This collection follows the regulatory questions surrounding medical software, from classification and clinical evidence to post-market surveillance and cybersecurity. It also examines AI-enabled devices, digital therapeutics, health data and the flexibility Swiss law offers digital health without a statutory sandbox.
These articles provide general information and are not legal advice.
The classification of software as a medical device under EU MDR creates regulatory exposure developers discover post-launch. Marketing claims often inadvertently determine regulatory status.
Under the EU MDR, clinical evidence for software as a medical device rests on valid clinical association, analytical and clinical validation, a burden many software makers underestimate.
Software as a medical device (SaMD) can lose accuracy on a new scanner or patient group, or change with an update, without any visible injury. Post-market surveillance under the MDR and the Swiss medical devices ordinance (MepV) must detect that, and the AI Act adds monitoring for high-risk AI devices.
The MDR requires security to be built into software as a medical device (SaMD) and maintained for its life, and notified bodies treat the international standard IEC 81001-5-1 as the state of the art. A security patch can itself need notified-body review, and one incident can start five reporting clocks.
AI-enabled medical software that needs a notified body under the MDR is high-risk through the product route in Annex I AI Act rather than Annex III AI Act, so its obligations attach in 2027 and are assessed within MDR conformity assessment.
An AI-enabled device sold from Switzerland into the EU answers to two cybersecurity regimes that measure different things: the MDR secures the device in its IT environment, the AI Act the model against manipulation. Switzerland adds a 24-hour reporting clock.
For AI devices that need a notified body, the AI Act adds high-risk duties to the MDR, and the Swiss medical devices ordinance (MepV) has no AI-specific provisions. The FDA allows changes pre-specified in an authorized change control plan, but no framework yet admits continuous learning.
Germany's Digital Act rewrote § 134 of the health insurance code (SGB V) so that from 2026 at least 20 percent of the negotiated price of a digital health application (DiGA) turns on measured outcomes, and the directory of the regulator BfArM now admits class IIb software on stricter evidence terms.
Switzerland has no statutory sandbox for digital health. Derogations, clinical investigations, and regulator dialogue give limited flexibility for market entry.
The Swiss data protection act (DSG) attaches to the data category, not the entity holding it. A US health-SaaS or digital-therapeutics vendor mapped for HIPAA and the GDPR may still have to designate a Swiss representative, and the DSG's criminal fines fall on named individuals.
For advice on a particular matter, please get in touch.
Make an enquiry