Is an AI platform a medical device?

What decides whether AI is a medical device?

Its intended purpose. Art. 2(1) of the Medical Device Regulation (MDR) expressly names software: it is a medical device if the manufacturer intends it for, among other things, the diagnosis, prevention, monitoring, prediction, prognosis or treatment of disease. The MDCG 2019-11 guidance (revised in June 2025) clarifies two points: the software must process data beyond storage, archiving, communication and simple search, and it must do so for the benefit of individual patients. Software for general purposes is not a medical device, even if it runs in a hospital.

Task	Classification (as a rule)
Draft a doctor’s letter, the doctor reviews and signs it	not a medical device
Search a guideline	not a medical device
Summarise a study	not a medical device
Duty roster, minutes, citizen’s enquiry	not a medical device
Diagnostic suggestion for a patient	can be a medical device
Dose calculation, treatment recommendation for a patient	can be a medical device

The boundary is fluid: a draft doctor’s letter becomes a problem if the application adds its own diagnoses or treatment recommendations. Details in the guide When does an AI discharge letter generator become a medical device?.

Which class does medical AI fall into?

Software with a medical intended purpose is classified under Rule 11 in Annex VIII of the MDR. If it provides information used to take decisions on diagnosis or treatment, it is at least Class IIa; if a wrong decision could cause a serious deterioration of health, Class IIb; if it could cause death or an irreversible deterioration, Class III. Software for monitoring physiological processes is Class IIa, or IIb for vital parameters. All other software is Class I.

From Class IIa upwards, a notified body assesses the product before it bears the CE marking. Medical AI applications therefore usually end up there. More on this in the guide CE marking for AI in diagnostics.

Is an AI platform a medical device, then?

No, as long as its manufacturer does not give it a medical intended purpose. A comparison: the server of a hospital information system is not a medical device. Diagnostic software running on it can be one. It is the same with AI. The platform provides chat, apps and connections to systems; whether an individual app has a medical intended purpose is decided by the app.

What applies under the EU AI Act?

The AI Act builds on the MDR, not the other way round. Under Art. 6(1) together with Annex I, an AI system is high-risk if it is itself a medical device or a safety component of one and the product must be assessed by a notified body. The joint guidance MDCG 2025-6 from the Medical Device Coordination Group and the AI Board confirms: the class under the MDR decides. A Class I AI application without a notified body is therefore not a high-risk system under Art. 6(1).

Following the amendment by Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force since 27 July 2026), the obligations for this high-risk AI apply from 2 August 2028. An AI platform without a medical intended purpose is not covered. For everyone who uses AI at work, the AI literacy obligation under Art. 4 already applies today. Overview in the guide EU AI Act for hospitals.

What is changing right now?

On 16 December 2025, the European Commission proposed simplifying the MDR and IVDR (COM(2025) 1023). Among other things, the proposal provides for lower classes for certain products, including software, relaxes the conditions for in-house manufacturing, and would move the MDR and IVDR in Annex I of the AI Act from Section A to Section B. Only selected provisions of the AI Act would then apply to AI in medical devices. As of 11 October 2026, Parliament and Council are still negotiating; the MDR applies in its current version.

What does ISO 13485 govern?

The quality management of medical device manufacturers. The standard certifies an organisation, not an AI product. Anyone who does not manufacture a medical device does not need it.

What applies to the platform?

Information security. On a server at your site, your requirements as the operator apply, such as the B3S Krankenhaus (the industry-specific security standard for German hospitals) or your ISMS under BSI IT-Grundschutz. In Germany, § 393 SGB V (Social Code, Book V) requires a C5 attestation or equivalent proof for health data in the cloud.

And if we build a medical application ourselves?

Then the MDR applies to this application, and your organisation is its manufacturer. Without CE marking, this is only possible under the exemption for health institutions in Art. 5(5) MDR: manufacture and use only within the same institution, a quality management system, a justification of why no equivalent product on the market is sufficient, and a public declaration. Details in the guide Own AI apps and the medical device trap.

How does this work with basebox?

basebox is not a medical device and therefore does not need ISO 13485. basebox is a platform for general tasks such as drafting letters or searching guidelines. For tasks involving patient data, basebox delivers drafts and summaries with sources, not diagnoses or treatment suggestions; every result is reviewed by the doctor or the nurse.

• Information security: basebox is certified to ISO 27001. The C5 Type 1 attestation for the cloud is in progress; until then, for the cloud on our servers, basebox provides proof under § 393(4) SGB V through ISO 27001 with an action plan under the C5 Equivalence Ordinance (C5GleichwV).
• Server at your site: basebox supplies the documentation for your ISMS and the B3S; a cross-reference to the B3S requirements is available on request.
• Your own medical device: If you build a medical device yourself and use AI models in basebox through it, you are the manufacturer. For your technical documentation, basebox provides the information of a supplier: model register with version and licence, software bill of materials and ISO 27001 certificate.

Proof and documents are available under Security.

Not legal advice: Whether an application is a medical device depends on its intended purpose in the individual case. Have your own medical applications reviewed from a regulatory perspective, for example by your legal department or a notified body. Legal position as of 11 October 2026.