The EU regulatory environment for artificial intelligence in healthcare is entering a phase of unprecedented activity. Companies developing AI-powered health solutions are no longer dealing with a single legal framework, but with a cumulative regulatory landscape where several instruments apply at the same time: the AI Act, the Medical Devices Regulation, the In Vitro Diagnostic Medical Devices Regulation, the European Health Data Space, the Data Act, and new legislative initiatives such as the proposed European Biotech Act.
Alongside these binding rules, the European Commission has also launched two major strategies: the Apply AI Strategy and the AI in Science Strategy. Together, these initiatives aim to accelerate the deployment of AI across strategic sectors, including healthcare, research, life sciences and pharmaceuticals.
For SMEs, this moment represents both a challenge and a window of opportunity. The regulatory framework is still being shaped, implementing acts and guidance documents are still being drafted, and new EU initiatives are being launched to support testing, validation and deployment. This means that innovative healthcare SMEs should not simply wait for the rules to be finalised. They should actively engage at EU level to ensure that their needs, constraints and solutions are properly understood.
Progress in this field will not only benefit companies. If deployed safely and effectively, AI has the potential to transform the entire care pathway, from prevention and early diagnosis to treatment, rehabilitation and long-term care. Patients are ultimately the main beneficiaries: better access, faster diagnosis, more personalised treatments and more efficient healthcare systems.
The AI Act
The European AI Act, which entered into force in 2024, has major consequences for healthcare companies. Its most important impact is the classification of certain AI systems as “high-risk”.
AI systems that are themselves medical devices, or that are safety components of medical devices, may fall within the high-risk category when they are subject to third-party conformity assessment under the relevant EU product safety legislation. This is particularly relevant for AI-enabled medical devices and in vitro diagnostic devices, where MDR or IVDR classification can trigger AI Act obligations.
For companies, this means that the regulatory pathway can become longer, more complex and more expensive. The issue is particularly sensitive where the AI component is not the core diagnostic function, but rather supports calculation, prioritisation, workflow management or clinical decision-making. Many healthcare innovators have therefore raised concerns about the risk of treating very different AI applications in the same way, regardless of their actual role, level of autonomy or risk profile.
The same concern applies to AI systems used in areas such as healthcare triage or health insurance risk assessment, which may also fall within the AI Act’s high-risk framework. For SMEs, the risk is that compliance requirements designed for high-impact systems could be applied too broadly, creating delays and costs that smaller innovators are less able to absorb.
In response to wider concerns about regulatory burden, the European Parliament approved on 16 June the Digital Omnibus on AI, aimed at simplifying the implementation of harmonised rules on artificial intelligence. This proposal, which amends the AI Act, seeks to reduce compliance burdens for stakeholders, particularly small and medium-sized enterprises, while ensuring that health, safety and fundamental rights protections are maintained. The revised framework addresses concerns around delayed implementation and aims to enable smoother AI innovation across sectors.
In parallel, the Commission published draft guidelines on the classification of high-risk AI systems under Article 6 of the AI Act. A targeted consultation is open until 23 July 2026. This is a live opportunity for healthcare AI companies to influence how their products will be classified in practice.
For SMEs, this is not a technical detail. Classification will determine the compliance pathway, the documentation burden, the timing of market entry and, ultimately, the cost of innovation. Healthcare AI companies should therefore use this consultation to explain where guidance is needed, where examples are too broad, and where proportionality is essential.
Targeted simplification of the MDR and IVDR
On 16 December 2025, the European Commission proposed a targeted simplification of the Medical Devices Regulation and the In Vitro Diagnostic Medical Devices Regulation. These are the two main EU frameworks governing the placing on the market and commercialisation of medical devices and in vitro diagnostic devices.
Under the MDR, many AI healthcare solutions qualify as medical device software when they have a medical purpose. As a result, companies must address classification, clinical evaluation, conformity assessment, post-market surveillance, cybersecurity, quality management and notified-body review.
The current MDR and IVDR framework has been widely criticised for long certification timelines, inconsistent notified-body practices, high costs and regulatory uncertainty. These problems are particularly acute for SMEs and software developers, which often operate with shorter innovation cycles and more limited resources than large medical technology companies.
The central challenge for AI healthcare companies is that an AI-enabled medical device may be regulated twice. First, it may be classified under the MDR or IVDR. Then, because of that classification, it may also become a high-risk AI system under the AI Act.
