment.

The second stage addresses the certification, review or marketing approval (marketing approval is required for devices classified as high or highest risk) which is based on the abovementioned information recorded in technical documents and submitted to the regulatory authority.Footnote ²³

Once a product has been placed on the market, the so-called third stage begins, namely the post-market surveillance: the manufacturer is obliged to ensure that the product remains safe and functions as intended, as specified in its original documentation.Footnote ²⁴ Finally, manufacturers are also obliged to keep records and regularly report the results of post-market monitoring and surveillance to the regulator.

In the event that a device proves to be defective, or new risks to patient safety are detected or revealed, then the regulator is competent to withdraw the device from the market, which constitutes the fourth stage.Footnote ²⁵

The MDR also places certain categories of obligations on importers and distributors, not least in order to achieve greater compliance on the part of individual economic operators.

The previous short remarks seem to justify the thesis that the regulation introduces a set of mechanisms enhancing the safety of the medical devices themselves, including IoMT devices, and, by extension, of the persons using them. Of course, the scientific literature also draws attention to certain issues that may undermine the achievement of the objectives for which the regulation was adopted,Footnote ²⁶ but, in principle, it must be assessed that the harmonised set of obligations for manufacturers provide grounds for affirming that, as Kosta Shatrov and Carl Rudolf Blankart rightly assessed, the MDR represents a pragmatic step in the right direction.

2. “Consumer” IoMT

For IoMT devices, which will not fall in the category of medical devices as defined by MDR, the regulatory environment addressing user safety includes several other pieces of legislation, including new pieces of legislation and legislative proposals that will directly relate to the Internet of Things, but also more specifically to those IoMT devices. Both legislation in force and proposed legislation will be considered in the remainder of this work, showing the conception of the EU legislator as to what the protection of users of IoMT devices should look like.

Directive 2001/95/EC on general product safety is the starting point. Article 1 clarifies that the directive aims to ensure the safety of all products placed on the market. Article 2 defines a product as any product – including in the case of a service – which is intended for consumers or likely, under reasonably foreseeable conditions, to be used by consumers even if not intended for them, and is supplied or made available, whether for consideration or not, in the course of a commercial activity, and whether new, used or reconditioned. This definition clearly applies to IoMT devices. By contrast, a “safe product” is considered to be any product which, under normal or reasonably foreseeable conditions of use including duration and, where applicable, putting into service, installation and maintenance requirements, does not present any risk or only the minimum risks compatible with the product’s use, considered to be acceptable and consistent with a high level of protection for the safety and health of persons. The following points should be considered:

1. (1) the characteristics of the product, including its composition, packaging, instructions for assembly and, where applicable, for installation and maintenance;

2. (2) the effect on other products, where it is reasonably foreseeable that it will be used with other products;

3. (3) the presentation of the product, the labelling, any warnings and instructions for its use and disposal and any other indication or information regarding the product;

4. (4) the categories of consumers at risk when using the product, in particular children and the elderly.

Under the Directive, producers are obliged to fulfill one general obligation to place only safe products on the market, as well as several other specific obligations, such as providing consumers with adequate information to enable them to assess the risks posed by the product during normal or foreseeable use, in the absence of adequate warnings of such risks, and to take appropriate precautions.

Furthermore, distributors are obliged to act with due care to ensure compliance with the applicable safety requirements. Furthermore, distributors, within the limits of their respective activities, should participate in monitoring the safety of products placed on the market, in particular by passing on information on the risks that products present, keeping and providing the documentation necessary for tracing the origin of products and cooperating with producers and the competent authorities on risk-avoidance measures taken. Within their field of activity, distributors should take measures to cooperate effectively.

