I. Introduction
In recent years, there has been a growing interest among health institutions in developing and using AI-based medical devices. The in-house development and the exclusive use within the same health institution within the European Union is an accessible way for health institutions to utilise AI-based medical devices. This in-house exemption under the Medical Device Regulation (MDR)Footnote 1 is a specific regime to put a medical device – manufactured and used within a health institution in the Union – into service. This regime provides only a minimal set of general safety and performance requirements. Once met, the in-house medical device can be put into service without undergoing the full conformity assessment by a notified body.
This article analyses the framework for AI-based, in-house medical devices and scrutinises their beneficial regime, in light of the MDR and the AI Act.Footnote 2 Given that the MDR does not require conformity assessment by the notified body for in-house devices, and given that Article 6(1) AI Act requires medical devices to undergo conformity assessment to be classified as a high-risk AI systems, it follows that most AI-based in-house medical devices – irrespective of its classification under the MDR – are not high-risk AI systems under the AI Act. Such a classification would exclude those AI systems from the additional safety requirements enforced by the AI Act. As a result, AI-based medical devices that the AI Act would consider a high-risk AI system (such as class IIa or above devices) can easily be considered low risk for the sole reason of being manufactured and used within a health institution, relying on the in-house exemption.
This issue raises several questions. For example, it might be argued that such an exemption may undermine the tiered risk classification system established by the AI Act. Or it could lead to wondering with which rationale this exemption aligns, AI Act and MDR considered. In fact, while the rationale underlying the in-house exemption is to reduce the administrative burden by exempting health institutions from most regulatory requirements, Article 5(5) of the MDR nonetheless imposes a set of minimum safety and performance requirements. In contrast, the AI Act does not establish comparable baseline safety requirements for in-house AI systems, potentially resulting in the application of less rigorous requirements.
Considerable research attention has been given to the regulatory challenges of implementing the AI Act alongside the MDR,Footnote 3 to the impact of the AI Act on the MDRFootnote 4 and medical devices.Footnote 5 A substantial body of literature also exists on the use of AI in medical devicesFootnote 6 and the healthcare sector.Footnote 7 Furthermore, medical device law in general have been extensively researched.Footnote 8
However, to date and to the knowledge of the authors, it appears that the in-house exemption under the MDR has not been comprehensively researched. Additionally, the vast literature offers little information about the effect of the in-house exemption under the MDR on the applicability of the AI Act to in-house medical devices. There has also been little to no public debate on the potentially arbitrary classification of certified class IIa or higher AI-based medical devices and class IIa or higher AI-based in-house medical devices under the AI Act.
A medical device of class IIa or higher is usually classified as a high-risk AI system and is subjected to more stringent requirements when placed on the Union market, while the exact same medical device, when it is exclusively put into service within the health institution where it was manufactured, is subject to a lower regulatory threshold. This may raise a regulatory inconsistency and potentially undermine the uniform application and effectiveness of the AI Act. Therefore, given the above-mentioned gap in the legal literature and given the stated problem, it is relevant to address this issue in a paper to initiate a broader discussion on the topic.
This paper is structured as follows: it introduces in-house medical devices, their exemption regime, and the implications of the interplay between the MDR and the AI Act (Section II). This section also illustrates the potential regulatory problem. A subsequent section addresses whether the in-house exemption, as a beneficial regime, should be maintained under the AI Act. It identifies and zooms in on selected key arguments, being the research and innovation exemption, the characterisation of the exemption as a legal loophole and the potential inconsistency of the exemption with the underlying rationale of the AI Act (Section III). The last section concludes the key findings of this study by addressing whether the lower risk classification of in-house medical devices under the AI Act constitutes a legal loophole or reflects a deliberate preservation of a beneficial regime and whether this loophole should be considered in prospective reforms. After establishing that this constitutes a legal loophole, the paper offers policy recommendations (Section IV).
II. The MDR and AI-based in-house medical devices
Medical devices within the European Union are regulated under the MDR, which serves as the cornerstone of EU legislation in this field. The MDR establishes comprehensive requirements for safety, performance, conformity assessment and post-market surveillance. In principle, all medical devices placed on the market or put into service must comply with these requirements. Devices are classified according to risk – from Class I (low risk) to Class III (high risk).Footnote 9 While low-risk devices (Class I) may often be self-certified by manufacturers, higher-risk devices (Class IIa, IIb, and III) must undergo third-party conformity assessment by a notified body before being placed on the market or used within the EU.Footnote 10 This process ensures that more complex and potentially hazardous devices meet stricter safety and performance standards.
1. (AI-based) in-house medical devices
The general approach foreseen by the MDR has some exceptions. Article 5(5) MDR introduces a significant derogation for devices that are both manufactured and used exclusively within health institutions in the Union. This derogation refers to “in-house medical devices.” In-house medical devices are those devices that are manufactured and utilised internally within one health institution in the European Union.Footnote 11 This exemption stands on the fact that they are manufactured on a non-industrial scale and address specific needs.Footnote 12 For the exception to apply, these specific needs should not be met by an equivalent certified device on the Union market.Footnote 13 In-house medical devices benefit from a favourable regime under the MDR: they are exempt from most of the Regulation’s requirements provided they meet the specific conditions for manufacture and use set out in Article 5(5). By contrast, custom-made devices – those produced exclusively for an individual patient – fall outside the scope of Article 5(5) and remain subject to the broader MDR framework.