In practice, this means that a company may face two regulatory layers:
- MDR or IVDR obligations, because the product is a medical device or an in vitro diagnostic device.
- AI Act high-risk obligations, because the product contains, or is itself, an AI system.
The intended approach is that the AI Act assessment should be integrated into the existing MDR or IVDR conformity assessment. In principle, this should avoid two completely separate CE-marking routes. The same notified-body process should also verify the relevant AI Act requirements.
This integration is essential, but it does not remove the additional obligations. Companies will still need to demonstrate compliance with AI-specific requirements, including data governance, transparency, human oversight, accuracy, robustness, cybersecurity and post-market monitoring.
For SMEs, this apparently technical discussion is extremely important. They should engage with policymakers and stakeholders to call for clear guidance mapping MDR, IVDR and AI Act requirements; recognition of aligned compliance documentation; avoidance of duplication between the two frameworks; integrated notified-body assessment; and proportionate requirements for lower-risk medical software.
Without this clarity, Europe risks creating a regulatory environment where innovative SMEs are slowed down before their solutions can reach patients.
The European Health Data Space
The European Health Data Space Regulation aims to create a common framework for the use and exchange of electronic health data across the EU. It strengthens individuals’ access to and control over their personal electronic health data, while also enabling certain data to be reused for public interest, policy support, scientific research and innovation.
The EHDS also establishes a harmonised legal and technical framework for electronic health record systems, supporting interoperability and the smooth functioning of the internal market for digital health services and products.
For AI healthcare SMEs, the EHDS is particularly important because high-quality health data is essential to train, validate, benchmark, monitor and improve AI systems. Today, many smaller companies struggle to access representative datasets across Member States. Data is often fragmented, difficult to obtain, or locked within national or institutional systems.
The EHDS could make access to health data more structured and predictable, including for research, innovation, algorithm training and testing, regulatory activities and healthcare improvement. This could be a major opportunity for SMEs developing AI tools in diagnostics, clinical decision support, personalised medicine, prevention and care management.
However, the details will matter enormously. Fees, timelines, data quality, dataset descriptions, access conditions, IP and confidentiality safeguards, and the practical functioning of health data access bodies will determine whether the EHDS becomes a real enabler for innovation or another complex administrative layer.
Several implementing acts and technical specifications will shape how the EHDS works in practice. SMEs should therefore engage early in consultations and stakeholder discussions to ensure that the system is usable not only for large research institutions and major companies, but also for smaller innovators.
The Data Act
The Data Act has been directly applicable since 12 September 2025. It gives users greater control over data generated by connected products and related services and allows them to share that data with third parties.
This is highly relevant for connected medical and health-related devices, such as continuous glucose monitors, smart insulin pumps, wearable health technologies and associated software. For AI companies, the Data Act can unlock access to valuable datasets that were previously controlled by device manufacturers or platform operators.
This creates both an opportunity and an obligation. On the one hand, AI innovators may gain access to more data, supporting the development of new services, predictive tools, monitoring systems and personalised healthcare solutions. On the other hand, manufacturers and developers will need to design products and data interfaces in a way that enables secure, fair and machine-readable access.
For medical devices, this can also interact with MDR obligations. Changes to data interfaces, software architecture or access mechanisms may have regulatory implications and could trigger further assessment by notified bodies.
For SMEs, the Data Act should therefore be understood not only as a data access instrument, but also as a design and compliance issue. Companies should prepare early, assess how their products generate and share data, and identify whether new data access obligations may affect their regulatory strategy.
The European Biotech Act
The proposed European Biotech Act, presented on 16 December 2025, aims to strengthen the EU’s biotechnology and biomanufacturing sectors. Healthcare is one of the most important areas covered by the initiative, and AI is increasingly recognised as a key enabler for biotechnology, medicines development, clinical trials and advanced therapies.
Several elements of the proposal are particularly relevant for AI in healthcare.
First, the “digital by default” approach promotes the use of AI and data-driven tools across regulatory, scientific and administrative processes. This is relevant for drug discovery, clinical trial design, biomanufacturing and the development of innovative health technologies.
Second, the proposal includes regulatory sandboxes, which could create controlled environments for novel health biotechnology products, including tools integrating AI.
