Two Laws, One Product

Most conversations I have about AI in hospitals start with the same question: "Is this allowed?" The honest answer is usually "under which law?"

Clinical AI in Europe sits under two separate pieces of legislation that were written by different people, for different reasons, on different timelines. The Medical Device Regulation (MDR) has applied for years. The EU AI Act is being phased in now. For a growing number of products, both apply at the same time.

That matters for two groups. Hospitals are buying and using these tools, and they carry obligations of their own. Medical device and AI vendors have to get through two sets of requirements before a European hospital can sign a contract with them.

In March I wrote about how AI is starting to change rare disease care. This piece is the regulatory side of that story.

MDR: Is This Safe as a Medical Product?

The MDR does not care whether software uses AI. It cares about what the software claims to do.

Once software makes a medical claim, it is usually a medical device. "Helps the physician diagnose." "Finds patients with disease X." "Proposes a score that guides treatment." Each of those sentences puts you in scope.

From class IIa upwards, a notified body has to review the product. In practice that means:

  • a quality management system, typically certified to ISO 13485
  • full technical documentation
  • a clinical evaluation showing the software does what it claims, safely

Expect 12 to 24 months and serious cost. Most decision-support software lands in class IIa or higher, so this is the normal route, not the exception.

There is one grey zone worth knowing. A pure scribe tool that only records and structures what the doctor says can sometimes stay outside the MDR. As soon as it advises, flags or influences a diagnosis, you are in.

My practitioner view: many teams find this out too late. The line between "documentation tool" and "medical device" is usually crossed by a product roadmap feature, not by a deliberate decision.

The AI Act: Is This AI System Reliable and Under Control?

The AI Act regulates AI systems themselves, whatever sector they are in. It sorts them into risk classes, from banned practices to minimal risk.

The timeline is staggered, and from where we stand in June 2026 it looks like this:

  • Already in force: the bans on prohibited AI practices and the AI literacy obligation. Organisations using AI, including hospitals, are expected to make sure their staff understand the tools they work with.
  • From 2 August 2026: further obligations start to apply, including transparency rules (people must know when they are interacting with an AI system) and the supervision and oversight framework.
  • From December 2027: requirements for standalone high-risk AI systems listed in Annex III of the Act.
  • From 2 August 2028: the heavy high-risk requirements for AI built into regulated products such as medical devices. This date has moved back under the EU's Digital Omnibus package.
  • By January 2028: notified bodies need to be designated to assess AI Act conformity as well.

An AI system that is a medical device needing notified-body review under the MDR is, in general, treated as high-risk under the AI Act. So the same product picks up a second set of requirements: data governance, risk management, logging, transparency to the user, accuracy and robustness, and human oversight.

Why Clinical AI Usually Needs Both

The simplest way I can put it:

  • MDR asks: is this safe and effective as a medical product?
  • AI Act asks: is this AI system reliable, explainable and under meaningful human control?

They overlap, and the EU intends assessments to be combined where possible. But they are not the same question, and a dossier written for one does not automatically answer the other.

There is also a capacity problem. The same notified bodies that are already stretched by MDR certification will need AI Act designation, and they will face a wave of AI dossiers at the same time. Too few assessors, too many files. My view: vendors who wait until 2028 to start will be queuing.

Where It Pinches in Europe Now

The pressure is not evenly spread. This is my reading of the market, not an official ranking.

Germany, the Netherlands and the Nordics are furthest ahead. There is a lot of AI already running in hospitals, data rules are strict and supervisors are active. Hospital procurement teams there already ask hard questions about certification and data handling.

The UK has its own rules after Brexit, but NHS tenders still expect CE/MDR-like evidence. A product that cannot show that level of evidence struggles there too.

France and the DACH region are building fast. Large hospital groups such as AP-HP and a strong cluster of scribe, imaging-AI and hospital-software companies are scaling, and they are setting the bar for what "ready for hospitals" looks like.

