EU AI Act & GDPR Compliance for Medical AI Systems in NL

Important notice: this article contains general information about regulatory frameworks applicable to AI in healthcare. It is not medical advice, legal advice, or official regulatory guidance. The specific classification, compliance obligations, and risk assessments for any given AI system must be determined by qualified legal, regulatory, and data-protection professionals in light of the specific facts. Always consult your legal counsel, data protection officer, and notified body before deploying AI in a clinical setting.

EU AI Act Healthcare Compliance High-Risk: Why Medical AI Is Under Scrutiny

The intersection of artificial intelligence and healthcare is one of the most tightly regulated areas in the European Union. Dutch hospitals, diagnostic centres, GP practices, and digital health companies that develop or deploy AI-powered clinical tools face a layered compliance landscape that has grown substantially more demanding since 2024. Three frameworks sit at the centre of that landscape: the EU AI Act (Regulation 2024/1689), the EU Medical Device Regulation (MDR, Regulation 2017/745), and the General Data Protection Regulation (GDPR, Regulation 2016/679), implemented in the Netherlands through the Uitvoeringswet AVG (UAVG).

Understanding how these three frameworks interact — and where they diverge — is the starting point for any responsible EU AI Act healthcare compliance high-risk programme. This guide explains the regulatory landscape, identifies the most common compliance gaps, and outlines the practical steps Dutch healthcare organisations should take before deploying medical AI.

Crux Digits is a vendor-neutral AI consultancy based in Utrecht. We help Dutch healthcare organisations design, build, and deploy AI systems that meet the requirements of the EU AI Act, EU MDR/IVDR, and GDPR across the full project lifecycle — from initial risk classification through technical implementation, data governance, and post-market monitoring. We do not sell proprietary AI products; we help organisations choose and deploy the right solutions for their specific clinical and compliance context. Visit our healthcare practice page to learn more.

How the Three Frameworks Interact for Medical AI in the Netherlands

Before examining each framework in detail, it is useful to understand how they relate to one another. The EU AI Act, the EU MDR/IVDR, and the GDPR are not mutually exclusive — they overlap, and compliance with one does not guarantee compliance with the others.

The EU AI Act is a horizontal regulation that applies across all sectors. It classifies AI systems by risk level and imposes obligations on both providers (those who develop or place AI systems on the market) and deployers (organisations that use AI systems in a professional context). For healthcare AI, the Act introduces a category of high-risk AI systems that face the most demanding requirements.

The EU MDR and IVDR are sector-specific regulations governing medical devices and in vitro diagnostic devices respectively. Many AI-powered clinical tools — particularly those that assist in diagnosis, prognosis, or treatment selection — qualify as medical devices or in vitro diagnostics under these regulations. Where an AI system falls under both the EU AI Act and the MDR/IVDR, certain EU AI Act obligations are satisfied by compliance with the MDR/IVDR, but the two frameworks must both be addressed.

The GDPR (AVG in Dutch) applies whenever personal data is processed. Health data is classified as a special category of personal data under Article 9 GDPR, attracting enhanced protections. Any medical AI system that processes patient data — which is virtually all of them — must comply with the GDPR. In the Netherlands, the UAVG and the Wet op de geneeskundige behandelingsovereenkomst (WGBO) add further obligations specific to medical records and clinical data processing.

Does the EU AI Act Classify Medical Diagnostic AI as High-Risk, and What Compliance Steps Are Needed?

This is the question that most Dutch healthcare IT leaders and compliance officers are grappling with, and it deserves a direct answer.

Yes, many medical AI systems are classified as high-risk under the EU AI Act. Annex III of the Act lists the categories of AI system that are automatically classified as high-risk. Two categories are directly relevant to healthcare:

• AI systems intended to be used as medical devices, or as safety components of medical devices, within the meaning of EU MDR (Regulation 2017/745) and EU IVDR (Regulation 2017/746). This includes AI-powered diagnostic imaging analysis, AI-assisted pathology tools, AI-driven ECG interpretation, and any AI system that influences clinical decisions about individual patients.
• AI systems used in the management and operation of critical infrastructure that includes healthcare systems — for example, AI tools used in hospital resource allocation or patient triage at scale.