In-house devices are deemed to have been “put into service” but, apart from the general safety and performance requirements laid down in Annex I, they are exempt from the broader set of obligations that apply to commercial devices.Footnote 14 This carve-out enables healthcare institutions to develop tailored medical solutions for clinical needs that are not already (sufficiently) met on a commercial level. However, this exemption is conditional: health institutions must ensure, inter alia, that the devices are not transferred to another legal entity, that their manufacture and use take place under an appropriate quality management system, and that it can be demonstrated that the specific needs of the patient group cannot be met to the same standard by an equivalent device available on the market.Footnote 15 That said, pursuing the in-house route is by no means a walk in the park. Health institutions must provide competent authorities with documentation justifying the manufacture and use of such devices, publish a declaration of conformity with the general safety and performance requirements outlined in Annex I of the MDR (or provide a reasoned explanation where full compliance is not possible), and maintain comprehensive technical documentation detailing the design and production processes. In addition, institutions are required to implement appropriate corrective measures based on clinical experience and real-world use. Member States retain strong oversight powers: they can request further information, impose restrictions on specific in-house medical devices, and carry out inspections to ensure compliance with the regulatory framework.
While the exemption excludes devices manufactured on an industrial scale, it nonetheless provides hospitals and other health institutions with a legally recognised pathway to develop and use bespoke devices, including AI-based solutions, without undergoing the full conformity assessment procedures required for marketable products. With the entry into force of the AI Act, however, this regulatory landscape is further complicated. The AI Act introduces a new layer of horizontal rules for AI systems, which interact with the MDR obligations, particularly for AI components embedded in medical devices. While the in-house exemption under Article 5(5) MDR limits the application of third-party conformity assessments, the emergence of AI-specific obligations raises questions about how AI-based in-house medical devices fit within the broader EU regulatory framework. This creates a need to examine the AI Act in detail, its classification of high-risk AI systems, and the ways it intersects with the MDR.
2. The AI Act and AI-based medical devices
With the adoption of the AI Act, a new horizontal regulatory framework has been introduced, adding further compliance obligations to medical devices that integrate artificial intelligence. Unlike the MDR, which is a sector-specific instrument governing the placing on the market, safety, and performance of medical devices, the AI Act applies broadly to AI systems across different sectors, imposing requirements proportionate to the risks associated with their use. The central provision in this regard is Article 6(1) AI Act, which stipulates that AI systems are to be considered high-risk when they are safety components of products, or products themselves, falling within the Union harmonisation legislation listed in Annex I. Annex I AI Act explicitly includes the MDR and the IVDR, thereby creating an automatic link between the two regimes. As further clarified in Recitals 30–34 AI Act, this mechanism avoids duplication of sectoral legislation while ensuring that medical AI systems embedded in other products are consistently subject to the safeguards of the AI Act.
The practical consequence of this legal construction is that whenever an AI-based medical device requires a third-party conformity assessment under the MDR, it is simultaneously classified as a high-risk AI system under the AI Act.Footnote 16 This dual qualification activates a set of cumulative requirements. Alongside MDR provisions on general safety and performance (Articles 5–10 MDR), classification (Annex VIII MDR), and conformity assessment (Article 52 MDR), the AI Act introduces obligations specifically targeting the development and use of AI. These include the establishment of a risk management system (Article 9 AI Act), ensuring the quality and representativeness of training and testing data (Article 10 AI Act), maintaining comprehensive technical documentation (Article 11 AI Act), record-keeping to guarantee traceability (Article 12 AI Act), clear information and transparency obligations (Article 13 AI Act), and effective human oversight mechanisms (Article 14 AI Act). Furthermore, Articles 16 to 29 of the AI Act lay down specific obligations depending on the actor involved (providers, deployers, importers, distributors), ensuring accountability throughout the AI value chain.
In this sense, the AI Act does not replace or modify the MDR, but rather complements it: the MDR continues to regulate the safety, performance and clinical evaluation of medical devices as products, while the AI Act adds a layer of requirements aimed at ensuring the trustworthiness, robustness and responsible use of AI systems embedded within them. However, because the in-house exemption under Article 5(5) MDR excludes devices from third-party conformity assessment, in-house AI medical devices generally do not trigger the AI Act’s high-risk obligations under Article 6(1). As a result, a significant portion of AI systems used directly in clinical practice may fall outside the combined safeguards of both frameworks, creating a regulatory gap with potentially important implications for patient safety and accountability.
III. A benefit or a loophole? Dissecting the arguments
While it is clear that the MDR’s favourable treatment of in-house medical devices was a deliberate policy choice, it is far less evident that the same intentional “benefit” applies when the MDR and the AI Act operate together in the context of AI-based in-house medical devices. This section therefore considers whether the resulting legal framework should be understood as a justified and purposeful advantage for manufacturers and AI providers, or whether, on the contrary, it reflects an unintended regulatory gap produced by the interaction between the AI Act and medical device law, as others already identified in the literature.Footnote 17 Section III.1 assesses the thesis as to whether such a regime is intended to be beneficial for manufacturers-providers, as a sort of “reasonable exemption.” Section III.2 assesses an opposed thesis, for which the regime should not be intended to be beneficial. Instead, it should be regarded as an (unintended) “legal loophole” between the AI Act and medical device regulations. The section concludes with some caveats, moving beyond this binary assessment to offer a broader perspective on how the in-house regime aligns with the objectives of the AI Act, considering whether the exemption may inadvertently weaken the Act’s risk-based architecture and the safeguards it establishes for high-risk AI systems.
1. A “reasonable exemption”
The first thesis of the arguments this article proposes to scrutinise holds that the lack of regulatory scrutiny for in-house and potentially high-risk medical devices represents a “reasonable exemption” for medical device manufacturers. According to this thesis, the legislature would have intentionally envisaged such an exemption to support and facilitate compliance with legal requirements. EU Regulations often provide facilitations for medical device manufacturers or certain economic actors; therefore, manufacturers-AI providers should also be entitled to benefit from facilitations in their activities, whether it be research and development or local/in-house activities.
