Why combine MDR/IVDR, the AI Act and data protection into one mandate?

Because a single digital-health product usually triggers all three at once. A software-as-a-medical-device tool is regulated as a device under the MDR or the IVDR, is high-risk under Art. 6(1) of the EU AI Act where it is a medical-device product requiring third-party conformity assessment, and processes health data that is sensitive under the DSG. Coordinating the work helps keep the device file, AI conformity material and data-protection record consistent and avoids duplicate or conflicting documentation.

Is AI/ML diagnostic or decision-support software high-risk under the EU AI Act?

Generally yes, where it is a medical device. An AI system that is itself a medical device, or a safety component of one, and that must undergo third-party conformity assessment under the Union harmonization legislation in Annex I AI Act, is high-risk under Art. 6(1) of the AI Act. Most AI/ML diagnostic imaging and clinical-decision-support software falls into a conformity-assessed class under the MDR or the IVDR, so it is dual-regulated: the AI Act's high-risk obligations apply on top of device conformity assessment. The detailed AI Act analysis is set out on the EU AI Act service page.

How is health data handled for a telemedicine or digital-therapeutics platform?

Health data is sensitive personal data under Art. 5 DSG, which raises the bar for lawful processing, security and transparency, and a platform operated from outside Switzerland may also need a Swiss data-protection representative. Where the product feeds clinical research with health-related personal data, the HFG can apply as well (Art. 2 HFG). The mandate maps which regime governs which data flow and draws on GAWEL Legal's health and research data and Swiss data-protection representative services for the detailed work.

How does this integrated service relate to the separate component services?

This service coordinates the work described on the individual service pages. MDR/IVDR device work, the EU AI Act analysis, health-research and clinical-data law, and the Swiss data-protection representative function each have a dedicated service page with the detailed obligations and legal references. A digital-health engagement draws on whichever components a given product needs and keeps them aligned under one timeline and one set of documentation.

Digital health compliance

GAWEL Legal provides coordinated compliance advice for SaMD and AI diagnostics across the MDR, IVDR, EU AI Act and DSG, on a retainer. The mandate spans digital therapeutics, AI/ML diagnostic and decision-support tools and cross-border telemedicine, keeping device, AI and data documentation consistent, and GAWEL Legal's service for each regime covers the detailed work.

Discuss a digital-health product View scope

One product, related obligations

Device: MDR and IVDR
Artificial intelligence: EU AI Act
Health data: DSG and research-data rules

Coordinated documentation across the applicable regimes

Who this is for

Digital-therapeutics makers placing software as a medical device on the EU or Swiss market
AI/ML diagnostic-imaging and clinical-decision-support providers regulated as both device and high-risk AI
Cross-border telemedicine platforms operating into Germany, Austria and Switzerland and handling health data

Scope

GAWEL Legal identifies which regimes apply to the product and coordinates the advice, timetable and documentation. The individual service pages describe the work under each regime and the relevant legal provisions.

Applicable rules:
one assessment of which regimes each digital-health product triggers across its lifecycle, so device, AI and data obligations are considered together
Medical-device pathway (MDR/IVDR):
software-as-a-medical-device classification, conformity-assessment route and technical-documentation strategy under the EU device regulations, with the detail handled by GAWEL Legal's MDR and IVDR compliance service
AI Act requirements:
high-risk classification for medical-device AI under Art. 6(1) AI Act and how the AI Act's high-risk requirements sit alongside device conformity assessment, with the full analysis on the EU AI Act compliance service
Health-data governance:
lawful processing, security and transparency for health data, which is sensitive personal data under Art. 5 DSG, plus the clinical-research overlay where the HFG applies (Art. 2 HFG), via GAWEL Legal's health and research data service
Cross-border representation:
where a platform is operated from outside Switzerland, the Swiss data-protection representative function for the local-presence requirement under the DSG
Coordinated documentation:
the legal content of the device file, the AI conformity material and the data-protection record, kept aligned, with major legal deliverables priced as fixed-fee modules

How the work proceeds

Scoping The initial review maps the product and identifies which regimes (device, AI, data) it triggers across its lifecycle.
Integration plan A common timeline is set and each obligation is assigned to the relevant part of the work.
Gap assessment Current documentation and governance are compared against the combined obligations.
Build The legal documentation for the device, AI and data regimes is prepared as fixed-fee modules and kept consistent.
Ongoing advisory The retainer covers change management and post-market monitoring across all three regimes.

Fees

Monthly retainer

One integrated mandate; major legal deliverables as fixed-fee modules

Questions

Why combine MDR/IVDR, the AI Act and data protection into one mandate?: Because a single digital-health product usually triggers all three at once. A software-as-a-medical-device tool is regulated as a device under the MDR or the IVDR, is high-risk under Art. 6(1) of the EU AI Act where it is a medical-device product requiring third-party conformity assessment, and processes health data that is sensitive under the DSG. Coordinating the work helps keep the device file, AI conformity material and data-protection record consistent and avoids duplicate or conflicting documentation.
Is AI/ML diagnostic or decision-support software high-risk under the EU AI Act?: Generally yes, where it is a medical device. An AI system that is itself a medical device, or a safety component of one, and that must undergo third-party conformity assessment under the Union harmonization legislation in Annex I AI Act, is high-risk under Art. 6(1) of the AI Act. Most AI/ML diagnostic imaging and clinical-decision-support software falls into a conformity-assessed class under the MDR or the IVDR, so it is dual-regulated: the AI Act's high-risk obligations apply on top of device conformity assessment. The detailed AI Act analysis is set out on the EU AI Act service page.
How is health data handled for a telemedicine or digital-therapeutics platform?: Health data is sensitive personal data under Art. 5 DSG, which raises the bar for lawful processing, security and transparency, and a platform operated from outside Switzerland may also need a Swiss data-protection representative. Where the product feeds clinical research with health-related personal data, the HFG can apply as well (Art. 2 HFG). The mandate maps which regime governs which data flow and draws on GAWEL Legal's health and research data and Swiss data-protection representative services for the detailed work.
How does this integrated service relate to the separate component services?: This service coordinates the work described on the individual service pages. MDR/IVDR device work, the EU AI Act analysis, health-research and clinical-data law, and the Swiss data-protection representative function each have a dedicated service page with the detailed obligations and legal references. A digital-health engagement draws on whichever components a given product needs and keeps them aligned under one timeline and one set of documentation.

Discuss your matter

Briefly describe the matter and the legal advice you need.

Discuss a digital-health mandate