Scope of distributors’ verification obligations

Tag: MDR

ECJ on the scope of distributors’ verification obligations – Case C-10/24

In its judgment of 4 June 2026, the Court of Justice of the European Union (ECJ) clarified for the first time the scope of distributors’ verification obligations under Regulation 2017/745 (MDR).

A. Facts of the case

The judgment arose from a competition law dispute between Dürr Dental and Cattani Deutschland concerning dry air compressors distributed by the latter in Germany. During two test purchases (in November 2020 and early 2021), Dürr Dental found that, whilst the compressors distributed by Cattani Deutschland bore a CE marking, this referred exclusively to the EC Machinery Directive (Directive 2006/42/EC) and not to the MDR applicable to medical devices; furthermore, the four-digit identification number of a Notified Body was missing. At its core, the case concerned the testing obligations regarding the CE marking of products in accordance with Article 14(2) subpara. 1 lit. a MDR, as well as the prohibition on making products available in accordance with Article 14(2) subpara. 3 MDR, in the event that the distributor has reason to believe that the products are non-compliant.

The legal dispute reached the Federal Court of Justice (BGH), which referred several questions of interpretation to the ECJ for a preliminary ruling.

B. Key grounds for the ECJ’s ruling

The ECJ had to rule on a total of five preliminary questions. This article focuses on the first and second questions referred.

I. First and second questions referred

The first and second questions referred for a preliminary ruling concerned the scope of a distributor’s duty to verify the CE marking – in particular, whether a distributor must verify whether the product supplied falls within the scope of the MDR at all, and whether it is relevant in this respect that the manufacturer has affixed a CE marking designating the product as a ‘machine’ within the meaning of Directive 2006/42. It was undisputed that the compressors were to be regarded as accessories to a medical device within the meaning of the MDR and had therefore in fact been incorrectly qualified.

The ECJ reached the following conclusion in this regard: Article 14(1) and (2) subpara. 1 lit. a MDR must be interpreted as meaning that, as part of their duty of care, distributors must assess, on the basis of the information available to them, whether the CE marking and the EU declaration of conformity for the product they place on the market obviously relate to a product falling within the scope of the MDR.

Under Article 14(1) MDR, when placing a product on the market, distributors must, in the course of their activities, ‘act with due care in relation to the requirements applicable’. Article 14(2 subpara. 1 MDR stipulates that, before placing a product on the market, distributors must, amongst other things, verify that

  • the product bears the CE marking and,
  • an EU declaration of conformity has been issued for the product,
  • the product is accompanied by the required information,
  • the importer complies with the requirements specified for the product and,
  • where applicable, a Unique Device Identification (UDI) system has been assigned by the manufacturer.

According to the ECJ, the wording of the provision merely indicates that the distributor must verify whether a CE marking and an EU declaration of conformity exist for the product in question, but not whether their content is correct. Both the affixing of the CE marking and the issuance of the EU declaration of conformity fall within the sole responsibility of the manufacturer of the product (Article 10(6) MDR in conjunction with Articles 19 ff. MDR). Consequently, the obligation to verify a product’s conformity with the applicable regulations generally falls within the responsibility of the manufacturer and not the distributor.

Nevertheless, pursuant to Article 14(2), subpara. 3, sent.1, half-sent. 1 MDR, a distributor must not make a product available if they believe, or have reason to believe,

II. Third question referred for a preliminary ruling

With regard to the third question, the ECJ concluded that Article 14(2), subpara.1lit. a MDR, read in conjunction with Article 14(1) MDR, ‘must be interpreted as meaning that a distributor is not obliged to verify whether the device it places on the market falls within risk class IIa within the meaning of that Regulation and must therefore be marked with a four-digit identification number issued by a Notified Body. However, if the information available to the distributor indicates that the manufacturer has classified this product into a risk class requiring the involvement of a Notified Body, the distributor’s duty of care includes verifying whether the four-digit identification number of that body is present.’

