Diagnostic AI
without EU AI Act documentation.
AI systems for diagnosis and triage that are medical devices under the MDR are high-risk under the EU AI Act (Annex I), with obligations applying from 2 August 2028. They require technical documentation, auditable logs, bias testing and human oversight. Most healthtech platforms do not have that documentation today.
The most demanding intersection of the GDPR and the EU AI Act
Healthtech works with the most protected data under the GDPR and with AI classified as high-risk. A security incident in this sector is not a fine: it is a news story. A diagnostic system without technical documentation will be an enforceable infringement from 2 August 2028.
AI systems that influence diagnosis and triage decisions and are medical devices under the MDR are high-risk under the EU AI Act (Annex I). They require documented risk management, auditable training data and structural human oversight. Following the Digital Omnibus (Regulation (EU) 2026/1744), the full obligations fall due on 2 August 2028.
Diagnoses, prescriptions and health data require E2E encryption, role-based access control, auditing of every access and breach procedures adapted to healthcare regulations. This is not the standard of an ordinary SaaS: the regulator makes the distinction.
A risk prediction or triage model deployed in production needs documentation suitable for clinical review. Typical production code does not meet that standard and blocks subsequent certification and regulatory validation.
The most demanding level of European technical compliance
Cybersecurity adapted to GDPR Art.9
Penetration testing and architecture review for platforms handling health data. E2E encryption, RBAC access control, access auditing and an incident response plan adapted to healthcare regulations. Response SLA guaranteed by contract.
QA for high-risk clinical AI systems
Validation tests on diagnosis and triage flows aligned with the requirements of the EU AI Act: acceptance criteria on data and bias (Article 10), technical documentation (Article 11) and auditable logs (Article 12). The QA engineer joins when the criteria are defined, not at the end of the cycle.
Reproducible scientific computing
Engineers with a background in computational biology and statistics. Predictive models with reproducible code, versioned environments with conda or Docker, data under version control. Compatible with peer review and with SLURM, PBS and LSF in institutional HPC environments.
Staff augmentation with regulatory awareness
Backend and data engineering profiles assessed with a practical test, and onboarding with specific training in GDPR Art.9 and the EU AI Act. Free replacement if the fit is not right within the first two weeks. For technical teams that need reinforcement without the usual hiring process.
AI with structural human-in-the-loop
Resolves queries about configuration, logs and known errors without escalating to engineering. No impactful action without explicit human approval. Slack integration planned. EU AI Act compliant.
In development · waiting listFor healthtech companies using LLMs or external cloud services to process health data. We map the exposure under GDPR Art.9 and the EU AI Act and propose the path to European alternatives.
In serviceFor hospitals and healthtech platforms reporting under the CSRD. CO₂ measurement across scopes 1-2-3, cloud infrastructure right-sizing and reports with GRI and ESRS metrics.
In serviceThe most demanding level of the European framework
We operate under Estonian law. Health data processed exclusively on EU servers. Structural human-in-the-loop in all our AI products: no impactful action without explicit human approval. It is not a configuration option.
Do your clinical AI systems have technical documentation for the EU AI Act?
2 August 2028 is the deadline for high-risk AI in medical devices (Annex I). Within 48 hours we will assess your compliance gap and design a technical action plan.