This thesis can be supported by three main and distinct arguments: (a) EU legislature supports innovation and seeks to advance policies with lighter legal requirements for specific stakeholders, including for health institutions with regard to in-house medical devices; (b) medical device regulations aim at facilitating in-house healthcare providers with ad hoc and exceptional rules, and this regime belongs to the exceptional rule category; (c) EU legislature supports research and development and seeks to advance policies with beneficial regimes for those activities, including in-house medical devices.Footnote 18
a. EU legislature supports innovation
This first argument supporting the “reasonable exemption” thesis maintains that the facilitating regime shall be seen as a policy choice by the legislature to foster innovation within the healthcare environment.Footnote 19
Many debates in EU policy-making have concerned innovation in the EU, and the issue is particularly relevant to stakeholders in the health or life sciences field, where innovation is often mentioned as a core aspect to advance scientific knowledge and societal welfare.Footnote 20 In medical device regulations, “innovation” is mentioned in the first recitals of the MDR and the IVDR.Footnote 21 It has been one of the core objectives of the medical device reform. In the reform preparatory documents, the European Commission mentions it as an objective (“to provide a regulatory framework which is supportive for innovation and the competitiveness of the European medical device industry”).Footnote 22 Innovation is linked to competitiveness and the European Union’s single market policies, aiming to facilitate economic actors in their economic activities throughout the Union.
In the literature, different definitions of innovation exist. Among others, Granieri and Renda define innovation as “(a) the creation of new (or the efficient reallocation of existing) resources and (b) which contribute to progress,” to be intended in the broadest possible sense and only to the extent it contributes to social welfare in the long run.Footnote 23 According to regulation theory, various types of regulations exist in terms of their impact on innovation, and different regulatory approaches can have distinct effects on innovation.Footnote 24 Certain rules, such as those loosening known constraining aspects of regulation (e.g., compliance burdens), can serve as incentives for innovation.Footnote 25 Shielding health institutions from burdensome compliance requirements, including notified body assessment, therefore can be considered as an incentive for innovation. Therefore, considering the existing emphasis on innovation for medical devices, the argument “EU legislature supports innovation” for the beneficial regime for in-house high-risk medical device software is demonstrated by considering such a regime as a regulatory incentive for innovation.
b. In-house medical device broad exception
The second argument supporting the “reasonable exemption” thesis maintains that the beneficial regime shall be considered as a corollary, a broad interpretation of the already existing health institutions’ exemption for in-house medical devices.
In other words, if in-house medical devices have loosened requirements, the same rationale for in-house medical devices could be validly extended to AI-based medical devices. Therefore, if the MDR excludes third-party conformity assessment for in-house medical devices, for the purpose of facilitating healthcare institutions, similar lessened requirements should apply to in-house, AI-based medical devices.
This logic could also support the rationale of medical device in-house exceptional requirements, which are set for healthcare institutions to support them when no suitable commercially available solutions are on the market to meet specific patients’ needs.Footnote 26
In this sense, we can consider the example of a university hospital specialising in rare metabolic disorders. It could consider developing an AI-based diagnostic support tool trained on its own biobank and imaging datasets, with atypical patient profiles not represented in commercial AI systems. Such a model would need continuous fine-tuning and validation using the institution’s own clinical data and workflows, often diverging from standardised, market-ready solutions. In this context, an in-house exemption regime would allow the hospital to iteratively develop, adapt and deploy this AI system, with the aim of supporting responsiveness to local clinical and research needs. A beneficial regime could allow the hospital to create such a system and have less burden, on a compliance level, for developing it. Given that the hospital is not a commercial, widespread medical device organisation, a beneficial regime could support the entity while facing fewer compliance costs that are usually associated with the creation and use of medical devices.
To conclude, as also illustrated through the example, this section has shown how the beneficial regime for AI-based medical devices could be interpreted as a broad exception to the general rules of MDR, as a further way of facilitating the production of medical device software tailored to the needs of healthcare institutions at a local level.
c. EU legislature supports research and development
The third argument builds on the first one and is that the EU legislature supports research and development. This argument holds that the beneficial regime is set by the EU legislature to promote innovation (also) through research and development, and it can be supported by considering that research and development usually benefit from specific regimes facilitating researchers at the early stages of their activities.
Such facilitations are present, for instance, in the AI Act, which provides for explicit exemption for research and development. Article 2(6) AI Act, namely, keeps that the AI Act “does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development.” Other regulations, analogously, provide for research exemptions to their standard rules. The General Data Protection Regulation (GDPR), for example, establishes a derogation to the prohibition on processing special categories of personal data when it is for research purposes.Footnote 27 There are further exemptions when it comes to the further processing of personal data for research purposes. In this case, the GDPR established the possibility of organisations to rely on “broad consent” of individuals.Footnote 28 Another example can be drawn from the European Health Data Space (EHDS) Regulation. Scientific research is one of the closed hypotheses under which health data can be shared for secondary use in the EHDS Regulation.Footnote 29
It is also worth mentioning – as a supporting element of this argument – that even medical device regulations exclude “research-only” medical devices. As clarified by the Medical Device Coordination Group (MDCG) in its guidance on health institutions exemption, “RUO (research use only) products are not regulated by the MDR and IVDR.”Footnote 30 This rule emphasises that research-related products can be exempted from general rules of MDR/IVDR and thus can support the argument for which research is promoted by the EU legislature through exemptions.
Therefore, this section’s argument is demonstrated by the presence of specific research-related rules, both in product or data regulations, which are justified in order to provide facilitations for research. Similarly, for AI-based medical devices, a beneficial regime is provided to foster the development of medical devices.
d. Caveats
While considering the thesis of the beneficial regime, all the arguments here provided above need to be nuanced.
