CE marking for AI diagnostic support

Does AI for diagnostic support need CE marking?

Yes, if it is placed on the market in the EU. Software that provides information for diagnostic or therapeutic decisions about individual patients is a medical device under Art. 2(1) MDR. Guidance MDCG 2019-11 explicitly names decision support as an example: software that combines medical knowledge with patient data and gives recommendations for diagnosis, prognosis, monitoring or treatment. This applies regardless of whether a doctor checks the result.

Exempt are in-house devices that a hospital uses only itself: under the conditions of Art. 5(5) MDR they need no CE marking (Own AI apps and the medical device trap).

Which class does AI diagnostic software fall into?

Rule 11 in Annex VIII of the MDR classifies software by the possible consequence of a wrong decision:

Consequence of a decision based on wrong information	Class	Example
no serious deterioration	IIa	Notice of a possible interaction, to be checked
serious deterioration or surgical intervention	IIb	Suggestion to adjust therapy
death or irreversible deterioration	III	Software for cancer diagnosis (example from MDCG 2019-11)
monitoring of physiological processes	IIa; IIb for vital parameters where there is immediate danger	Analysis of monitor data

The class follows from the manufacturer’s intended purpose, not from the technology.

How does CE marking work?

1. Define the intended purpose: what the software does, for which patient group, for which professionals. MDCG 2019-11 stresses that it must describe every medical function clearly.
2. Classify under Rule 11.
3. Set up a quality management system (Art. 10(9) MDR), in practice usually to ISO 13485, with a person responsible for regulatory compliance (Art. 15).
4. Technical documentation under Annexes II and III; for software including life cycle, risk management, verification, validation and IT security (Annex I, Section 17).
5. Clinical evaluation: proof of safety, performance and clinical benefit; MDCG 2020-1 describes this for software.
6. Conformity assessment by a notified body (Art. 52, usually under Annex IX): audit of quality management and technical documentation.
7. EU declaration of conformity (Art. 19), CE marking with the notified body’s identification number (Art. 20), unique device identification (UDI) and registration in the European database EUDAMED.
8. After placing on the market: surveillance, periodic safety update reports, reporting of serious incidents.

For learning systems, every significant change to the model or intended purpose must be assessed again.

What does the AI Act add?

A medical device that has to be assessed by a notified body is, as an AI system, a high-risk system (Art. 6(1) with Annex I of the AI Act). Following the amendment by Regulation (EU) 2026/1744, the obligations for these apply from 2 August 2028 (previously planned: August 2027). They add requirements for:

• risk management and quality of training, validation and test data (Art. 9 and 10),
• technical documentation and automatic logging (Art. 11 and 12),
• transparency towards deployers and human oversight (Art. 13 and 14),
• accuracy, robustness and cybersecurity (Art. 15).

This is assessed in the MDR conformity procedure, by the notified body (Art. 43(3)). Guidance MDCG 2025-6 explains how manufacturers combine both sets of rules in one quality management system and one set of documentation.

What may still change: In December 2025 the European Commission proposed a revision of the MDR (COM(2025) 1023). Under it, medical devices with AI would no longer be subject to most provisions of the AI Act; the requirements would come via the MDR instead. In July 2026 the deliberations were still ongoing, and the German Medical Association had issued a statement.

What should hospitals check when buying?

Question for the provider	Why
What is the intended purpose?	The product is assessed only for that.
Which class, which notified body, valid until when?	From Class IIa, a notified body must be named.
Is the EU declaration of conformity available?	Basis of the CE marking
For which patient groups is performance proven?	Results apply only to the group assessed.
Which hardware, IT environment and security measures does the product require?	Minimum requirements under Annex I, Section 17
How are model updates assessed and communicated?	Significant changes need a new assessment.

In operation: use the product only within its intended purpose and train the staff who work with it.

How does this work with basebox?

basebox is not a medical device and therefore does not need ISO 13485; it is a platform for general tasks such as drafting letters or searching guidelines. If your organisation uses basebox to build its own application with a medical intended purpose and connects models from basebox to it, your organisation is the manufacturer. For your technical documentation, basebox provides a supplier’s information: model register with version and licence, software bill of materials and ISO 27001 certificate. Background: Is an AI platform a medical device?

Not legal advice: Class and procedure depend on the intended purpose in each case. The AI Act deadlines were changed in 2026, and a revision of the MDR is under discussion. Check the current status before making decisions. Research as of 11 October 2026.