AI Act for Healthtech: Medical Devices, Health Data and Compliance

Most is, but not all. AI that is itself a product or safety component covered by MDR 2017/745 or IVDR 2017/746 and requires conformity assessment by a notified body is high-risk (Art. 6(1) + Annex I). AI under Annex III point 5(c) (life and health insurance) and 5(d) (emergency triage) is also high-risk. General wellness AI or non-diagnostic health apps may not be high-risk.

MDCG 2025-6 is a European Commission document on the interplay between the Medical Devices Regulation (MDR 2017/745), the In Vitro Diagnostics Regulation (IVDR 2017/746) and the AI Act. It sets out how to integrate conformity assessment obligations to avoid duplication when a medical device with AI must comply with both MDR/IVDR and the AI Act.

Health data are special categories (Art. 9(1) GDPR). Common legal bases are: explicit consent (Art. 9(2)(a)), processing necessary for healthcare purposes (Art. 9(2)(h)), or reasons of public interest in the area of public health (Art. 9(2)(i)). The choice depends on the context: direct healthcare, research, public health. The Spanish LOPDGDD additionally regulates health data in its arts. 7-11.

The DPIA (Art. 35 GDPR) is mandatory for high-risk processing, including large-scale processing of special categories of data (health, biometrics). In healthtech, almost any health data processing with AI requires a DPIA. It must document the risk analysis, mitigation measures and residual assessment. It is a prerequisite before starting the processing.

Art. 5(1)(f) of the AI Act prohibits AI systems inferring emotions in the workplace and educational institutions, with medical or safety exceptions. In healthcare contexts it may be permitted if it meets the requirements of the AI Act and the GDPR. Emotion recognition as a high-risk category is regulated under Annex III point 1(c) where not prohibited.

Maximum fines are: up to €35 million or 7% of global turnover for prohibited practices; up to €15 million or 3% for breach of high-risk obligations. For SMEs and startups, the lower absolute amount applies. In addition, breach of MDR/IVDR may generate additional fines under medical devices legislation.

The AEPD fined Marina Salud, S.A. €500,000 (2025) for unlawful sub-processor engagement under Art. 28 GDPR. Although not specifically an AI case, it illustrates the AEPD's active supervision in the healthcare sector. The AEPD has also published guides for healthcare professionals and for patients and users.

The AESIA supervises the AI Act. The AEMPS (Spanish Agency for Medicines and Medical Devices) supervises medical devices under MDR/IVDR. The AEPD supervises health data processing under the GDPR. In medical AI cases, all three authorities may intervene simultaneously. At European level, the European AI Office coordinates AI Act enforcement.