What rules apply to AI in healthcare?

AI that diagnoses, monitors or treats patients is usually a medical device under the EU Medical Device Regulation (or the UK's medical device rules), and when it needs a notified body under that regulation it is also high-risk under the EU AI Act (Annex I). Health data is special-category personal data under GDPR, and in the US, HIPAA governs protected health information.

How it works

1. Check whether the software is a medical device and which class it falls in.
2. Where it is, follow medical device conformity assessment plus the AI Act high-risk requirements.
3. Protect patient data under GDPR or HIPAA.
4. Keep sealed records of model versions, decisions and clinician overrides.