III. Fourth and fifth questions referred

With regard to the fourth and fifth preliminary questions, the ECJ concluded that Article 14(2) subpara. 3 MDR ‘must be interpreted as meaning that a distributor may have grounds to believe that a product does not comply with Regulation 2017/745 if a competitor issues a warning to the distributor regarding the non-compliance of that product. If the manufacturer, when consulted by the distributor, considers that the alleged non-conformity does not exist, the distributor cannot be held to have breached its obligations under that provision by endorsing the manufacturer’s opinion, unless that opinion appears to the distributor to be manifestly incorrect. Where the distributor has informed the competent national authority in accordance with this provision, any doubts expressed thereby as to the conformity of the product in question shall be unreservedly dispelled by a reasoned and unequivocal statement from that authority refuting the alleged non-conformity.’

C. Classification under product law

I. MDR

The ECJ has confirmed that there is an obligation to verify compliance under the MDR. However, this is not a new finding, as this is precisely what is laid down in Article 14(2) subpara. 2 lit. a MDR. What is decisive, rather, is the scope of this obligation to verify: Is this a purely formal obligation to verify that a CE marking is present and an EU declaration of conformity has been issued, or must the distributor, as part of their duty of care, also assess the accuracy of the content?

The conclusion is clear with regard to the MDR: the verification obligations must be fulfilled as part of a ‘consistency check’. Since the MDR – unlike other harmonisation acts – does not require the EU Declaration of Conformity to be attached to the product, the distributor must actively request it in order to be able to fulfil their primary duty of verification at all. Consequently, the distributor must in any case examine all documentation and, logically, take action in the event of obvious discrepancies, as the duty of verification would otherwise be rendered meaningless. This is in line with Article 14(2) subpara. 3 sent. 1 MDR: according to this provision, a distributor may not make a product available on the market if they have reason to believe, or consider, that it is non-compliant; furthermore, they must inform the manufacturer accordingly.

II. Scope beyond the MDR

Although the ECJ has provided clarity with regard to the MDR, it is not possible to infer from the judgement a generalised duty to check or even investigate in relation to other harmonisation acts. A duty to check can only exist where it is laid down by law – as is the case in the MDR. In fact, however, obligations on distributors comparable to those in Article 14 MDR exist in almost all other (non-food) product sectors. It should also be noted that the distributor has a formal duty to verify solely on the basis of the documents and information readily available to them. This is the essence of the ‘coherence check’, which is ultimately a plausibility check. If an EC or EU declaration of conformity is not supplied with the product – as is the case, for example, under the EC Toys Directive (Directive 2009/48/EC) or the new EU Packaging Regulation (PPWR) – the trader cannot be expected from the outset to request and verify it without good reason. This applies all the more so where the trader – as under the PPWR – is not required to check the necessary documentation in the first place. Any duty to investigate, if it exists at all, would only arise where there are indications of potential discrepancies, for example in the form of a warning letter from a competitor. Consequently, the position remains that, whilst retailers must check whether a product is correctly classified in other product sectors or – with regard to the EU General Product Safety Regulation (GPSR) – in the area of non-harmonised consumer products, this check does not go beyond a simple verification of the evidence provided. In the absence of, for example, a warning letter from a competitor or an obviously incorrect product classification, the retailer may, in principle, assume that the manufacturer’s product classification is correct, particularly as the manufacturer has the best knowledge of its own product.

D. Outlook

With regard to the first and second questions of interpretation, the ECJ has held that the question of the extent to which the distributor is required, under the MDR, to verify whether the CE marking to be affixed by the manufacturer is manifestly incorrect must be answered on a case-by-case basis, taking into account the available documentation and information, including that which is readily accessible. Irrespective of this, responsibility for the conformity of products with the MDR remains with the manufacturer. The BGH must now decide whether the distributor’s efforts in the underlying case were sufficient. The benchmark here is an assessment taking into account all the circumstances of the individual case. The BGH’s decision is still pending.

For further reading: Handorn, MPR 2024, 100

Do you have any questions about this news item, or would you like to discuss it with the author? Please feel free to contact: Prof. Dr. Boris Handorn, Anna Christ and Dr. Carsten Schucht

4. August 2026 Prof. Dr. Boris Handorn & Anna Christ
Bild Prof. Dr. Boris Handorn
Prof. Dr. Boris Handorn
Lawyer / Partner
Bild Anna Christ
Anna Christ
Lawyer

You may also be interested in:

Digital-Omnibus: Medical Devices to remain under dual AI regulation

On May 7, 2026, the European Council and the European Parliament reached a provisional political agreement on simpler, more innovation-friendly rules for artificial intelligence (AI) as part of the “Digital Omnibus on AI.”