High-risk classification triggers a substantial set of compliance obligations under the EU AI Act. The key steps for Dutch healthcare organisations are:

• Confirm classification. Work with legal counsel to determine whether your specific AI system meets the definition of a medical device under MDR/IVDR or otherwise falls within Annex III. The intended purpose and the claims made about the system are decisive — not just its technical architecture.
• Conduct a conformity assessment. High-risk AI systems must undergo a conformity assessment before being placed on the market or put into service. For AI systems that are also medical devices, this assessment is aligned with the MDR/IVDR conformity assessment process, which may require involvement of a Notified Body.
• Establish a quality management system. Providers of high-risk AI systems must implement and maintain a quality management system covering design, development, risk management, testing, and post-market monitoring.
• Prepare technical documentation. Comprehensive technical documentation must be maintained demonstrating compliance with EU AI Act requirements, including the system description, risk management measures, data governance practices, testing results, and performance metrics.
• Register in the EU database. High-risk AI systems must be registered in the EU AI Act database maintained by the European Commission before deployment.
• Implement human oversight mechanisms. The AI system must be designed and deployed so that a qualified human — typically the treating clinician — can understand, monitor, and override the system output. AI supports clinical decision-making; it does not replace clinical judgement.
• Establish post-market monitoring. Providers and deployers must monitor system performance after deployment and report serious incidents to the relevant national competent authority.

The full text of the EU AI Act is available from EUR-Lex (Regulation 2024/1689). Dutch healthcare organisations should also monitor guidance from the Netherlands Enterprise Agency (RVO) and the relevant national supervisory authorities as implementation guidance develops.

EU MDR and IVDR: When Medical AI Becomes a Medical Device

The EU Medical Device Regulation (MDR, Regulation 2017/745) and the In Vitro Diagnostic Device Regulation (IVDR, Regulation 2017/746) define medical devices and in vitro diagnostics broadly. An AI software application can qualify as a medical device if it is intended by its manufacturer to be used for the diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease in individual patients.

The European Commission has published guidance on the qualification and classification of Software as a Medical Device (SaMD) under the MDR. The key principle is that software intended to influence clinical decisions about individual patients — as opposed to software intended for population-level analytics or administrative purposes — is more likely to qualify as a medical device. An AI system that analyses a chest X-ray to detect nodules and presents findings to the radiologist for diagnostic use is likely to qualify. An AI system that schedules radiology appointments is unlikely to qualify.

Where an AI system qualifies as a medical device under the MDR, the following obligations apply:

• CE marking. The device must carry a CE mark, demonstrating conformity with the MDR, before it is placed on the EU market. For higher-risk devices (Class IIa, IIb, or III under the MDR risk classification), a Notified Body must be involved in the conformity assessment.
• Clinical evaluation. The manufacturer must conduct and document a clinical evaluation demonstrating that the device performs as intended and that its benefits outweigh its risks in the intended clinical context. For AI medical devices, clinical evaluation must address algorithm performance on the specific patient population for which the device is intended.
• Post-market clinical follow-up. After CE marking, manufacturers must proactively collect clinical data from the deployed device and update the clinical evaluation accordingly.
• Unique Device Identification (UDI). Medical devices must be registered in the European database for medical devices (EUDAMED) and carry a unique device identifier.
• Vigilance and incident reporting. Manufacturers and healthcare institutions that use medical devices must report serious incidents to national competent authorities — in the Netherlands, the Inspectie Gezondheidszorg en Jeugd (IGJ).

The relationship between the EU AI Act and the EU MDR is one of partial overlap. The European Commission has confirmed that for AI systems regulated as medical devices under the MDR, certain EU AI Act requirements are deemed satisfied by compliance with the MDR. However, this alignment is partial and the specifics depend on the classification of the system. Legal advice is essential to navigate the interaction.