Third, the proposal aims to streamline clinical trials and reduce delays for innovative technologies. Faster and more predictable trial authorisation procedures could be highly valuable for companies developing AI-enabled solutions that need clinical evidence and real-world validation.
Fourth, the proposal introduces the concept of strategic biotech projects and high-impact strategic biotech projects. The European Parliament draft report, released the 15 June, places strong emphasis on AI, health data, data quality, regulatory coordination, testing environments, clinical evidence, EHDS links and SME support as part of Europe’s biotech competitiveness agenda.
For AI healthcare SMEs, this could become a strategic opportunity. Recognition as a strategic or high-impact biotech project could help companies access faster administrative procedures, single points of contact, easier navigation of EU and national rules, better access to funding and stronger visibility.
This would allow AI healthcare companies to position their solutions not merely as software products, but as part of Europe’s strategic health-biotech infrastructure.
The Apply AI Strategy
The Apply AI Strategy and the AI in Science Strategy complement the AI Continent Action Plan. Unlike the AI Act, the MDR or the EHDS, these strategies are not binding legislation. They are policy frameworks through which the Commission aims to promote the uptake of AI across strategic sectors, including healthcare, research and life sciences.
Their purpose is practical: to support real-world deployment, scale up research and innovation, create testing environments, mobilise funding and encourage public procurement pathways for trustworthy AI solutions.
One of the flagship initiatives under the Apply AI Strategy is the European network of AI-powered advanced screening centres. These centres are designed to support real-world clinical validation and local performance assessment of AI solutions, generating evidence for adoption at scale across national healthcare systems, including in underserved areas.
The network initially focuses on the early detection and diagnosis of cancer and cardiovascular diseases, with the possibility of expanding to additional health domains in the future. It aims to cover all EU Member States by the end of 2029.
In the cancer domain, Cancer Image Europe will serve as a key infrastructure for multi-centre development, testing and validation studies involving cancer imaging data. Centres engaged in clinical validation will be encouraged to use best practices from the European Cancer Imaging Initiative and contribute to cross-border AI research and model validation.
In cardiovascular health, the network will integrate and extend the work of the EU4Health Cardiovascular Flagship, which provides the digital, data and AI foundation for the EU Cardiovascular Health Plan.
The network will bring together public authorities, research entities, community hospitals, cancer centres, cardiovascular centres and other healthcare organisations across Europe. Following strong interest, the Commission opened a second call for expressions of interest on 22 May 2026, with a deadline of 10 September 2026.
Companies developing AI solutions for cancer and cardiovascular health should not miss this opportunity. They should engage at EU level to express interest in participating as technology providers, research partners or innovation actors contributing to pilots, validation exercises and care pathway transformation.
This is exactly the type of initiative where political engagement and awareness-raising can make a real difference for SMEs. Companies can either react to future developments once they are already defined, or they can seek to be part of the ecosystem that shapes them.
Why SMEs should engage now
The EU is moving quickly to create the regulatory and policy conditions for trustworthy AI in healthcare. This is happening at a time of geopolitical tension, increasing pressure on Member States’ health budgets, and growing demand for technologies that can make healthcare systems more efficient, resilient and patient-centred.
AI can help transform the entire care pathway, from prevention and diagnosis to treatment, cure and rehabilitation. It can support faster decisions, more personalised interventions, better resource allocation and improved access to care.
However, innovation will only reach patients if the regulatory environment is clear, proportionate and workable. For SMEs, this is the key point. The current EU agenda is not only about compliance. It is also about positioning, visibility and influence.
Healthcare AI SMEs should engage with policymakers, regulators, industry associations, patient organisations, research networks and EU initiatives. They should explain where regulatory overlaps create unnecessary burdens, where guidance is needed, and where European initiatives can better support real-world deployment.
The coming months will shape how AI in healthcare is regulated, tested, validated, funded and adopted across the EU. SMEs that engage now will be better placed to influence the rules, access opportunities and demonstrate the value of their innovations.
At Lykke Advice, we stand ready to support SMEs delivering innovation in healthcare through AI. We help companies understand the EU regulatory landscape, engage with decision-makers, raise awareness of their solutions and position themselves within the policy initiatives that will shape the future of healthcare in Europe.
To find out more, contact us at info@lykkeadvice.eu.
