capinorium · Article · Healthcare & MedTech

MedTech uses AI everywhere – except in the product

By Rudy WinklhoferPublished 16 April 20265 min read

Pencil illustration: doctor and engineer looking at an ultrasound image

Medical technology manufacturers use AI widely in marketing and in the office, but rarely build it into their own products. The main reason is not the technology. As soon as AI is given a medical intended purpose, a regulated development path emerges, involving medical device law, the AI Act, data access and change management. Those who plan this path before the first training run make an AI medical device realistic, even if they cannot guarantee it.

The question is not new, but the figures are. The industry has long embraced AI as a tool, but hardly as a product. For managing directors and R&D managers, what matters is therefore not whether AI can do something. The decisive question is under what conditions an AI product becomes approvable, provable and maintainable.

The gap is measured, not just felt

The BVMed autumn survey 2026 by the German Medical Technology Association shows a clear pattern. 69 per cent of the companies surveyed use AI in marketing, 62 per cent in office tools, 49 per cent in sales. By contrast, only 20 per cent develop their own AI products. A year earlier, 91 per cent said they used AI and 16 per cent were developing their own AI products.

So there is movement, but the gap remains large. For context: 120 of the 220 voting BVMed members were surveyed, including large corporations and companies headquartered in the USA. The figures describe the MedTech industry within the association, not small manufacturers specifically.

A second finding from the same survey stands out. 62 per cent prefer the approval system of the US Food and Drug Administration (FDA), only 9 per cent the European Medical Device Regulation (MDR). The survey does not prove a causal link to the lack of AI products. But such a link becomes plausible as soon as you look at the European path.

The intended purpose determines the effort

Whether software is a medical device, and which risk class it falls into, follows from its intended purpose, not from the technology used. Software that supports diagnostic or therapeutic decisions often falls into at least class IIa under Rule 11 of the MDR; the guidance MDCG 2019-11 sets this out in detail. From this class upwards, a notified body carries out the assessment.

This is exactly where the AI Act comes in. According to MDCG 2025-6, an AI medical device is considered high-risk AI if it is a medical device and a notified body must be involved. The AI omnibus, Regulation (EU) 2026/1744, has postponed these obligations to 2 August 2028. This is not an exemption: medical devices remain in Annex I Section A and thus high-risk AI, unlike machinery.

The law is also in motion. The ongoing MDR reform could ease software classification; its adoption is targeted for 2027, but the content is open. Anyone planning today should therefore work with scenarios, not hopes.

Training data and clinical evidence are the same construction site

The AI Act requires training, validation and test data to be relevant, sufficiently representative and examined for bias. The MDR additionally requires a clinical evaluation. MDCG 2025-6 describes the two as complementary: clinical validation plus evidence of accuracy, robustness, transparency, human oversight and cybersecurity.

For planning, this means that data strategy and clinical strategy belong in one document. Public data spaces help little in the short term. According to the European Commission, most obligations under the European Health Data Space only take effect from 2029. At the beginning of 2026, Germany's Health Research Data Centre offered only billing data from statutory health insurers. For image- or signal-based AI, partnerships with hospitals and one's own study data remain the obvious route.

Learning models need a change plan

An AI model that is retrained is a moving target. Since the end of 2024, the FDA has offered predetermined change control plans for this purpose. The EU lacks a comparable instrument in the legal text. However, MDCG 2025-6 makes clear that changes defined in advance and reviewed during the initial assessment do not constitute a significant change. Likewise, the AI-specific elements of quality management can be integrated into the existing MDR system.

For manufacturers with established quality management under ISO 13485, this is good news: they do not need to build a second system. They do, however, need to extend the existing one with data governance, logging, human oversight and post-market surveillance that detects model drift. The notified body reviews these requirements as part of the MDR procedure; there is no separate procedure under the AI Act.

In practice, this means the update path belongs in the technical documentation of the first submission. It is often wiser to ship a frozen model first and safeguard further development through defined limits, tests and post-market surveillance.

A realistic path begins before the first training run

The sequence is decisive. First comes a narrowly defined intended purpose: which decision does the AI support, for whom, in which situation? From this follow the risk class, the conformity route and the question of whether to approach a notified body early. Then come data access, clinical strategy and change plan. The model itself comes at the end of this chain, not at the beginning.

Before every budget step, it should be established that data rights are clarified, acceptance criteria defined and termination criteria agreed. A good demo answers none of these questions. The FDA publicly lists over 1,600 AI-enabled medical devices; no comparable EU statistic exists. This shows that the path is passable, not that it is short. Binding regulatory classification remains a matter for specialists and the notified body.

If you would like to check whether your product idea can follow this path, a feasibility study on intended purpose, risk class and data strategy with capinori is a sensible first step.

Frequently asked questions about AI in medical devices

How many MedTech companies develop their own AI products?

According to the BVMed autumn survey 2026, 20 per cent of the surveyed member companies of the German Medical Technology Association develop their own AI products, up from 16 per cent the previous year. AI is, by contrast, widely used internally, for example in marketing (69 per cent) and office tools (62 per cent). The sample comprises 120 companies, including large corporations (BVMed 2026).

Is all AI software in medicine automatically a medical device?

No. Whether software is a medical device is determined by its medical intended purpose, not by the use of AI. Software for appointment scheduling or administration is generally not a medical device. If, however, it supports diagnostic or therapeutic decisions, the European Medical Device Regulation (MDR) applies. The guidance MDCG 2019-11 describes qualification and classification.

When is an AI medical device considered high-risk AI under the AI Act?

Under the EU AI Act, an AI medical device is high-risk AI when two conditions are met: it is a medical device or a safety component of one, and a notified body must assess its conformity. The AI Act does not change the class under the Medical Device Regulation (MDCG 2025-6).

From when do the AI Act obligations apply to AI in medical devices?

Following the AI omnibus, Regulation (EU) 2026/1744, the high-risk obligations of the EU AI Act apply to AI in medical devices from 2 August 2028. Medical devices remain high-risk AI and did not receive an exemption like machinery (Morgan Lewis). Anyone planning to place a product on the market in 2027 or 2028 should take the requirements into account during development.

May an AI medical device continue learning after approval?

To a limited extent, yes. According to the guidance MDCG 2025-6, changes that were defined in advance and reviewed during the initial conformity assessment are not considered significant changes. However, the Medical Device Regulation does not contain a formal instrument like the FDA's predetermined change control plan. Manufacturers also need post-market surveillance that detects new risks.

Where do manufacturers get data for AI medical devices?

In the short term, mostly from partnerships with hospitals, their own studies and existing data with a clarified legal basis. According to the European Commission, most obligations under the European Health Data Space (EHDS) only take effect from 2029. At the beginning of 2026, Germany's Health Research Data Centre offered only billing data from statutory health insurers (Pharmazeutische Zeitung), which are hardly suitable for image-based diagnostics.

Sources (12)

Rudy Winklhofer is Owner and Director R&D of capinori GmbH.

Facing a similar question?

Talk to capinori