For manufacturers of medical devices and in vitro diagnostics, this agreement sets an important – and challenging – course: Contrary to expectations, an exemption for AI-based medical devices was not adopted under the AI Regulation.

A. Background

Regulation (EU) 2024/1689 (AI Act) classifies certain AI systems as so-called high-risk AI systems and thereby subjects them to extensive substantive requirements (Chapter III, Section 2 of the AI Act). Medical devices containing AI components fall into this category under Article 6(1) AI Act, provided they are subject to conformity assessment by a Notified Body.

As part of the ongoing reform of the MDR/IVDR (COM (2025) 1023 final), it was planned to move medical devices from Annex I, Section A to Section B of the AI Act. This change would have resulted in the application of Article 2(2) of the AI Act, with the consequence that AI-based medical devices, despite being classified as high-risk AI systems under Article 6(1) AI Act, would no longer have been required to meet the substantive requirements under Article 8 ff. Ai Act (Chapter III, Section 2). This proposed amendment was not adopted as part of the Digital Omnibus. Such a transfer occurred only for the Machinery Regulation.

B. Consequences for Medical Devices

This decision has several consequences for medical devices.

I. Dual compliance burden remains

AI-based medical devices continue to be subject to the substantive requirements under Article 8 ff. AI Act (Chapter III, Section 2), in addition to the requirements of the MDR and IVDR.

This applies in particular to medical devices of classes IIa, IIb, and III, as well as IVDs of IVDR classes A–D, insofar as they contain AI components. Manufacturers of these devices will have to meet the following AI-specific requirements in addition to their existing MDR or IVDR obligations:

  • An AI-specific risk management system that operates in parallel with ISO 14971
  • Extended technical documentation in accordance with Annex IV of the AI Regulation
  • Extended QMS procedures in accordance with ISO 13485
  • AI-specific post-market surveillance

Although conformity assessment can be consolidated into an integrated procedure, it must be carried out by a Notified Body that is notified under both the AI Act and the MDR/IVDR.

The original problem of extensive regulatory overlap between the AI Regulation and the MDR/IVDR thus remains, for the time being, both formally and structurally. The Digital Omnibus provides that exemptions may be created in the future through implementing acts. However, until such implementing acts are adopted, it remains unclear how the conflict will be resolved. This is particularly relevant in practice because AI-based medical devices are already on the market today.

II. New Deadlines

The Digital Omnibus has postponed the effective date for high-risk AI systems under Article 6(1) AI Act —and the associated obligations—by one year: Instead of the originally planned August 2, 2027, the new effective date is August 2, 2028.

III. Registration Requirement

The agreement of 7 May 2026 on the Digital Omnibus reintroduces the obligation for providers to register high-risk AI systems in the EU database, even if they believe their system should be exempt from classification as a high-risk system.

Next steps

The provisional agreement is not yet a final binding legal act. The Digital Omnibus package must be approved and formally adopted by both the European Parliament and the Council of the EU, as well as undergo legal and linguistic review, before it can enter into force. According to the Council, this will take place in the coming weeks.

21. May 2026 Prof. Dr. Boris Handorn & Anna Christ
Bild Prof. Dr. Boris Handorn
Prof. Dr. Boris Handorn
Lawyer / Partner
Bild Anna Christ
Anna Christ
Lawyer

You may also be interested in:

Potential implications of the Commission’s draft amendment to the MDR/IVDR for AI-based medical devices

The regulatory framework for AI-based medical devices is currently a major focus of legislative discussions.

Back in November 2025, the Commission tabled a proposal for a digital omnibus regulation on AI, which aims to relax the requirements set out in Regulation (EU) 2024/1689 (hereinafter: Artificial Intelligence Act, or AIA for short) in terms of timing. For AI systems already covered by the EU’s sectoral legislation on safety and market surveillance, it is proposed to postpone the deadline for application from 2 August 2026 to 2 August 2028. The European Parliament recently approved this postponement by a large majority on 26 March 2026. In parallel with these efforts, on 16 December 2025 the Commission published a proposal for a regulation amending the MDR/IVDR, which, among other things, is intended to largely exempt AI-based medical devices from the application of the AIA requirements. Understandably, these legislative developments are raising a fundamental question within the medtech industry: whether, and to what extent, the AIA will continue to play a regulatory role in the long term in the development and use of AI-based medical devices.