The safety versus innovation argument requires considering also the conception of “innovation” in EU policy. In EU policy and regulation theory, innovation cannot be seen as the only driving value for medical products production and legislation. While facilitations for stakeholders to foster innovation are promoted by the EU bodies, this does not mean it is a blanket facilitating regime. The argument of fostering innovation in the EU, and in medical device regulations implies the consideration of other values, such as health and safety. As the MDR/IVDR mention in their recitals, “the regulations establish a robust, transparent, predictable and sustainable regulatory framework for medical devices, which ensures a high level of safety and health whilst supporting innovation” (emphasis added). In other words, innovation in medical devices requires to be balanced in light of safety and health. This needs to balance innovation with health and safety, which also emerges from parliamentary and the European Commission’s discussions over the medical device regulations, before their adoption.Footnote 31
The in-house medical device broad exception and the EU legislature supports research and development arguments might have its weaknesses at a legal theoretical level. Considering the beneficial regime as a “broad exemption” implies that there is a general legal rule (medical device heightened scrutiny) and an exception (lighter legal requirements, for a specific reason, i.e., facilitating healthcare institutions at a local level). The exception suggested by the argument would be an “implicit” or “broad” one, not being specifically written anywhere in the legal text of the MDR or in interpretative guidance thereof. However, in legal theory, usually a rule has specific or explicit exceptions. An implicit or broad exception could go against general principles of law. A rule that can be turned by way of broad exemption, for example, could undermine the predictability of individuals or entities’ behaviour and thus legal certainty.Footnote 32 In other words, implicit or broad exceptions are difficult to maintain at a logical level. Thus, transposing it to the medical device field – which is, per se, densely regulated – simply appears as an unlikely or logically weak argumentation.
In addition, the available MDCG’s interpretative guidance has not considered the issue itself of the beneficial regime for in-house AI-based medical devices, opening the possibility to consider that such a regime constitutes a loophole, rather than an intentional advantage for health institutions. The following section will dissect this argument in more detail.
2. A legal loophole (not a beneficial regime)
This section argues that in-house medical devices being considered as low-risk AI systems under the AI Act constitute a legal loophole. It should not be regarded as a beneficial regime. The discussion begins by challenging the argument that the AI Act’s emphasis on research and development implies that AI-based medical devices, which are used in-house, should be considered low risk to maintain the beneficial regime of the MDR under the AI Act. It then proceeds to compare the in-house exemption with the AI Act’s special regime for regulatory sandboxes and testing in real-world conditions. Subsequently, it examines the concept of “putting into service,” to then ultimately conclude that the interplay between the MDR and AI Act may have created a legal gap while presenting the associated implications.
As noted earlier, the in-house exemption under the MDR removes the obligation for medical devices to undergo third-party conformity assessment. This is unproblematic when viewed solely through the MDR’s logic, which intentionally creates a flexible space for hospitals to address specific patient needs while maintaining baseline safety safeguards. The situation becomes more complex once an in-house medical device incorporates AI. This bears repeating, as it is central to the subsequent analysis: although medical AI systems are generally understood to fall within the high-risk category of the AI Act, the cumulative conditions of Article 6(1) are not satisfied when the device benefits from the in-house exemption under Article 5(5) MDR, which removes the requirement for third-party conformity assessment. Consequently, AI-based in-house medical devices do not qualify as high-risk systems and thus escape most AI Act obligations. This outcome raises the question of whether such a regulatory effect reflects an intentional extension of the in-house regime or an unintended gap between the MDR and the AI Act.
a. The research exemptions under the AI Act
One possible explanation for the low-risk classification of in-house medical devices under the AI Act may be the AI Act’s research exemptions, as the EU legislature supports the research and development argument would hint. However, a closer look at the AI Act’s wording on research exemptions suggests that such an argument may not be solid.
Let us consider the AI Act. This Regulation was established to protect health, safety and fundamental rights while fostering innovation.Footnote 33 To avoid hampering innovation, the regulation largely excluded research activities from its scope.Footnote 34 It incorporated both a broad research exemption and a narrower and tailored exemption limited to scientific research in Article 2(8) and Article 2(6) of the AI Act, respectively.Footnote 35
The research exemption provided in Article 2(8) of the AI Act refers to “any research, testing, or development activity prior to their being placed on the market or put into service.”Footnote 36 Given this wording, the provision seems to be directed at the research and exploratory phases of an AI system, which are phases preceding any use by the provider or its availability on the Union market.Footnote 37
Let us now consider the MDR and read it in conjunction with the AI Act. Article 5(4) MDR states that medical devices manufactured and used within a health institution are considered as being put into service. So, AI-based in-house medical devices used by health institutions, possibly operating in a provider capacity, are AI systems put into service. Therefore, given that the MDR considers AI-based in-house medical devices used by hospitals as put into service, and given that Article 2(8) AI Act constitutes an exemption only for devices before their use – thus not when “put into service” – it follows that Article 2(8) on research exemption cannot be invoked as a basis to exclude AI-based in-house medical devices from the scope of the AI Act.
Turning to the second reference relevant to research in the AI Act, i.e., Article 2(6), the article provides a specific exemption for AI systems, applying to the AI systems that are developed and put into service, but not placed on the market, “solely for the purpose of scientific research and development.”Footnote 38 However, neither this provision can be invoked for the EU legislature supports research and development argument when it comes to in house medical devices.
This provision – as also Mantelero notes – imposes two restrictions.Footnote 39 First, the AI system or model should be developed and put into service specifically for the purpose of scientific research and development. Second, the purpose of scientific research and development should be the sole purpose of the development and use of the AI system or model. Furthermore – as also de Vries observes – the AI Act restricts its research exemption to AI systems that are “completely disconnected from practice, whose sole purpose is research and development.”Footnote 40 This suggests that the real-world deployment of the AI system, where patients are exposed to its use for their clinical treatment or diagnosis, as it would be in the case of AI-based in house medical devices, might not be covered by AI Act’s Article 2(6) exemption. AI-based in-house medical devices, once put into service, operate within a real-world setting with possible direct exposure to patients.Footnote 41 Additionally, the MDCG guideline of 2023-1 clearly states that Research Use Only products do not fall under the in-house exemption because the products are not subject to the MDR when they are intended solely for scientific research purposes and not for clinical diagnoses or treatment. AI-based in-house medical devices have a medical purpose and are established to be used in practice within a health institution.
