EU AI Act Compliance for Healthcare Software
I help healthcare software teams work out whether their AI is high-risk under the EU AI Act and turn the requirements (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and cybersecurity) into engineering tasks. After the Digital Omnibus, Annex III systems apply from 2 December 2027 and medical-device AI from 2 August 2028.
Book a discovery callWho is it for?
- Vendors of clinical decision support, diagnostic or risk-scoring software
- Hospitals and clinics that deploy AI tools
- Startups preparing a conformity assessment alongside MDR/IVDR
What you get
- Risk classification of each AI system (Annex I and Annex III pathways)
- Gap analysis against Articles 8-15 and a prioritised remediation plan
- Data governance and dataset documentation templates
- Technical documentation and logging design
- Human oversight design for clinical workflows
How it works
- 1Discovery call to define the system and its intended use
- 2Risk classification and gap analysis
- 3Remediation roadmap and documentation set
- 4Support while the team implements and validates
Typical scope and pricing
Every engagement starts with a 30-minute discovery call. Pricing is custom and depends on scope; the Discovery, Build and Scale packages describe the usual ways of working. I work from Valencia, remotely with teams across Europe and the USA, in English and Spanish. In Spain, medical devices are supervised by the AEMPS (Spanish Agency of Medicines and Medical Devices).
Related case studies
Frequently asked questions
Is my healthcare AI high-risk under the EU AI Act?
If it is a medical device or a safety component of one under MDR/IVDR, or if it falls in an Annex III area such as access to healthcare services, it is almost certainly high-risk. Research-only and purely administrative tools may fall outside, but the boundaries are narrower than most organisations assume.
Did the deadline change?
Yes. Regulation (EU) 2026/1744 postponed the high-risk obligations: Annex III systems now apply from 2 December 2027 and Annex I systems, including medical-device AI, from 2 August 2028. Confirm dates against the official text on EUR-Lex.
Do you replace a regulatory consultant?
No. I handle the technical side of compliance and work with specialised regulatory consultants when a project needs deep legal or notified-body expertise.