Healthcare and medical devices

Hospitals, clinics and healthtech companies use AI to diagnose, triage patients and draft clinical records using health data, which is sensitive data everywhere. Errors can harm patients, so healthcare is high-risk in the EU and Peru, clinical software may be a medical device, and regulators such as Brazil's CFM and Colombia's Ministry of Health already require validation and medical oversight.

Relevant sector rules

EU: AI medical devices fall under Annex I of the AI Act from Aug 2, 2028, integrated into the MDR/IVDR technical file (MDCG 2025-6 guidance); emergency triage and eligibility for healthcare benefits are Annex III high-risk from Dec 2, 2027; the European Health Data Space applies from March 2027. Spain: GDPR for health data and AEMPS for medical devices. Peru: health is a priority sector and the AI regulation deadline passed on Sep 10, 2026. Colombia: Telemedicine Resolution 1644/2026 (from Sep 7, 2026) requires prior notice to patients, technical and clinical validation, traceability and INVIMA registration if the software is a device. Brazil: CFM Resolution 2,454/2026 (from Aug 26, 2026) requires risk classification, continuous auditing and medical oversight committees; ANVISA regulates software as a medical device (RDC 657/2022). Mexico, Chile, Argentina and Ecuador: sanitary registration for software that qualifies as a medical device, plus sensitive-data rules. US: the FDA regulates AI-enabled device software; the Section 1557 rule (45 CFR 92.210) requires identifying and mitigating discrimination risk in patient care decision support tools; Texas TRAIGA requires healthcare providers to disclose AI use; California AB 3030 requires disclaimers on AI-generated clinical communications; Colorado SB 26-189 covers health care from 2027.

Typical AI uses

Sector regulators

European Union: European Commission, Medical Device Coordination Group (MDCG)
Spain: Spanish Agency of Medicines and Medical Devices (AEMPS)
Ecuador: National Health Regulation, Control and Surveillance Agency (ARCSA)
Colombia: Ministry of Health and Social Protection
National Food and Drug Surveillance Institute (INVIMA)
Peru: Ministry of Health (MINSA)
National Health Superintendency (SUSALUD)
Mexico: Federal Commission for Protection against Health Risks (COFEPRIS)
Chile: Public Health Institute (ISP)
Health Superintendency
Argentina: National Administration of Drugs, Foods and Medical Technology (ANMAT)
Brazil: National Health Surveillance Agency (ANVISA)
Federal Council of Medicine (CFM)
United States (federal): Food and Drug Administration (FDA)
HHS Office for Civil Rights (OCR)
Texas: Texas Attorney General

Related kits

Includes 5 documents

Healthcare Kit

Technical and clinical validation, DPIA for health data, clinician oversight, in-use monitoring and a model card for clinical AI tools.

USD 139USD 215

Complete kit · available to buy

Find out what applies to you (free)