This article addresses this question. To this end, it first provides an overview of the current regulatory status of AI-based medical devices (see Section I). It then examines in more detail the Commission’s draft amending regulation to the MDR/IVDR concerning the regulation of AI-based medical devices (see Section II). The need for action by the relevant stakeholders is then discussed on the basis of a scenario analysis (see Section III). The article concludes with a summary and an outlook (see Section V).

I. Regulation of AI-based medical devices – current situation

1. Parallel application of the MDR/IVDR and the AIA

    Since its entry into force on 2 August 2024, the AIA has formed the central regulatory framework containing AI-specific requirements to regulate the use of AI in a horizontal and risk-based manner. From its (current) date of application on 2 August 2026, affected medical device manufacturers must comply with the requirements of the MDR and the AIA as soon as a medical device in the form of software (Art. 2(1) MDR) also constitutes an AI system within the meaning of Art. 2(1) AIA. The AIA is to be understood as a horizontal supplement to the (sectoral) safety and performance requirements standardised in the MDR, specifically for AI-based medical devices (software).

    Article 6 of the AIA sets out, by means of two cumulative conditions that must be met, whether or not an AI system is to be classified as a high-risk AI system. The first cumulative condition: AI systems are considered high-risk under Article 6(1)(a) in conjunction with Annex I, Section A of the AI Act if, as a product or as a safety component embedded in that product, they fall within the scope of the legislative acts listed in Annex I. Under the current regulatory framework, the MDR/IVDR is also included among the listed legislative acts. The second cumulative requirement: The AI system itself, as a product, must undergo a third-party conformity assessment with a view to the placing on the market or putting into service of that product in accordance with the legal acts listed in Annex I of the IIA (Article 6(1)(b) of the IIA). As medical device software must generally undergo a third-party conformity assessment (see current Rule 11 of the MDR), AI-based medical devices fulfil the cumulative requirements set out in Article 6(1) of the AIA and are regularly classified as high-risk AI systems.

    The consequence of this risk classification is that such medical devices must meet the substantive requirements of the AIA, which are set out in Article 8 et seq. of the AIA. These substantive requirements include, in particular, the establishment of a risk management system (Article 9 of the AIA), data and data governance (Article 10 of the AIA), the assurance of human oversight (Article 14 of the AIA), and compliance with accuracy, robustness and cybersecurity (Article 15 of the AIA). However, pursuant to Article 113(c) of the AIA, the central classification provision under Article 6(1) of the AIA and the resulting obligations (including compliance with the aforementioned substantive requirements under Article 8 et seq. of the AIA) shall only apply from 2 August 2027.

    2. Substantive overlaps and divergences

    As the MDR/IVDR already constitutes a highly regulated field in its own right, the parallel application of the AIA naturally gives rise to many overlaps in content. This applies in particular to overlaps with the substantive safety and performance requirements set out in Annex I of the MDR/IVDR. In view of this, it is not surprising that a detailed analysis of both sets of regulations reveals some substantive and conceptual divergences and inconsistencies. This stems in particular from the fact that sector-specific features, which are set out in the MDR, are not sufficiently taken into account in the horizontally structured AIA.

    II. Planned amendments under the Commission’s draft

      Due to the aforementioned overlaps and divergences in content, the Commission decided on 16 December 2025 to submit a proposal as part of the Commission draft amending the MDR/IVDR (COM (2025) 1023 final), to submit a proposal aimed at resolving the complex and, in some respects, contradictory regulatory framework in favour of a purely sector-specific regulation of AI-based medical devices.

      1. Transfer of the MDR/IVDR to Annex I, Section B of the AIA

        To this end, Article 4 of the Commission’s draft provides that the MDR and the IVDR are to be removed from Annex I, Section A of the AIA and instead added to Section B of the AIA. With this amendment, Article 2(2) of the AIA would be applicable in future. Accordingly, for AI systems classified as high-risk AI systems in accordance with Article 6(1) of the AIA and which are related to products covered by the legislative acts listed in Annex I, Section B, only

        • Article 6(1) of the AIA (concerning the classification provision for high-risk AI systems),
        • Articles 102 to 109 of the AIA (concerning the amendment of regulations by the AIA)
        • and Article 112 of the AIA (concerning the evaluation and review of the list in Annex III and the list of prohibited practices in the field of AI).