So, products that lack a medical purpose and only have a scientific research purpose do not fall under the MDR and cannot, therefore, invoke the provisions under the MDR. Taking into account the plain reading of the text of the MDR and AI Act, the interpretations offered by both Mantelero and de Vries and the MDCG guidelines, it can be concluded that AI-based in-house medical devices are not covered by the exemption under Article 2(6) AI Act. In this way, the claim that the research exemptions demonstrate that the beneficial regime for in-house medical devices under the MDR are preserved under the AI Act is unfounded.
b. Regulatory sandboxes under the AI Act
The AI Act further provides for the creation of regulatory sandboxes where AI systems can be developed and tested under regulatory oversight prior to the system being granted market access or permitted to be used. This controlled experimenting and testing environment facilitates “the development, training, testing and validation of innovative AI systems for a limited time before being placed on the market or put into service pursuant to a specific sandbox plan agreed between the providers or prospective providers and the competent authority.”Footnote 42 Contrary to this, in-house medical devices are already at the stage of putting into service.Footnote 43 Accordingly, based on the strict literal interpretation of the text of both the AI Act and the MDR, the in-house exemption regime is not similar to the regulatory sandbox regime. In addition, Buocz and others argue that the clinical investigation under the MDR, that allows to test under realistic conditions, can be considered similar to a regulatory sandbox.Footnote 44 A clinical investigation is a systematic investigation in which one or more human participants are subjected to the device to evaluate its safety and performance.Footnote 45 This investigation generates clinical data for manufacturers to establish clinical evidence for the device.Footnote 46 As with regulatory sandboxes, a comprehensive clinical investigation plan is required to conduct a clinical investigation to test and validate the device. Both regulatory sandboxes and clinical investigations pertain to a phase preceding the phase where the system or device is put into service or on the market. Furthermore, regulatory sandboxes are a regulatory-led experimental framework for the temporarily testing of innovations under regulatory supervision towards future market access.Footnote 47
Contrary to this, the in-house exemption under the MDR is a legal carveout that allows hospitals based in the European Union to manufacture and use devices for immediate clinical need without undergoing a third-party conformity assessment and the complete set of requirements under the MDR. Thus, although both regimes aim to promote innovation while ensuring safety, regulatory sandboxes are characterised by a temporary, controlled testing period, whereas the in-house exemption facilitates an ongoing healthcare delivery.
c. Testing in real-world conditions under the AI Act
The AI Act allows under Article 60 for the testing in real-world conditions of high-risk AI systems, as set out in Annex III. This provision enables providers or prospective providers to conduct testing of high-risk AI systems referred to in Annex III in real-world conditions at any moment before the placing on the market or the putting into service of the AI system. Although this provision is limited to high-risk AI systems under Annex III, this special regime could nonetheless be invoked to justify classifying AI-based in-house medical devices as low-risk under the AI Act. However, testing in real-world conditions is defined as “the temporary testing of an AI system for its intended purpose in real-world conditions outside of a laboratory or otherwise simulated environment.”Footnote 48 The MDCG 2025-6 says that high-risk AI-based medical devices undergoing a clinical investigation or performance study can constitute real-world testing under the AI Act. This appears to indicate that like regulatory sandboxes, testing in real-world conditions constitutes a temporary testing and validation phase following the research phase, given its exclusion from the general research exemption under Article 2(8), and preceding putting into service, which is the phase where the device is used by the manufacturer for its intended purpose. This means that since testing in real-world conditions pertains to a separate phase, it is likewise not comparable with the in-house exemption. Thus, the special provisions governing regulatory sandboxes and testing under real-world conditions cannot substantiate the argument that classifying AI-based in-house medical devices as low-risk aligns with the underlying objective of the AI Act.
d. The concept of “putting into service”
The concept of “putting into service” should be explained. The AI Act defines the concept of “putting into service” as the “supply of an AI system for first use directly to the user or for own use on the Union market for its intended purpose.”Footnote 49 Article 2(29) of the MDR defines “putting into service” as “the stage at which a device, other than an investigational device, has been made available to the final user as being ready for use on the Union market for the first time for its intended purpose.” Both definitions are comparable as they require the initial use of the system, whether by the end-user or for own use on the internal market, in accordance with its intended purpose. These definitions suggest that when a product is put into service it is used in practice, in a real environment,Footnote 50 indicating that the system is no longer situated within the research or testing phases, but has entered its phase of practical application. The MDR clearly articulates that medical devices manufactured and used within a health institution are understood as being put into service, rendering applicable the requirements governing the use of that device. Accordingly, the AI Act stipulates that the regulation applies to providers putting their AI systems into service. Given that AI-based in-house medical devices put into service are not in the research phase and do not serve a purely scientific purpose, the AI Act applies. Consequently, the special provisions for research and testing are no longer relevant, as the devices have entered the practical use phase.
e. Implications of a legal loophole
Finally, the reduced regulatory requirements for AI-based in-house medical devices compared to those for regular AI-based medical devices raise concerns. Key requirements on data quality, risk management, technical documentation and human oversight that would usually apply to high-risk AI systems are inapplicable for AI-based in-house medical devices. Unlike the MDR, the AI Act has not established minimum safety and performance requirements for AI-based in-house medical devices. While the requirements set forth under the MDR protect patient safety, they do not address the necessary provisions for the AI component and its associated risks. As a result, essential safeguards such as risk management, data quality, technical documentation and human oversight are either weakened or absent. The MDR can partially cover the risk management and technical documentation of the AI-based in-house medical devices. Nonetheless, the AI Act introduces complementary obligations that cannot be substituted. Moreover, requirements concerning representative datasets and human oversight are not covered by the MDR, leaving them entirely unaddressed in an AI-based in-house medical device.
