Own AI apps and the medical device trap (Article 5(5) MDR)

When does an app you build yourself become a medical device?

When it has a medical intended purpose. Under Article 2(1) MDR, software is also a medical device if it serves, among other things, the diagnosis, prevention, monitoring, prediction, prognosis or treatment of disease. The guidance MDCG 2019-11 specifies that the software must process data beyond storage, archiving, communication and simple search, and do so for the benefit of individual patients. Whether an error would be dangerous plays no role in the classification; what matters is the purpose.

On an AI platform, an app is made from an instruction, documents and connections to systems. The intended purpose therefore lies mainly in the instruction and in what the organisation shares the app for:

App	Purpose	Classification (as a rule)
Draft a discharge letter from bullet points	Word text, doctor reviews	not a medical device
Search a clinical guideline and cite it with source	general information, not patient-specific	not a medical device
Summarise a patient’s findings	documentation, no assessment	as a rule not a medical device
Suggest differential diagnoses from findings	decision support for one patient	medical device, at least class IIa under Rule 11
Adjust a dose to kidney values	treatment decision for one patient	medical device

The line does not run between platform and app, but between apps. An organisation can have both on the same platform.

Who is the manufacturer then?

The organisation that builds and uses the app with a medical intended purpose. The platform provider does not become the manufacturer as a result, just as a server does not become a medical device because diagnostic software runs on it. For the organisation, this means: it must either follow the full path of a manufacturer, with conformity assessment and CE marking (CE marking for AI diagnostic support), or use the health institution exemption.

What does Article 5(5) MDR require?

For devices that are manufactured and used exclusively within a health institution in the EU, only the general safety and performance requirements in Annex I apply, not the rest of the MDR. In return, all conditions must be met:

• No transfer: not to another legally separate institution (point a).
• Quality management: manufacture and use under an appropriate system (b).
• Justification: documented reasons why no equivalent product on the market meets the needs of the patient group at the required level of performance (c).
• Information: information for the authority on request (d).
• Public declaration: name and address of the institution, details of the device and a declaration on Annex I; requirements not met, with reasons (e). MDCG 2023-1 contains a template for this.
• Documentation: design, manufacture and performance data including intended purpose (f), manufacture in accordance with this documentation (g).
• Review experience: review clinical experience and take corrective action (h).

The exemption does not apply to manufacture on an industrial scale. Member states may restrict and monitor in-house manufacture.

Where does the exemption end?

The guidance MDCG 2023-1 names limits that AI apps reach quickly:

• Hospital group: If the hospitals belong to different companies, each is a separate legal entity. An app for all hospitals then does not fall under the exemption.
• Patient apps: Applications that patients use outside the institution are excluded.
• Equivalent product on the market: If there is a CE-marked product with the same level of performance, the justification no longer holds. The organisation should therefore monitor the market continuously.
• Economic reasons only: In-house manufacture that is only meant to save money and has no clinical reason is not covered by the exemption.
• Purpose changed: If an institution gives a CE-marked product a new purpose, Article 5(5) also applies to that purpose.

What do the AI Act and product liability add?

• AI Act: A medical device that requires assessment by a notified body is a high-risk system when it is an AI system (Article 6(1) with Annex I). Following the amendment by Regulation (EU) 2026/1744, the obligations for this apply from 2 August 2028. Article 6(1) is linked to the product having to undergo third-party conformity assessment; with in-house manufacture under Article 5(5) MDR, this does not happen. Whether in-house products therefore fall outside the high-risk classification has not been conclusively settled. As a precaution, plan for the requirements on data, logging and human oversight.
• Product liability: The new Product Liability Directive (EU) 2024/2853 covers software and applies to products placed on the market or put into service after 9 December 2026. Anyone who develops a product for their own use also counts as a manufacturer.

How does an organisation keep control of its apps?

• Define the purpose: For every app that is shared, briefly record what it is meant for and what it is not meant for.
• Control sharing: Share apps that relate to patients with groups only after review by the medical device officer or quality management.
• Check instructions: Wording such as “suggest the treatment” or “assess the risk” signals a medical intended purpose.
• Result as a draft: The professional checks against the source and decides.

How does this work with basebox?

basebox is not a medical device, but a platform for general tasks such as drafting letters or searching clinical guidelines. You build apps from an instruction, documents and connections; whoever builds an app shares it with groups or people, to use or to edit. Your staff can only use what your administrator has enabled. Every answer shows its sources with the quoted passage, the model and version are documented, and the audit log records who used which app.

If your organisation uses basebox to build an application with a medical intended purpose itself, your organisation is its manufacturer. For your technical documentation, basebox provides the information of a supplier: a model register with version and licence, a software bill of materials and the ISO 27001 certificate. Basics on the platform: Is an AI platform a medical device?

Not legal advice: Whether an app is a medical device depends on its intended purpose in the individual case. MDCG guidance is not binding. The AI Act deadlines were changed in 2026 and may change again; the German transposition of the Product Liability Directive had not yet been promulgated on 11 October 2026. Research as of 11 October 2026.