Academic literature has observed that, although Directive 2001/95 applies to those products used by consumers that do not meet the requirement of health and safety protection, it does not define the very concept of safety – which further necessitated specific legislative steps in the individual Member States.Footnote ²⁷ For this reason, among others, a new legislative proposal has been presented introducing clear and detailed provisions, leaving no room for differing transposition by Member States. Regulation (EU) 2023/988 on general product safetyFootnote ²⁸ has recently been adopted. This Regulation – as mentioned in Article 1(2) – lays down essential rules on the safety of consumer products placed or made available on the market. Significantly, the regulation defines product as any item, whether or not it is interconnected to other items, supplied or made available, whether for consideration or not, including in the context of providing a service, which is intended for consumers or is likely, under reasonably foreseeable conditions, to be used by consumers even if not intended for them. Again, this leaves no illusion that IoMT devices will fall within this definition. It should be noted that the EU legislator decided to define a dangerous product as any product which is not a “safe product” (Article 3(3)), and as a safe product any product which, under normal or reasonably foreseeable conditions of use, including the actual duration of use, does not present any risk or only the minimum risks compatible with the product’s use, considered acceptable and consistent with a high level of protection of the health and safety of consumers (Article 3(2)).

Looking at the Regulation in the context of the IoMT, it is certainly noteworthy that the EU legislator has considered the case of Internet of Things and the risks arising from their use by explicitly pointing out that objects that connect with other objects, or non-integrated objects that affect the way another object works, may pose a risk to product safety. This aspect should be adequately addressed as a potential risk. The connections and interdependencies that an object may have with external objects should not compromise its safety.Footnote ²⁹ The protection of the consumer using IoMT devices is also supported by the fact that the EU legislator has chosen to oblige all actors involved in the supply and distribution chain to take appropriate measures to ensure that they make available on the market only products that are safe and comply with this Regulation.

The adequacy of the IoMT user protection may be assessed by reference to the so-called “milestones” setting the standard of consumer protection, ie in particular provisions concerning the implementation of the information obligation, issues related to the assurance of fair contractual terms and conditions or consumer protection against unfair commercial practices.

With regard to issues concerning the implementation of the information obligation towards the consumer, the provisions of Directive 2011/83/EU are relevant in this regard. There is no doubt that an IoMT user who purchases a wearable medical device will fall within the definition of a consumer proposed in the directive. Undoubtedly, it can also be assumed that IoMT devices can be qualified as goods according to Directive 2011/83/EU, ie as any tangible movable item, with the exception of items sold by way of execution or otherwise by operation of law. At the same time, since there are no grounds to consider that the provisions of Directive 2011/83/EU will be excluded due to any of the circumstances indicated in Article 3 of the Directive, its provisions will therefore apply and shape the legal position of the IoMT user.

According to Articles 5 and 6 of the Directive, the assessment of the adequacy of the provisions shaping the duty of information in relation to IoMT devices is not clear-cut. While in the case of a purchase of an IoMT device, such as a smartwatch, many times, the consumer has an adequate level of protection, regardless of whether the contract is concluded at a distance or not, as regards such information as, for example, the identity of the trader, the conditions of payment, delivery, performance, the time limit within which the trader undertakes to deliver the goods or to provide the service, and the trader’s complaint handling procedure, in relation to the duty to provide information on the main characteristics of the product or the functionality of the digital content, this assessment may become significantly more complicated. This is due to an intrinsic feature of any IoT device, including IoMT devices, namely its functionality, which is the result of a complex network of interconnected applications and services and, ultimately, the input of the consumer himself.Footnote ³⁰ This, in turn, makes it more difficult for the manufacturer to comply with its duty to provide information in such a way that the consumer can be deemed to have actually been informed of, for example, the functionality of digital content, etc.

The fairness of contractual terms are regulated by the Directive on unfair terms in consumer contracts, also in case of IoMT. The Directive addresses the non-binding nature of unfair contract terms and therefore aims to address the problem of “significant imbalance in the rights and obligations of the parties under the contract.” However, the specific nature of the IoMT, through the collection and processing of vast amounts of data about users and the associated detailed knowledge of consumers’ vulnerabilities, behaviours and biases, has the effect of significantly aggravating the imbalance of power between users and producers of these devices.Footnote ³¹ In this context, it also seems relevant to address the question of the extent to which IoMT users will be able to safeguard their interests and negotiate fair terms, in order to ensure transparency, considering this widespread imbalance of power?Footnote ³² These contracts are, after all, mostly adhesion contracts, and the user may not even be interested in negotiating their terms and conditions if he is not aware of what market practices he is being subjected to.