A low-risk classification does not, however, render an AI-based medical device entirely free from regulatory oversight.Footnote 51 For instance, the requirement for AI literacy applies regardless of the classification of the AI system.Footnote 52 Article 4 of the AI Act imposes obligations on both providers and deployers, e.g., healthcare institutions, to adopt appropriate measures ensuring that their staff possess a sufficient level of AI literacy.Footnote 53 This extends beyond mere operational familiarity with the AI-based medical device.Footnote 54 Physicians and other clinical staff must develop a meaningful understanding of the underlying functioning of AI-based medical devices to critically engage with these systems in a clinical setting.Footnote 55
Furthermore, Recital 166 of the AI Act provides that AI systems falling outside the scope of the high-risk requirements must nonetheless be safe when placed on the market or put into service, with the General Product Safety Regulation (GPSR) serving as a residual safety net in this regard.
Though in the context of medical devices, the MDR operates as a lex specialis in relation to the GPSR,Footnote 56 both instruments pursue the same overarching objective of ensuring the safety of products placed on the EU market or put into service.Footnote 57 Yet, the MDR contains more specific provisions, namely targeted safety requirements for medical devices. In accordance with the general principle that specific legislation prevails over general legislation, the MDR prevails over the GPSR notwithstanding the latter’s more recent adoption.Footnote 58 The MDR thus constitutes sector-specific product safety legislation embedded within the broader general product safety framework of the GPSR. Consistent with the rationale underlying the GPSR, the MDR proceeds from the premise that only safe and compliant products may be marketed and put into service, with the dual aim of levelling the playing field for responsible economic operators and ensuring a high level of safety and consumer protection across the EU.
Against this backdrop, the legislature’s decision to treat in-house medical devices as low-risk AI systems within the meaning of the AI Act may well reflect a deliberate regulatory choice. Insofar as the MDR’s general safety and performance requirements continue to apply as a safety net for low-risk AI-based medical devices, the legislature may have considered that layer of protection sufficient as confirmed by the recent developments in the discussion over modifications for the MDR regimes that would extend the favourable in-house exception, as explained later in this paper.
This reasoning, still, is not without tension. As early as 2020, the European CommissionFootnote 59 explicitly acknowledged that existing Union product safety legislation does not address the specific risks arising from the opacity of AI systems, and that additional requirements relating to transparency, robustness, accountability, human oversight, and the prevention of biased outcomes are therefore necessary. Therefore, while the legislature appears to regard the MDR’s safety framework as adequate for certain AI-based medical devices, it has simultaneously recognised at its institutional policy level that product safety legislation alone is insufficient to capture the full spectrum of risks inherent to artificial intelligence.Footnote 60 This internal inconsistency in the regulatory framework warrants scrutiny, especially in light of the current legal developments at the EU level (see infra). Altogether, the interplay between the MDR and AI Act seems to result in a legal loophole that can pave the way for arbitrary compliance, whereby health institutions are inclined to favour in-house medical devices due to the reduced requirements.
3. Against the rationale of the AI Act
This section – as already partially mentioned in the previous paragraph – discusses the AI Act’s underlying rationale and contrasts it with that of the MDR. It argues that, although both regulations focus on safety, they nonetheless place different emphases on it. The section starts by explaining that fundamental rights have played a significant role in determining the categories under the AI Act. It then proceeds to explain that the AI Act, as a horizontally applicable legislation, builds upon existing EU legislation, given that the integration of AI introduces an additional layer of risk. Since this additional layer of risk is not considered under the MDR, the discussion then turns to why a seemingly arbitrary dual regime of requirements may arise for medical devices. Lastly, the section concludes that the arbitrariness of these requirements may give rise to a paradoxical risk categorisation under the AI Act.
a. Fundamental rights as a key criterion
The EU AI Act is characterised as a hybrid framework that combines elements of product safety legislation with provisions for the protection of fundamental rights.Footnote 61 On the one hand, it heavily focuses on product safety and on the other hand, on the risks for fundamental rights.Footnote 62 This horizontal legislative instrument promotes the development and deployment of human-centric and trustworthy AI by ensuring that AI is designed, developed and deployed in accordance with EU values and fundamental rights.Footnote 63 The underlying philosophy of the AI Act is that AI systems and models should be regulated according to the level of risks they pose.Footnote 64 To this end, the legislator established closed categories based on the respective potential risk levels, and fundamental rights appear to have served as a key criterion in delineating these categories.Footnote 65
These closed categories of AI systems indicate that the European Commission predetermined the balancing exercise of fundamental rights by establishing the classification ex ante.Footnote 66 Since the AI Act’s risk classification happened ex ante, it means that the classification is detached from the actual impact of the AI system. Furthermore, the risks of the AI system depend on the purpose of the system, illustrating a probabilistic association between the purpose and risks.Footnote 67 Accordingly, the risk classification of an AI system under the AI Act does not always reflect the actual risk exposure of the system. Following this line of thinking, an AI-based medical device may be classified as a low-risk AI system, yet in practice, it may expose patients to risks that exceed those typically associated with low-risk AI systems.
Similar to the MDR, the AI Act is also part of the New Legislative Framework, which establishes conditions for placing products on the internal market with a strong emphasis on safety and technical risks.Footnote 68 However, Mahler contends that the AI Act’s notion of risk goes beyond a purely technical understanding, which is typically in product safety regulation, and encompasses legal considerations, including the extent to which fundamental rights may be affected.Footnote 69 Even though the MDR mentions fundamental rights once in its recitals, this isolated mention does not render it a framework that primarily focuses on fundamental rights. Similarly, the categories in the MDR are not shaped or differentiated with regard to the safeguarding of fundamental rights, focusing rather on safety alone. Hence, unlike the AI Act, the MDR does not expressly account for risks to fundamental rights.Footnote 70
b. AI as an additional layer of risks
When classifying high-risk AI systems, Article 6(1) AI Act refers to the harmonized legislations in Annex I. Almada and Petit call this “piggy-backing” on safety regulation since the AI Act relies on the already existing sector-specific requirements. By referring to the MDR, the AI Act builds upon the existing product safety requirements for medical devices, where the “AI component” is regulated by the AI Act and the “medical device component” is regulated by the MDR. Mahler likewise notes that, although the use of medical devices already presupposes the protection of the health and safety of individuals under the MDR, equipping such devices with AI introduces additional (new) risks to health and safety. Furthermore, the harm caused by an AI system with a medical purpose is not entirely comparable with harm arising from a defective medical device without an AI component. AI systems have the potential to discriminate, perpetuate or generate (new) social inequalities, and amplify these impacts on a large scale.Footnote 71 These additional risks inherent to AI systems are covered by the horizontally applicable AI Act. Therefore, assuming that the MDR addresses these risks is unfounded, as it only regulates the product safety aspects of the device, without considering the fundamental rights aspects.
