Over the last decade, the number of connected-to-network medical devices has grown significantly, which is leading to their increased exposure to cyber incidents and attacks. Medical devices’ cybersecurity is of utmost relevance all over the world. The EU legal framework here is heavily characterized by fragmentation and a lack of regulatory guidance. Moreover, legal literature on the topic is scarce, mainly because the regulation of cybersecurity and medical devices is a relatively novel subject. This chapter analyzes the applicable legal framework for cybersecurity of medical devices in the EU and pinpoints the main ethical concerns as well as the relevant regulatory challenges. The chapter introduces the key ethical concerns (i.e., harm to users’ privacy, confidentiality and integrity risks, misuse of personal and health data) and critically assesses the EU legislation regarding medical devices’ cybersecurity (such as the new EU medical devices Regulation, GDPR, NIS Directive, the Cybersecurity Act) respectively applicable to different stakeholders having different obligations. Recommendations on possible ways the stakeholders may approach medical devices’ cybersecurity are drafted with the special attention given to pre/postmarket obligations for manufacturers, the notion of data controllership, requirements applicable to operators of essential services, and the certification schemes relevant for the sector.