The traditional consumer regime that goes beyond the contract and, as a principle, can be more helpful is the Unfair Commercial Practices Directive. Central to the directive is the autonomy of the consumers’ decision-making process, providing protection against deception and unfair restrictions on consumer choices.Footnote ³³ According to recital 18, the yardstick for unfairness is an average consumer who is sufficiently well-informed and reasonably attentive and cautious, taking into account social, cultural, and linguistic factors, in line with the interpretation of the Court of Justice. The directive also acknowledges that commercial practices may target vulnerable consumers, ie those ones particularly susceptible to such practices or the product in question, due to physical or mental disabilities, age, or gullibility. Determining the characteristics of an average consumer or an average representative of a specific group of consumers falls within the competence of national courts and can be challenging in practice, especially considering the specificity of IoMT. Following the insightful example given by Natali Helberger, where a purchaser of a smartwatch will need a different level of media usage skills, technical understanding, and awareness of basic legal implications than a purchaser of an “ordinary” analog watch,Footnote ³⁴ in case of consumer IoMT devices, for consumers using contact lenses to measure blood glucose levels, the informational obligation should be fulfilled differently than for consumers using regular contact lenses.

As a result of the previous analysis, pre-contractual, contractual, and non-contractual protection for IoMT users are not without imperfections and certain legislative shortcomings. The following step is then evaluating to what is the extent consumers are protected when the IoMT device proves to be defective. This issue is addressed by the Directive 85/374 concerning liability for defective products. Nevertheless, the applicability of the provisions of this act to IoMT devices may be debatable for the following reasons.

Firstly, in the context of IoT, the definition of the product itself seems problematic: Article 2 states that a product means “any movable item, excluding agricultural raw materials and hunting and fishing products, even if it forms part of another movable or immovable item.” “Product” also includes electricity. This definition was perceived as problematic when attempting to classify IoT devices as products under this directive until the European Commission provided for clarifications. The Commission stated that IoT devices and any other objects containing intangible elements or possessing communication features, provided they qualify as “movable items,” are considered “products,” and defects in these products are covered by the directive.Footnote ³⁵ Thus, IoMT devices, which have the nature of movable items, will also be covered by this directive.

However, the functionality of intangible elements (software, etc.) is typically crucial in an IoT device. Such information transfer may be considered as a “service.” According to the European Commission, such a service will not be subject to EU product liability and safety regimes.Footnote ³⁶ Therefore, “in cases where damage is caused by the provision of incorrect data or the failure to provide data, assigning responsibility may become unclear, and claims potentially difficult to enforce. This means that sellers may consider placing key safety functions in the cloud to try to avoid product liability.Footnote ³⁷ ”

Moreover, the definition of defective product is also considered problematic. According to Article 6, a product is defective if it does not provide the safety that a person is entitled to expect, taking into account all circumstances, in particular: the appearance of the product; the way in which the product is intended to be used, which can be reasonably expected; the time when the product was put into circulation. It is also stated that a product will not be considered defective solely because a better product was later introduced into the market. However, for the manufacturer to be legally liable, there must be a causal link between the product’s defect and the resulting damage. Such an understanding of manufacturer liability does not fully align with the issue of security discussed here. For such an assessment, the provision of user instructions/warnings will be crucial. As IoT devices become increasingly sophisticated and technology advances, it will become more challenging to make the information provided on products sufficiently clear to enable consumers to assess the security of highly technically advanced products and understand the processes that enable their operation. When considering the choice of products to purchase, consumers are not always able to assess which one is truly safe.Footnote ³⁸

Regarding the issue of liability for defective products, the EU legislator has announced certain legislative changes that cannot be overlooked. On 28 September 2022, the Proposal for a Directive on liability for defective productsFootnote ³⁹ was published, aiming to establish a compensation system at the EU level for individuals who have suffered harm to health or property caused by defective products.

From the perspective of users, it is noteworthy, first and foremost, that consumer IoMT devices will fall within the concept of a product. According to the proposal, the concept of a product includes all movables, even if integrated into another movable or into an immovable. “Product” includes electricity, digital manufacturing files, and software. The proposal also adopts the principle that strict liability for defective products should apply to all movable items, including those integrated into other movable items or installed on them.Footnote ⁴⁰ Additionally, in order to reduce the burden of proof for the plaintiff, the proposal obliges manufacturers to disclose evidence, aiming to ease the burden of proof on consumers in complex cases.

