EU Compliance for Healthcare & MedTech
EU regulations directly affecting Healthcare & MedTech organisations — including obligations, deadlines, and maximum fines. Use our regulation checker to map your exact exposure.
Which EU regulations apply to Healthcare & MedTech businesses?
Healthcare & MedTech organisations operating in the EU are subject to 4 key regulations, including AI Act, NIS2, Pay Transparency and 1 more. The most significant obligations cover Classify AI systems by risk tier; Implement cybersecurity risk management measures. Use the regulation checker to map your exact exposure in under 2 minutes.
- AI Act: max fine €35M or 7% of global turnover — Classify AI systems by risk tier
- NIS2: max fine €10M or 2% / €7M or 1.4% (essential / important entities) — Implement cybersecurity risk management measures
- Pay Transparency: max fine Per member state (compensation + penalties) — Publish salary ranges in job adverts
- eIDAS 2.0: max fine Per member state — Accept EU Digital Identity Wallet (very large platforms)
| Regulations applicable | 4 |
| Key regulations | AI Act, NIS2, Pay Transparency |
| Highest fine | €10M or 2% / €7M or 1.4% (essential / important entities) |
Regulations that apply to Healthcare & MedTech
AI Act
The EU AI Act classifies AI systems by risk level and imposes obligations on providers and deployers. High-risk systems face mandatory conformity assessments, documentation, and human oversight requirements.
Max fine: €35M or 7% of global turnover
NIS2
NIS2 expands cybersecurity obligations to essential and important entities across critical sectors. It mandates risk management, incident reporting, and supply chain security.
Max fine: €10M or 2% / €7M or 1.4% (essential / important entities)
Pay Transparency
The Pay Transparency Directive requires employers to disclose salary ranges in job postings, report on gender pay gaps, and enable employees to compare pay. Targets the gender pay gap across the EU.
Max fine: Per member state (compensation + penalties)
eIDAS 2.0
eIDAS 2.0 updates the framework for electronic identification and trust services, introducing the EU Digital Identity Wallet. It enables cross-border digital identity verification and expands recognised trust services.
Max fine: Per member state
Which regulations apply to your Healthcare & MedTech business?
Answer 5 questions and get a personalised compliance map — free.
Run the regulation checkerExplore by regulation
- EU AI Act
- General Data Protection Regulation
- NIS2 Directive
- Cyber Resilience Act
- Digital Operational Resilience Act
- EU Data Act
- ePrivacy Directive
- Digital Services Act
- Digital Markets Act
- Pay Transparency Directive
- Whistleblower Directive
- Markets in Crypto-Assets Regulation
- eIDAS 2.0 Regulation
- Product Liability Directive (Revised)
- Corporate Sustainability Reporting Directive
- Corporate Sustainability Due Diligence Directive
- Green Claims Directive
- European Accessibility Act
- EU Machinery Regulation
Frequently asked questions
Which EU regulations apply to healthcare and MedTech companies?
Healthcare and MedTech companies in the EU must comply with: GDPR and the specific provisions for health data (Article 9 special-category data, requiring explicit consent or specific legal bases); EU AI Act (AI systems used as medical devices or in clinical decision support are typically high-risk under Annex III Section 4); the Medical Device Regulation (MDR, Regulation (EU) 2017/745) for software as a medical device (SaMD); NIS2 (healthcare sector is an essential entity category under Annex I); and the European Health Data Space (EHDS) Regulation for health data sharing (applicable from 2025-2026).
Is healthcare AI subject to the EU AI Act?
Yes. EU AI Act Annex III Section 4 classifies as high-risk AI systems intended to be used for medical device purposes as defined in the MDR/IVDR, and AI systems intended for clinical decision support that influence clinical decisions. These require: risk management system (Article 9); training data governance (Article 10); Annex IV technical documentation; registration in the EU AI database; human oversight mechanisms (Article 14); and accuracy, robustness, and cybersecurity measures (Article 15). AI systems already CE-marked under MDR or IVDR are partially exempted from duplicate conformity assessment.
What GDPR obligations apply to health data processing?
Health data is Article 9 special-category data under GDPR and cannot be processed without an explicit legal basis — typically explicit consent, vital interests, or specific legal provisions under Article 9(2)(h) for medical treatment or Article 9(2)(i) for public health. Controllers processing health data must appoint a DPO (Article 37, due to large-scale special-category data processing), conduct a DPIA before starting processing (Article 35), and implement enhanced technical measures including pseudonymisation and access controls. Cross-border health data transfers require adequacy decisions or standard contractual clauses.
Does NIS2 apply to hospitals and healthcare providers?
Yes. NIS2 Annex I includes healthcare in the essential entity sector list. Hospitals, healthcare providers, and reference laboratories are essential entities if they meet the size thresholds (medium: 50+ employees or €10M+ turnover; or large). Essential healthcare entities must implement NIS2 Article 21 security measures; report incidents within 24 hours (early warning), 72 hours (notification), and 1 month (final report); and cooperate with the national competent authority. EU Member States may apply stricter requirements to specific healthcare entities.
What is the European Health Data Space (EHDS) and what does it require?
The European Health Data Space (EHDS) Regulation (adopted 2024, applicability phased 2025-2027) creates a framework for: secondary use of health data for research, innovation, and public interest purposes; cross-border exchange of electronic health records; and citizens' digital health data rights. Healthcare providers must make designated categories of health data (electronic health records, prescriptions, imaging) accessible via MyHealth@EU infrastructure. For MedTech, the EHDS creates data sharing obligations for manufacturers of electronic health record systems and wellness applications.
For informational purposes only. This is not legal advice — consult qualified legal counsel.