AI in MedTech and pharma that holds up under data protection law and the AI Act.
Health data, medical device regulation and, from 2028, the AI Act's high-risk obligations: anyone using AI in MedTech or pharma must be able to justify every data flow and every decision. We build and run the architecture for it in Switzerland and the EU and assess the use case in ClearSky.
MedTech manufacturers with obligations under the MDR (EU 2017/745) and supervised by Swissmedic, pharma companies with pharmacovigilance obligations, and healthcare providers that use or want to use AI, for example to capture reports, draft technical documentation or search study and quality records.
Health data and data protection impact assessment
Health data is sensitive personal data under the Swiss FADP and a special category under the GDPR. Processing it at scale with AI usually requires a data protection impact assessment beforehand. We provide the technical basis: data flows, storage locations, access and retention periods, documented in ClearSky.
The AI Act for medical devices
AI that is itself a medical device, or a safety component of one assessed by a notified body, is high-risk under the EU AI Act. After the postponement by the Digital Omnibus these obligations apply from 2 August 2028; AI literacy and transparency duties apply today. We work out with you which category your use case falls into and what follows from it.
Traceable audit trail
Every agent action is signed with Ed25519 and stored hash-chained, so any later change can be proven. We use this approach in our own systems, for example in the transfer log of our platform for cross-border patient cases.
Data location and choice of model
Processes, data and audit trail live on our platform in the EU or on your own infrastructure. You choose the language model: one you already license, a provider of your choice, or an open model on hardware in Switzerland or the EU.
Standards we work to
We align requirements, risk analysis, usability and testing with the standards for medical device software: IEC 62304, ISO 14971 and IEC 62366. Regulatory responsibility, classification and conformity assessment remain with you and your notified body.
What we do not do
We are not a notified body and not a regulatory consultancy. We do not hold our own certified ISO 13485 QMS, and we do not promise that Swissmedic or a notified body will accept a result. We provide the architecture and the evidence your regulatory affairs team can argue with.