The proposed Directive, however, is not without shortcomings in the context of IoMT, as rightfully pointed out by Greser, who states that, “the proposal introduces a presumption of product defectiveness in certain situations. One of these is a claimant’s establishment that a product fails to comply with mandatory safety requirements under EU or national laws that are designed to protect against the risk of damage. In such cases, it will not be possible to refer to noncompliance with nonlegal standards as a source of damage. This seems to be the wrong approach, considering the dynamics of changes in cybersecurity threats and, generally speaking, the more rapid adaptation of nonlegal standards to them.Footnote ⁴¹ ”

Summarising the above considerations regarding the level of protection for consumer IoMT users in light of EU legislation, a first consideration is the multitude of regulations shaping these issues. While this diversity of regulations per se is not necessarily negative, it brings about significant consequences. Such legislative “fragmentation” may pose problems for individual consumers in understanding their rights. For the average consumer, the proper interpretation of the relationship between various legal acts can also be challenging. At the same time, manufacturers and other entities offering such products must be vigilant regarding the existence of regulations about them across various legal acts.

The rapid technological transformation, including in the IoMT sector, requires constant monitoring of user protection levels in various fields. Any legislative changes often need to be coordinated at multiple levels and about multiple texts simultaneously. To address these concerns, especially in the cybersecurity domain, one of the recent initiatives undertaken by the European legislator appears to be the Cyber Resilience Act proposal.Footnote ⁴² This initiative currently addresses the unregulated cybersecurity market of IoT. Its goal is to establish basic security requirements for digital products and related services available in the EU.

The Cyber Resilience Act aims to contribute to ensuring that manufacturers enhance the security of products with digital elements. It seeks to establish cohesive cybersecurity frameworks, facilitating compliance for hardware and software manufacturers, while enhancing transparency regarding security features. Finally, it aims to protect businesses and consumers, enabling them to use these products safely.Footnote ⁴³

Under the proposed regulation, manufacturers will be obligated to conduct an assessment of the compliance of products with digital elements and procedures established by the manufacturer to determine whether the fundamental requirements specified in Annex I, which requires delivery “without any known exploitable vulnerabilities,” have been met. The proposed regulation will not apply to products with digital elements covered by the MDR.

It is positive to recognise the ever-increasing awareness on the part of the EU legislator regarding the changing context and conditions in which IoMT device users are expected to operate. This is particularly accentuated in recent years, especially with the dynamic technological advancements and the widespread adoption of such products on a mass scale. The hallmark of responsible legislative actions is a consistent and systematic orientation towards the needs of individuals, while simultaneously ensuring market balance.

Of course, examples of certain legislative shortcomings could be multiplied across various fields. However, the mere recognition of the necessity to revise many legal acts to enhance the security level for IoMT users creates a kind of “light at the end of the tunnel.” It is crucial to emphasise that this should be accompanied by an appropriate pace of legislative work.

1. Medical device as a category of IoMT in US law

The primary source of legal regulations concerning medical devices in the United States is the Medical Device Amendments of 1976 to the Federal Food, Drug, and Cosmetic Act.Footnote ⁴⁴ These regulations cover various aspects, including pre-market review, approval of medical devices, a risk-based classification system, requirements for good manufacturing practices, reporting adverse events, and requirements for medical device studies.Footnote ⁴⁵ Over the years, this law has undergone multiple amendments through acts such as the Safe Medical Devices Act of 1990 (the 1990 Act), the Medical Device Amendments of 1992 (the 1992 Amendments), the Food and Drug Administration Modernization Act of 1997 (FDAMA), the Medical Device User Fee and Modernization Act of 2002 (MDUFMA), the Food and Drug Administration Amendments Act of 2007 (FDAAA), and the Food and Drug Administration Safety and Innovation Act (FDASIA) enacted in July 2012.Footnote ⁴⁶

The concept of medical devices is defined in Section 201(h) of the Food, Drug, and Cosmetic Act. The term “device” refers to an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article. This includes any component, part, or accessory that meets the following criteria:

1. (1) Recognised in the official National Formulary or the United States Pharmacopeia, or any supplement to them.

2. (2) Intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in humans or other animals.

3. (3) Intended to affect the structure or any function of the body of humans or other animals.

Importantly, a medical device does not achieve its primary intended purposes through chemical action within or on the body of humans or other animals and is not dependent upon being metabolised for the achievement of its primary intended purposes.