Belgium is following. Belgian hospital IT platforms are adding AI layers, and international dictation and scribe tools are available here. What I see less of is local, visible AI-governance expertise: people who can sit between the hospital, the vendor and the regulation and translate.

Practical Checklist for Hospitals (2026–2028)

Hospitals are not only buyers. Under the AI Act they are deployers, with obligations of their own. Several apply already.

  1. Build an AI inventory. Which AI tools are in use, in which departments, from which vendor, doing what? Include the "small" ones: dictation, triage, scheduling, image pre-reads.
  2. Organise AI literacy. Staff who use AI tools need to understand what the tool does, where it fails and when to override it. Document what you did.
  3. Classify each tool. Is it making a medical claim? Is it CE-marked under the MDR, and in which class? If a "documentation" tool is quietly giving clinical advice, that is a problem for the vendor and for you.
  4. Ask vendors for transparency now. Intended purpose, training data, known limitations, performance in populations like yours, and their AI Act roadmap.
  5. Define human oversight. Who reviews the output, who can override it and how incidents are reported.
  6. Write it into procurement. Make MDR status and AI Act readiness tender criteria, not a footnote.

Practical Checklist for Medtech and AI Vendors

  1. Fix your intended purpose early. Every marketing sentence about diagnosis, patient finding or treatment scoring is a regulatory decision. Write the claim you can support, not the one that sounds best.
  2. Map MDR class and AI Act risk together. One gap analysis, two frameworks.
  3. Build one quality system that serves both. ISO 13485 plus the AI Act's data, logging and oversight requirements.
  4. Plan clinical evidence for European buyers. Performance in the populations and care pathways of the hospitals you want to sell to, not only the training site.
  5. Book notified-body capacity early. The bottleneck toward 2028 is predictable.
  6. Prepare a hospital-ready transparency pack. Procurement and IT security teams in Germany, the Netherlands and the Nordics already ask for it. Belgium will follow.

The Rare Disease Angle: Patient Finding and US Tools

This is where the regulation meets my own field directly.

AI that searches hospital records for patients who may have an undiagnosed rare disease is one of the most promising uses of clinical AI. I wrote about one research example in DeepRare: from paper to diagnosis. But a tool that says "this patient may have disease X, consider testing" is making a diagnostic claim. Under the MDR, that is very likely a medical device, and under the AI Act very likely high-risk.

The same applies to US diagnostic and decision-support tools coming to Europe. A product that is established in American hospitals can still meet a long road here: MDR certification, a clinical evaluation that fits European practice, and AI Act requirements on top.

My honest view: if you are building such a product yourself, this is painful. It costs time, money and focus. If you are helping a vendor through it, or a pharma company is funding the path because finding undiagnosed patients matters for its therapy, then that pain is exactly the work that needs doing. And it needs doing well, because patient-finding programmes touch sensitive data and hospital trust.

How RareGenetics Helps

I am not a notified body and not a regulatory law firm. I work alongside them. My role is the commercial and launch side: making sure a clinical AI product, or a rare disease programme that relies on one, actually reaches the right hospitals and patients in Europe.

For medtech and AI vendors entering Europe:

  • Hospital-buyer readiness: what procurement, clinicians and IT in Benelux and neighbouring markets will ask, and how to answer it
  • Positioning your intended purpose so the commercial story and the regulatory claim match
  • Go-to-market planning around realistic MDR and AI Act timelines, including a European entry for US tools
  • Introductions to expert centres and rare disease networks where the evidence needs to be built

For pharma and biotech with an orphan product:

For hospitals:

  • A practical view on which AI tools touch diagnosis and what to ask vendors, from someone who has sat on the commercial side of the table

The certification wave for medical AI is coming toward 2028, and the bottlenecks are already visible. The organisations that start mapping their products and partners now will have the choice of when they go through. If you want to talk through where your product or programme sits, contact me at tom.meuleman@raregenetics.be.