AI & Data / Germany & European Union
Medical software and AI can sit at the intersection of product regulation, health-data protection, professional duties and technology contracts. We help identify the relevant legal workstreams.
Where we can help
Intended purpose and classification
The intended medical purpose is central to medical-device software classification. The AI Act assessment is distinct and must be coordinated with MDR or IVDR requirements where relevant.
Data and development
Clinical and patient data raise sensitive-data, confidentiality and access questions. Development and procurement contracts should allocate documentation, validation support, update and incident responsibilities.
Deployment and change
A change in functionality or intended purpose can require reassessment. Legal work should be coordinated with the technical, clinical and conformity-assessment specialists responsible for the product.
From assessment to implementation
We establish the relevant role and legal framework, review the product and contractual documentation, and identify the decisions needed before launch or the next procedural step. The engagement can include a written assessment, revised agreements and support in negotiations or proceedings.
Four practical examples
Illustrative scenarios, not reports of client mandates. The appropriate response depends on the facts and applicable law.
Diagnostic feature
A wellness app adds diagnostic recommendations. We assess the changed intended purpose and applicable regulatory route.
Hospital procurement
A hospital buys an AI tool and needs documentation, security commitments and supplier assistance.
Training dataset
A developer seeks access to patient records. We assess lawful data access, roles and confidentiality before use.
Model update
A supplier changes a model used in clinical workflows. We review contractual notice and the need for regulatory reassessment.
What to send us
Please describe the product or dispute, the countries involved, your role and any deadline. Relevant contracts, technical documentation, correspondence and a short chronology help us identify the next steps. Agree a secure transfer channel before sending sensitive records.
Discuss your next step
We can define the scope of a review, identify urgent measures and agree the work and fees before proceeding. A website enquiry alone does not establish a mandate.
Related: IT & AI services · Legal updates · Our attorneys
Legal framework and further reading: Commission / MDCG: medical devices and the AI Act. Content reviewed: 12 November 2026.