The proposed definition of medical devices in US law undoubtedly encompasses a significant portion of IoMT devices, which, according to the earlier qualification presented, fall into the category of devices with a strictly clinical purpose. Firstly, the US legislator, by formulating “or other similar or related article,” used an open catalogue, which practically eliminates the need to determine whether IoMT devices will be considered a machine, contrivance, or another article. Secondly, it seems indisputable that at the current stage of IoMT device development, they do not utilise any chemical actions in the body or on the body, and the achievement of their intended purpose is not dependent on metabolism. Finally, they are used for diagnosing disorders or other medical conditions, as well as in the treatment or prevention of diseases. In a situation where an IoMT device meets these criteria, it should be classified as a medical device under the FDCA. An important variable in this regard is that the manufacturer’s intention is the key factor determining the status of the “product.” Manufacturer declarations regarding the product define the “intended use,” and the same product may be a device or not, depending on the manufacturer’s declaration. As an example, following Ellen J. Flannery, one can point to a situation where exercise equipment used for maintaining good health may not be considered a device, while the same equipment designed for the cardiac rehabilitation of patients after heart surgery will be considered a device under the FDCA.Footnote ⁴⁷

If an IoMT device is considered to meet the criteria for a medical device, the FDCA establishes regulatory frameworks for these products based on risk analysis. According to Section 513 of the FDCA, products are classified according to the level of risk. Similar to the EU approach, US legislation distinguishes three risk classes. In practice, as indicated by statistical data, more devices in the EU fall into risk class I (40% versus 35%) and risk class III (16% versus 9%) compared to the US. The US has more devices in risk class II, accounting for 53% compared to 44% (combining Class IIa and IIb) in the EU.Footnote ⁴⁸

In the United States, like in the European Union, Class I applies to medical devices posing the least risk and subject to general controls specified by law. Class II devices are subject to both general and special controls. Consequently, nearly all Class I devices and some Class II devices are exempt from premarket review. However, most Class II devices (and some Class I devices) can enter the market only after FDA approval through a premarket notification, pursuant to Section 510(k) of the law. This pathway requires the device to be “substantially equivalent” to a “predicate device.” A predicate device is a similar product introduced to the market before 28 May 1976 (the enactment date of the amendments) or introduced after that date and deemed by the FDA to be substantially equivalent to a legally marketed device previously cleared through a 510(k) submission. Most devices are marketed through this pathway and the premarket notification is referred to as a “510(k) submission.”Footnote ⁴⁹ Comparing this procedure with the provisions of Regulation 2017/745, it can be assessed that the criteria for demonstrating equivalence are less stringent.Footnote ⁵⁰

On the other hand, Class III devices, such as implants and life-supporting devices, are subject to the most rigorous controls, including approval before market entry by the Food and Drug Administration (FDA).Footnote ⁵¹ Class III devices, including those that are not substantially equivalent to a predicate device, cannot be marketed until: (1) the device has been tested for safety and effectiveness; (2) a premarket approval (PMA) application has been submitted to the FDA; and (3) the FDA has approved the PMA as demonstrating sufficient assurance that the device is safe and effective for its intended use. The FDA may impose conditions on the approval of the PMA, including post-approval study requirements and restrictions on sale, distribution, or use.Footnote ⁵²

Indeed, the FDA’s responsibility regarding the clearance of medical devices before their introduction to the market is to assess their safety, effectiveness, and quality (in accordance with good manufacturing practices).Footnote ⁵³

For all users of IoMT devices, the inclusion of these devices in a classification system, taking into account the level of risk associated with their use, seems to be a favourable circumstance on the path to ensuring an adequate level of protection. However, it should be noted that due to various factors such as uncertainty, delays, and the costs associated with FDA actions before introducing a product to the market, the risk of either complete discouragement of innovation or slowing it down increases. This could result in potential benefits emerging with delay or in other countries.

In reality, the FDA is unable to keep up with the rapid technological development, as Larry Downes pointed out, stating that “technology changes exponentially, but social, economic, and legal systems change gradually.” The FDA verification process is almost twice as long as that of its European counterpart (the European Medicines Agency) for devices that do not require clinical data and almost three times longer for devices requiring clinical data.