c. Arbitrariness of the dual regime
The in-house exemption under Article 5(5) MDR, which removes the obligation to undergo third-party conformity assessment, has a clear and coherent rationale within the MDR’s regulatory architecture: it enables health institutions to develop devices to meet specific clinical needs while remaining subject to the general safety and performance requirements of Annex I.Footnote 72 However, when such devices integrate AI components, the regulatory configuration changes substantially. Although medical AI systems would ordinarily fall within the high-risk category under Article 6(1) AI Act, the exemption from notified-body involvement means that the cumulative conditions required for high-risk classification are not satisfied. Consequently, AI-based in-house medical devices fall outside the AI Act’s high-risk regime and remain subject only to the MDR’s general safety requirements.
This divergence results in two markedly different levels of protection for AI systems with potentially identical clinical impact. On the one hand, as discussed in Section III.1, the exemption can be defended: in-house devices are developed and used within a controlled institutional environment, are not commercially distributed, and are managed through internal quality systems. Excluding them from the full AI Act regime reduces regulatory burden, supports rapid innovation, and allows providers to respond flexibly to unmet clinical needs that market-facing devices may not address.Footnote 73 From this perspective, the exemption promotes institutional agility and facilitates the development of tailored solutions for specific patient populations.
On the other hand, bypassing the AI Act’s safeguards raises significant concerns about the coherence, adequacy, and purpose of the EU’s AI regulatory framework. The AI Act introduces obligations relating to risk management, data governance, transparency, human oversight, and accountability – obligations specifically designed to address risks associated with AI systems, such as opacity, adaptivity, and the potential for systemic error. The MDR, by contrast, does not explicitly regulate these AI-specific phenomena. As a result, in-house AI-based medical devices may expose patients to risks that remain unmitigated despite being central to the rationale of the AI Act, including algorithmic bias, insufficient external validation, lack of traceability, or unanticipated performance drift.
The resulting asymmetry highlights the arbitrariness of the dual regime. The AI Act is grounded in a horizontal, risk-based approach centred on fundamental-rights protection, whereas the MDR remains a product-safety framework focused on performance and clinical efficacy. Since the MDR does not integrate the fundamental-rights-oriented logic of the AI Act, extending the in-house exemption to AI systems raises doubts as to whether the exemption provides safeguards commensurate with AI-specific risks. The divergence is further sharpened by the contrast between the MDR’s case-by-case risk classification and the AI Act’s reliance on predefined categories.Footnote 74 A device classified as Class IIa or IIb under the MDR – indicating medium to high risk – may nevertheless escape the AI Act’s high-risk designation solely because it is developed and used in-house. This outcome sits uneasily with Recital 26 AI Act, which stipulates that regulatory obligations must correspond to the intensity and scope of the risks posed.
d. Paradox of the risk categorisation under the AI Act
This regulatory configuration produces a paradox. Under the AI Act’s normative framework, systems capable of significantly affecting health, dignity, or fundamental rights should be subject to heightened scrutiny. Yet AI-based in-house medical devices, which may generate identical clinical risks, are subject only to minimal AI-specific obligations. Their regulatory treatment hinges not on their risk profile but on the contingent fact that they are developed internally within a health institution. Such a distinction is difficult to justify within a principled risk-based regime.
Consider, for example, AI software developed and used by a hospital to diagnose or recommend therapies in circumstances where no equivalent market device can provide comparable performance. Under the MDR, such a device would likely be classified as Class IIa or IIb, signalling a medium to high level of risk. Even if exempt from notified-body assessment under Article 5(5), the MDR’s classification nevertheless reflects an underlying risk that should inform the intensity of regulatory safeguards. When viewed through the lens of Recital 26 AI Act – which requires regulatory obligations to correspond to the intensity and scope of the risks posed – the obligations applicable to AI-based in-house devices appear incommensurate with the risks associated with their use. The AI Act’s requirements on establishing a risk management system in Article 9, ensuring the quality and representativeness of training and testing data in Article 10, maintaining comprehensive technical documentation in Article 11, record-keeping to guarantee traceability in Article 12, clear information and transparency in Article 13 and human oversight in Article 14 do not apply to an AI-based in-house medical device.
This discrepancy demonstrates that the combined operation of the MDR and the AI Act does not deliver a risk-commensurate level of protection for AI-based in-house medical devices. Instead, it creates a regulatory blind spot in which high-impact AI systems may operate without the safeguards the EU legislature considered necessary for high-risk AI. From a normative perspective, this gap raises fundamental questions about the coherence and legitimacy of the EU’s dual-framework model. If the European Union aims to fulfil the AI Act’s stated objectives – safeguarding fundamental rights, reducing systemic risk, and ensuring trustworthy AI deployment – then the in-house exemption cannot remain unchanged in its current form. A targeted recalibration is needed to ensure that AI-specific risks are properly addressed, irrespective of the development context. Without such reform, the EU risks entrenching a dual standard of protection that is difficult to defend within the AI Act’s own risk-based rationale.