Crux Digits works with specialist medical device regulatory consultants to support clients navigating MDR classification and conformity assessment. Our AI implementation services are designed with regulatory compliance as a first-class requirement, not an afterthought.

GDPR and Special-Category Health Data: What Dutch Clinics Must Address

Health data is classified as special-category personal data under Article 9 of the GDPR (Article 9 AVG), attracting significantly enhanced protections compared to ordinary personal data. Processing special-category data is prohibited by default, and can only be lawful on the basis of one of the exceptions listed in Article 9(2).

For medical AI systems in a clinical context, the most relevant exception is Article 9(2)(h): processing necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care, or the management of health or social care systems. In the Netherlands, this exception is given effect by the UAVG and the WGBO, which together define the conditions under which healthcare providers may process patient health data.

Key GDPR medical AI data Netherlands compliance requirements include:

• Data Protection Impact Assessment (DPIA). A DPIA is legally required under Article 35 GDPR before deploying any AI system that involves large-scale processing of special-category health data or systematic and extensive evaluation of personal aspects by automated means — both of which apply to most medical AI systems. The DPIA must identify the risks to data subjects and document the measures taken to address those risks. In the Netherlands, the Autoriteit Persoonsgegevens has published guidance on when a DPIA is required and how to conduct one.
• Legal basis. The legal basis for processing must be documented before the system goes live. For clinical AI, the basis is typically Article 6(1)(c) or (e) combined with Article 9(2)(h) GDPR, supported by the relevant UAVG provisions. Your data protection officer (DPO) should confirm the legal basis for your specific processing context.
• Data minimisation. Only the minimum personal data necessary for the specific clinical purpose may be processed. For AI systems that use patient data for model training or improvement, separate consent or another legal basis is typically required, and the training data pipeline must be addressed explicitly.
• Data residency and international transfers. Health data processed by medical AI systems should, as a default position for Dutch healthcare organisations, be kept within the European Economic Area. Transfers to third countries require a valid transfer mechanism under Chapter V GDPR — standard contractual clauses, adequacy decision, or binding corporate rules. The Autoriteit Persoonsgegevens publishes guidance on health data processing and international transfers at autoriteitpersoonsgegevens.nl.
• Data Processing Agreements. Any AI vendor, cloud infrastructure provider, or other third party that processes patient data on behalf of your organisation must be a contractually documented data processor (verwerker) under a Data Processing Agreement (verwerkersovereenkomst). This must be in place before any live patient data is processed.
• Retention and deletion. Medical records in the Netherlands are subject to a minimum fifteen-year retention period under the WGBO. Data processed by AI systems that does not form part of the patient record — such as intermediate inference outputs, logs, or model inputs — must be retained only as long as necessary and then securely deleted.
• Transparency and patient rights. Patients have the right to be informed about automated processing that significantly affects them. Where a medical AI system influences clinical decisions, information about the AI system's role should be included in the privacy notice provided to patients.

Crux Digits provides data engineering and data governance support to help healthcare organisations design compliant data pipelines for medical AI, including DPIA-ready data flow documentation, processor inventory management, and data residency architecture.

DPIA for Medical AI: A Practical Checklist

A Data Protection Impact Assessment (DPIA — Gegevensbeschermingseffectbeoordeling in Dutch) is not optional for most medical AI deployments. The following checklist reflects the key components that the Autoriteit Persoonsgegevens expects to see in a DPIA for high-risk AI processing in healthcare. This is general guidance and does not substitute for professional data-protection advice.

• Describe the processing operation: what data is processed, for what purpose, by what means, and by whom.