When CEOs of medical device manufacturing companies were asked about their biggest challenge in 2014 (in the United States), over 43% responded that it was the “changing regulatory environment.” In fact, the United States was the second most challenging market for introducing new medical devices, second only to China.Footnote ⁵⁴

In the USA, unlike in the EU, as discussed earlier, for most devices, the FDA requires only general post-market actions, such as gathering opinions from physicians or accessing the MAUDE database. In March 2023, 21 ongoing studies post-market introduction were listed in the database.Footnote ⁵⁵

Referring to IoMT medical devices, it is noteworthy that in 2023, the US legislature took significant steps to enhance their cybersecurity. The observation of a reality where open-source software became a significant part of many medical devices prompted legislative action. As a result, in December 2022, the FDA signed the Consolidated Appropriations Act 2023,Footnote ⁵⁶ also known as the “Omnibus.” Section 3305 of the Omnibus, titled “Ensuring Cybersecurity of Medical Devices,” amended the Federal Food, Drug, and Cosmetic Act [FD&C Act] by adding section 524B: “Ensuring Cybersecurity of Devices.” This amendment became effective in March 2023 and requires the sponsor of a premarket submission for a cyber device to submit a plan for monitoring, identifying, and addressing any post-market cybersecurity vulnerabilities and exploits. Devices that do not meet the specified legal requirements will be deemed inadmissible and will not enter the market.Footnote ⁵⁷ The Government Accountability Office will be tasked with collecting and reporting challenges related to the adoption and implementation of regulatory requirements.

In the United States, the aforementioned legislative action took place at a time when the European Union was in the process of developing the Cyber Resilience Act. It appears that its provisions may be more stringent. The reason for this is because it would subject manufacturers introducing devices in the EU to a new set of criteria aimed at ensuring safer hardware and software. This includes establishing processes and actions to prioritise safety at every stage of the product life cycle.Footnote ⁵⁸

2. IoMT and product liability regulations

Apart from the previously mentioned acts that regulate medical devices and IoMT in state law, the regulatory landscape for the safety of IoMT users will also be shaped by product liability laws.

As Amodio points out,Footnote ⁵⁹ there is no federal law on product liability, various states have enacted regulations in this regard, and these regulations vary depending on the state and product category. Referring to the definition in the Third Restatement of Torts, Amodio identifies three categories of product liability: manufacturing defects, design defects, and inadequate instructions or warnings.

In general, three main theories of liability defined by common law include breach of warranty, negligence, and strict liability. Amodio suggests that product liability law could serve as a means to protect IoT consumers from physical damage caused by malicious hacking attacks. If a hacker successfully damages a user’s IoT device, the user should be able to file a complaint against the manufacturer and the installer. If the security of the breached system does not meet the reasonable cybersecurity standard outlined by the FTC (Federal Trade Commission), the user should be able to plead negligence, arguing that the lack of or low security was a defect in the device and the “but for” cause of their injury. Amodio acknowledges that while no security setup can prevent all hacking attempts, manufacturers may use the FTC’s reasonable cybersecurity standard as a guideline for securing the devices they manufacture. This standard of care would encourage manufacturers to take reasonable precautions and stay informed about the latest developments in security, ultimately protecting consumers in the long run. Additionally, making manufacturers entering the IoT space aware of the risks of liability would help ensure that the security of IoT products is taken seriously.Footnote ⁶⁰

In the context of IoMT devices, Bethany A. Corbin also expressed the belief that fitting traditional tort doctrine to the reality of IoMT is akin to fitting a square peg in a round hole.Footnote ⁶¹ One reason for such an assessment is the ambiguity regarding whether software is considered a product or a service. Products liability applies only to products, and in some U.S. states, software or code may be perceived as an intangible item. Due to the variability in products liability standards across the United States, there is a possibility that some jurisdictions may find strict products liability inapplicable to insecure code. Consequently, strict products liability may not offer a sufficient remedy for consumers despite the potential harm posed by insecure IoMT code.Footnote ⁶² Additionally, attention is drawn to the potential lack of clarity in assigning responsibility for the faulty operation of the device within the supply chain, as there is currently no clear delineation of responsibility in this chain. This issue is further compounded in the case of IoMT, which involves numerous manufacturers, developers, suppliers, programmers, and sellers.Footnote ⁶³