IV. Tracing future directions: simplifying the MDR and AI Act?
In December 2025, the European Commission introduced a series of initiatives aimed at strengthening public health across the European Union.Footnote 75 One of these initiatives is the proposed amendment aimed at simplifying the requirements of the MDR and IVDR. The in-house exemption is likewise intended to be made more flexible by allowing health institutions established in the European Union to transfer their in-house medical device to a different entity, if this is in the interest of patient safety, patient health or public health. Since these justification grounds can be interpreted broadly, the whole ecosystem might change and render the in-house exemption the rule rather than the exception.
The European Commission also proposes relocating the MDR from Section A to Section B of Annex I of the AI Act. At first glance, this shift may not appear to entail significant changes since the AI systems will still be considered high-risk. However, the applicable requirements for these systems will be significantly reduced. The requirements for risk management, data governance, transparency, human oversight, and post-market monitoring will no longer apply to AI-based medical devices. This implies that not only will in-house AI-based medical devices be classified as low-risk and effortlessly transferable to another entity, but the high-risk AI-based medical devices will also no longer be required to comply with the core requirements of the AI Act. Whether this shift reflects an underlying assumption by the European Commission that AI-based medical devices are not as inherently risky as previously thought and therefore do not warrant stringent oversight, or whether it stems from the view that the MDR already incorporates the core requirements of the AI Act, rendering parts of the AI Act redundant, remains an open question.
Were these modifications to move forward – meaning both the modification to the MDR, which would extend the in-house devices exemption and the disapplication of the AI Act requirements to AI-based medical devices regulated under the MDR – the European Commission is readjusting the normative internal inconsistency highlighted above between AI-based medical devices and in-house AI-based medical devices. However, it would show a logical inconsistency, pre-empting the AI Act’s stated objectives – safeguarding fundamental rights, reducing systemic risk, and ensuring trustworthy AI deployment – which motivated the creation of the AI Act in the first place, as the MDR regime would be considered enough to respond to AI-specific risks.
Pending clarity on whether the proposed amendments will ultimately move forward, there is another way to address what appears to be a de facto regulatory gap for AI-based in-house medical devices. A politically feasible path would preserve the innovation flexibility currently afforded to hospital developers while strengthening safety and accountability expectations for in-house AI systems. Rather than reopening fragile legislative compromises by subjecting hospital-developed tools to the full compliance architecture of the AI Act, oversight could be reinforced through existing governance levers that regulators and payers already control – such as hospital accreditation, quality assurance frameworks, and public funding conditions. Embedding AI development standards within these mechanisms – through recognised standards bodies, professional societies, and accreditation criteria – would allow safeguards to evolve incrementally, without provoking institutional resistance or legislative delay.Footnote 76
An alternative, and potentially complementary, approach emphasises structured, institution-level governance for in-house AI development, consistent with recent proposals in the AI in healthcare literature. Under this model, hospitals would not merely benefit from regulatory flexibility but would explicitly internalise stewardship of AI systems across their lifecycle by establishing multidisciplinary oversight committees, formalised data governance structures, and continuous post-deployment monitoring processes embedded in clinical practice. Such an approach echoes the European Responsible AI Development (EURAID) framework proposed for in-house clinical AI, which calls for collaborative, human-centric governance that spans design, deployment, and ongoing evaluation while remaining compatible with European values and existing regulatory expectations.Footnote 77
In this sense, strengthening oversight of hospital-developed AI need not require sweeping legislative reform. Instead, it can be pursued as part of a broader and already necessary transition toward trustworthy AI in healthcare – aligning innovation, institutional accountability, and public trust without destabilising the regulatory architecture currently in place.
V. Conclusion
This paper examined the in-house exemption regime under the MDR and its interplay with the AI Act. It has been demonstrated that, because the in-house exemption removes the obligation of third-party conformity assessment under the MDR, AI-based in-house medical devices fail to meet the cumulative conditions laid down in Article 6(1) of the AI Act and therefore escape classification as high-risk AI systems. This triggers the non-application of AI-specific requirements laid out in the AI Act, leaving a safety gap when it comes to in-house developed AI systems. The analysis examined whether this regulatory outcome reflects a deliberate legislative choice aimed at preserving a beneficial in-house exemption regime to favour health institutions or whether this is an unintended de facto legal loophole.
To address this question, multiple perspectives have been examined, with the corresponding arguments critically evaluated, weighted, and, where appropriate, refuted. The arguments advanced in favour of a “reasonable exemption,” grounded in innovation policy, research facilitation and the traditional rationale of the in-house exemption, were shown to have limited explanatory power once AI systems are put into service in real clinical settings. An examination of the AI Act’s research exemptions, regulatory sandboxes, testing-in-real-world-conditions regime and the concept of “putting into service” indicates that AI-based in-house medical devices do not fall within any intended derogation under the AI Act.
Accordingly, the current regulatory outcome is best understood as a legal loophole arising from the cumulative design of the MDR and the AI Act rather than as an intentional preservation of a beneficial regime. This loophole undermines the AI Act’s risk-based architecture and creates an arbitrary dual standard, whereby AI systems with comparable clinical impact are subject to markedly different levels of AI-specific oversight solely on the basis of their development context. From a normative perspective, maintaining such regulatory asymmetry is difficult to reconcile with the AI Act’s objectives of safeguarding fundamental rights and ensuring trustworthy AI in high-risk domains such as healthcare.
Ongoing initiatives, including the Digital Omnibus and targeted amendments to the MDR – briefly presented in the previous paragraph – may soon reshape this regulatory landscape. If the proposed amendments do not proceed, a possible way to preserve the rapid innovation pathways available to hospital developers while raising baseline safety expectations for in-house AI would be embedding development-stage AI governance within existing accreditation, funding, and quality-assurance frameworks, to offer a politically feasible route to strengthen oversight without reopening complex regulatory compromises or deterring clinically valuable innovation.
Competing interests
Eylem Karakaya and Sofia Palmieri declare none. Elisabetta Biasin is a Member of the European Commission’s Healthcare Cybersecurity Advisory Board.
Open access
