Classifying GenAI under the European Union’s Medical Device Regulation.

Analysis

1. Intended use decides whether the MDR applies at all. Software is a medical device only if it is intended for a medical purpose such as diagnosis, monitoring or treatment. GenAI used for research, model development or education, with no direct interaction with patient care, falls outside the regulation.
2. Rule 11 sorts medical software into four classes by consequence. Informing diagnostic or therapeutic decisions is Class IIa, IIb if those decisions could cause serious deterioration or surgery, III if death or irreversible deterioration. Monitoring physiological processes is IIa, or IIb for vital parameters whose variations could put the patient in immediate danger. Everything else is Class I.
3. Synthetic data for training and research mostly sits outside the MDR. Synthetic images for training sets, synthetic cohorts for trial protocol design and synthetic biomarkers for early algorithm testing do not touch patient care directly. Where the data becomes integral to a device that does, the generator may count as an accessory to it.
4. Systems that touch clinical decisions land in IIa to III. Digital twins for treatment planning, records that suggest diagnoses and follow-up tests, and personalised treatment-response prediction all directly influence decisions. The class depends on the treatments and risks involved. Life-critical decisions likely make it Class III.
5. Two scores place any use case. Each case is rated 0 to 10 on decision-making relevance and on therapeutic risk potential. Medical education scores 1 and 1. Treatment-response prediction scores 10 and 8. Drug discovery sits at 5 and 3, likely outside the MDR unless it later informs trial design or dosing.

Why it matters

Misclassification cuts both ways. Under-regulate and synthetic data can reach clinical settings without the scrutiny the MDR exists to provide. Over-regulate and a field with real potential slows down. For anyone generating synthetic health data the practical reading is short. A generator used only for research and development is likely outside the MDR, unless it becomes an accessory to a device that is not. Once its output is intended to inform clinical decisions, it is a device, and the class follows the consequence of those decisions.

The MDR’s software rule was not drafted with generative models in mind. A system that produces novel data raises validation and monitoring questions the current framework does not fully address, and the hypothetical cases here are a starting point, not a map of the field. We argue for GenAI-specific regulatory guidance, and for AI researchers, clinicians, ethicists and lawyers to develop guidelines for responsible deployment together.

Scope and limitations

A position paper. The eight use cases are hypothetical and do not cover the full range of GenAI in healthcare, and new applications may challenge current interpretations. The analysis rests on the current MDR text and existing guidance, and amendments or new guidance could change it. How to validate and monitor a GenAI system once it is classified as a device is out of scope. When in doubt, consult regulatory experts or the relevant authorities.