Health & Medical Devices

Healthcare is going digital, through electronic health records, telemedicine, health apps, connected devices and AI-supported diagnostics. All of this runs on data that EU law protects more strictly than almost any other. It also runs on systems that are an increasingly attractive target for cyberattacks.

The sector is governed by a dense set of EU rules, both sector-specific and horizontal:

• Medical Device Regulation (EU) 2017/745 and In Vitro Diagnostic Medical Device Regulation (EU) 2017/746: safety, performance and cybersecurity requirements for devices and medical software, which replaced the previous medical device directives
• European Health Data Space Regulation (EU) 2025/327: patients' rights over their electronic health data, requirements for EHR systems, and a framework for the secondary use of health data in research and innovation
• Clinical Trials Regulation (EU) 536/2014: rules for clinical research, alongside the rules on clinical investigations under the MDR
• GDPR: strict conditions for processing health and genetic data
• Data Act, NIS2 and the Cyber Resilience Act: access to data from connected products, cybersecurity obligations for healthcare providers and manufacturers, and security by design for connected products outside the MDR
• AI Act: high-risk classification for many AI-based medical devices
• Machinery Regulation (EU) 2023/1230 and the new Product Liability Directive (EU) 2024/2853: safety requirements for devices that are also machinery, and liability rules that now expressly cover software and AI

We advise healthcare providers, health software companies and medical device manufacturers on privacy, digital data and cybersecurity. Our work covers product design, market launch and day-to-day operations. We work alongside your technical, clinical and regulatory affairs teams, so that legal requirements are built into the product rather than added at the end.

How we can help

• MDR and IVDR: qualification and classification of medical software, cybersecurity and data requirements in the technical documentation, post-market surveillance and vigilance, and legacy devices during the transition from the old directives
• European Health Data Space: readiness assessments covering patient access rights, requirements for EHR systems and the rules on secondary use of health data
• Health data protection: legal bases for processing health data, patient information, telemedicine, DPIAs, data processing agreements and DPO services for healthcare organizations
• Clinical research: data protection and data governance in clinical trials and clinical investigations, and reuse of health data for research
• NIS2 compliance: scope assessments for hospitals, healthcare providers and manufacturers, risk management measures, incident reporting and management body responsibilities
• Cyber Resilience Act: security-by-design obligations, vulnerability handling and reporting for connected health and wellness products not covered by the MDR
• Data Act for connected devices: user access to device data, data sharing with third parties and protection of trade secrets
• AI in healthcare: AI Act obligations for high-risk AI medical devices, aligned with MDR conformity assessment and GDPR requirements
• Product safety and liability: Machinery Regulation requirements for devices that are also machinery, the General Product Safety Regulation for non-medical health products, and exposure under the new Product Liability Directive

One product, many rules

A connected medical device or a health app can fall under the MDR, the GDPR, the Data Act, NIS2 and the AI Act all at once. For non-medical products, the Cyber Resilience Act and general product safety rules take the place of the MDR. Each regime comes with its own documentation, authorities and deadlines. Handling them separately leads to duplicated work and, worse, to gaps.

We map the rules that apply to your product or organization and build a single compliance framework around them. That means shared risk assessments and a technical documentation that serves several regimes. It also means one incident response procedure that meets both vigilance and cybersecurity notification deadlines. Several of these rules are still phasing in, so we also help you plan ahead and prioritize what needs to be in place first.

Our approach

We start from the clinical and technical reality of your product, not from a checklist of regulations. In healthcare, privacy and cybersecurity are part of product quality and patient safety. We treat them that way, with documentation that stands up to notified bodies, supervisory authorities and hospital procurement teams.