• Confirm the legal basis under Article 6 and the exception under Article 9(2) that applies to special-category health data.
• Identify all parties in the processing chain: internal teams, AI vendors, cloud infrastructure providers, integration middleware, and sub-processors.
• Map data flows: where data originates, how it is transmitted, where it is stored, how long it is retained, and how it is deleted.
• Assess risks to data subjects: unauthorised access, data breach, re-identification from de-identified data, discriminatory outputs from biased AI models, and errors in AI-assisted clinical decisions.
• Document technical and organisational measures: encryption in transit and at rest, access controls and audit logging, pseudonymisation, model bias testing, human oversight mechanisms, incident response procedures.
• Assess necessity and proportionality: could the clinical objective be achieved with less data or a less invasive technical approach?
• Consult the DPO: the DPO must be formally consulted during the DPIA process.
• Consult the supervisory authority if residual risk remains high after mitigation measures: the Autoriteit Persoonsgegevens offers prior consultation under Article 36 GDPR in such cases.
• Review and update the DPIA regularly as the system evolves and new risks emerge.

Responsible AI in Healthcare Netherlands: The Human Oversight Principle

Across all three regulatory frameworks — the EU AI Act, the EU MDR, and the GDPR — a common thread runs: responsible AI in healthcare Netherlands means AI that supports clinicians, never replaces them. This principle is not merely aspirational; it is a hard legal and ethical requirement.

Under the EU AI Act, high-risk AI systems must be designed so that the humans overseeing the system can effectively monitor its operation, understand what it is doing and why, intervene to stop or override it, and avoid over-reliance on AI outputs. Under the EU MDR, clinical AI tools must have a demonstrable benefit-risk profile, and the clinical evaluation must address how human oversight is maintained in practice. Under the GDPR, significant automated decisions affecting individuals — including decisions that influence clinical management — must be subject to meaningful human review.

In practical terms, this means:

• AI diagnostic tools present findings as decision support, clearly labelled as AI-generated, for clinician review — not as definitive diagnoses.
• Clinicians must be trained not only on how to use the AI system, but on its limitations, failure modes, and the specific contexts in which it is and is not reliable.
• Override mechanisms must be built into the clinical workflow so that a clinician who disagrees with an AI output can easily document their reasoning and proceed on their own clinical judgement.
• AI outputs that influence the patient record must be reviewed and approved by a qualified clinician before being saved — no fully autonomous writing to medical records.
• Performance monitoring after deployment must include tracking of cases where clinicians override AI outputs, to identify systematic errors or drift in model performance.

Crux Digits designs every medical AI system around this principle. Our computer vision implementations for diagnostic imaging — which analyse X-rays, CT scans, and other imaging modalities — are always built with explicit clinician review steps, override capabilities, and audit trails. We do not deploy autonomous clinical decision systems.

Data Governance for Medical AI: Building the Right Foundation

Robust data governance medical AI clinic practice is not just a compliance requirement — it is a precondition for building AI systems that are accurate, fair, and safe. Poor data governance at the design stage creates compliance risk, model bias, and safety failures that are expensive and sometimes impossible to remediate after deployment.

The key data governance questions for any medical AI project in the Netherlands include:

• Training data provenance. Where does the training data come from? Was it collected with appropriate consent or a valid legal basis for AI training? Does it represent the Dutch patient population for which the model will be used? Is it appropriately diverse in terms of age, sex, ethnicity, and clinical presentation?
• Labelling and ground truth. How were training data labels created? Were they generated by qualified clinicians? What inter-rater agreement was achieved? Label quality is a primary driver of model quality.
• De-identification and pseudonymisation. Has patient data used in training been appropriately de-identified or pseudonymised? What is the re-identification risk from the de-identified dataset, particularly if the dataset is small or highly specific?
• Bias assessment. Has the training dataset been assessed for demographic biases that could cause the model to perform differently — or worse — for specific patient subgroups? For diagnostic AI, a model that performs less accurately on elderly patients, women, or non-white ethnic groups is not merely a fairness problem — it is a patient safety problem.
• Data lineage and version control. As the model is retrained or fine-tuned, is there a clear record of which dataset version was used for each model version? This is essential for post-market monitoring and incident investigation.
• Production data pipeline. How is live patient data processed at inference time? Is it encrypted in transit and at rest? Who has access to the inference inputs and outputs? How long are they retained?

