Regulation and ethics

Medical device, AI Act, GDPR: three overlapping regimes. What they mean in practice — for a patient, a clinician, a developer.

In the European Union an AI tool for health is not judged by a single law. The Medical Devices Regulation (EU) 2017/745 defines what a medical device is and how safety and performance are demonstrated. The Artificial Intelligence Act (EU) 2024/1689, adopted in 2024, adds horizontal requirements for systems classed as high-risk. The General Data Protection Regulation (EU) 2016/679 applies to any processing of health data, whatever the technology.

The AI Act applies in stages, with deadlines running to 2027, and its overlap with medical device law is exactly where most questions arise. For a reader, the practical consequence is simpler: “medical device” is a checkable claim, not a marketing adjective.

Beyond compliance there remain ethical questions no regulation closes: who is accountable when the model errs, what informed consent looks like in a software-assisted consultation, and what happens to the parts of the population that appear rarely in training data. This section gathers the material that helps with those questions.

  • “Medical device” is a legal status, checkable with the competent authority in your country — not a quality label.
  • You have the right to know when an automated system contributes to a decision about your health.
  • Human oversight has to be real, not a signature on a generated report.
  • Post-market monitoring is where most promises break: performance shifts when scanners, protocols and staff shift.

Reading

Information for understanding and orientation. It does not replace medical care. In an emergency, call 112.