Crux Digits supports healthcare clients with the full data engineering stack for medical AI — from data pipeline design and de-identification tooling through to model monitoring and data lineage documentation. Our data engineering practice treats compliance as an architectural requirement, not a post-hoc audit.

Common Compliance Gaps in Dutch Healthcare AI Deployments

Based on the patterns we see across Dutch healthcare AI projects, the following compliance gaps are most commonly identified during initial assessments. This list is not exhaustive — the specific gaps in any deployment depend on the system, the organisation, and the clinical context — but it provides a useful starting point for a compliance review.

• Missing or inadequate DPIA. The DPIA is either not conducted before deployment, or is conducted as a paper exercise rather than a genuine risk assessment. Regulators across the EU are increasingly scrutinising DPIA quality, not just existence.
• Incorrect classification under EU AI Act. Organisations assume their AI system is not high-risk without conducting a structured classification exercise. The intended purpose and clinical claims determine classification, not the technical architecture.
• MDR applicability not assessed. AI systems that influence individual clinical decisions are deployed without assessing whether they qualify as medical devices under the MDR and therefore require CE marking.
• Data Processing Agreements absent or outdated. AI vendors and cloud providers are used without valid DPAs in place, or DPAs exist but do not cover the specific processing activities undertaken by the AI system.
• Training data legal basis undocumented. Patient data is used to train or fine-tune models without a documented legal basis for AI training use, separate from the legal basis for clinical care.
• Human oversight mechanisms inadequate in practice. Human oversight is documented in the system design but not enforced in the clinical workflow — clinicians rubber-stamp AI outputs without meaningful review.
• Post-market monitoring absent. AI systems are deployed and then left unmonitored. Model performance may drift over time as patient populations and clinical practice evolve.

If any of these gaps apply to your organisation, contact Crux Digits to discuss a structured compliance assessment. We also offer transparent pricing guidance for our advisory and implementation engagements so you can assess feasibility before committing.

How Crux Digits Helps Dutch Healthcare Organisations Deploy Medical AI Compliantly

Crux Digits is a vendor-neutral AI consultancy and software studio based in Utrecht. We help Dutch healthcare organisations — hospitals, specialist clinics, diagnostic centres, GP federations, and digital health companies — navigate the EU AI Act, EU MDR/IVDR, and GDPR as they design, procure, and deploy medical AI systems.

Our approach is structured around four phases:

Phase 1 — Regulatory classification and risk assessment. We work with your clinical, legal, and compliance teams to classify the AI system under the EU AI Act and EU MDR/IVDR, identify the applicable conformity assessment route, and scope the DPIA. This phase produces a clear compliance roadmap before any technology commitment is made.

Phase 2 — Architecture and data governance design. We design the technical architecture with compliance requirements built in from the outset — data flows, encryption, access controls, de-identification, residency, retention, and audit logging. We produce DPIA-ready data flow documentation for review by your DPO and legal counsel.

Phase 3 — Build, integration, and validation. We implement the AI system, integrate it with your clinical systems and EHR, and conduct technical validation. For AI systems regulated as medical devices, we support the clinical evaluation process by providing technical documentation aligned with MDR requirements. We do not certify AI systems as medical devices ourselves — that requires a Notified Body — but we ensure the technical deliverables meet the evidence requirements for certification.

Phase 4 — Deployment, training, and post-market monitoring. We deploy the system in a controlled clinical environment, train clinical and technical staff, and establish post-market monitoring processes including performance dashboards, override tracking, and incident reporting workflows.

Browse our case studies to see examples of how we have delivered compliant AI implementations in complex, regulated environments. If you are planning a medical AI project and want to understand the compliance requirements before committing to a technology or vendor, get in touch for an initial conversation.

Frequently Asked Questions

Frequently asked questions