        Consequently, the regulatory implication of Article 2(2) of the AIA would be that AI-based medical devices, despite being classified as high-risk AI systems under Article 6(1) of the AIA, would no longer be required to meet the substantive requirements set out in Article 8 et seq. of the AIA (Chapter III, Section 2). Through this technical manoeuvre, the Commission aims to ensure that the matter can in future be regulated exclusively through the MDR/IVDR.

        2. Implementing and delegated powers

        The Commission also confirms this in Recital 23, paragraphs 2 and 3, of its draft. It correctly notes that the parallel application of the MDR or IVDR and the AIA could lead to overlapping requirements and thereby hinder innovation. To avoid such overlaps and simplify the legal framework for AI-based medical devices, the application of the AIA to these products is to be limited to the provisions set out in Article 2(2) of the AIA. Where necessary, the Commission may make use of its implementing and delegated powers to lay down specific requirements relating to artificial intelligence, taking into account the requirements set out in Chapter III, Section 2 of the AIA (Recital 23, p. 5 of the draft). This requirement is also reflected as a provision to be incorporated into the MDR. Pursuant to Article 1(5)(b)(8) of the Commission’s draft, which aims to recast Article 5(8) 8 MDR, the Commission is to take into account the requirements set out in Chapter III, Section 2 of the aforementioned Regulation when adopting implementing acts, delegated acts or common specifications relating to devices that use high-risk AI systems within the meaning of Article 6(1) of the AIA or high-risk AI systems as safety components.

        The solution proposed by the Commission could, in future, lead to an overall simplification of the complex regulatory framework whilst enabling the introduction of requirements tailored to the specific characteristics of the development and use of AI-based medical devices. At the same time, it must not be overlooked that Recital 23, paragraph 5 of the draft seeks to permit the addition of AI-specific requirements in the form of implementing and delegated powers only to the extent that this is ‘necessary’.

        III. Need for action by affected stakeholders?

          Against the backdrop of this Commission proposal, the question is currently and quite rightly being raised within the medtech sector as to what action is required of affected stakeholders such as medical device manufacturers – in particular, whether the requirements of the AIA should be taken into account and preparations made for compliance.

          When answering this question, the starting point is always the applicable law: under current legislation, the MDR/IVDR and AIA apply in parallel. The requirements for high-risk AI systems will apply from 2 August 2026 and 2 August 2027 respectively. This means that medical device manufacturers are already required to ensure that their AI-based products can meet the requirements by 2 August 2027 at the latest. It should also be noted that the Commission’s proposal is currently still undergoing the legislative process. As things stand, it is therefore not certain whether the Commission’s draft will be adopted in this form, and if so, whether the Commission will, in a second step, exercise its discretion at all and issue specific requirements for AI-based medical devices by means of delegated acts.

          1. Possible scenarios

            Against this background, the following scenarios arise, which affected stakeholders should currently take into account in their legal and operational decisions:

            Scenario 1: The Commission’s draft fails completely in the legislative process, meaning that the current law remains in force unchanged. Affected medical device manufacturers would therefore be obliged to comply with the requirements of the AIA in addition to those of the MDR and IVDR by 2 August 2027 at the latest. Even if the proposal for a digital omnibus regulation on AI were to succeed in the legislative process and thus delay the entry into force of the AIA, those affected would ultimately still have to comply with the requirements of the AIA.

            Scenario 2: Article 4 of the Commission’s draft successfully passes through the legislative process and is implemented without amendments. In this scenario, affected medical device manufacturers would be exempt from the obligation to comply with both the requirements of the MDR and IVDR and those of the AIA. Instead, in this scenario, AI-based medical devices would be developed and placed on the market exclusively in accordance with the provisions of the MDR and IVDR. In this scenario, the Commission continues to conclude that there is no need for further clarification in the form of implementing or delegated acts. Uncertainties regarding AI-specific issues would thus resurface, which were the initial trigger for the implementation of medical devices under the AIA.

            Scenario 3: Article 4 of the Commission’s draft successfully passes through the legislative process and is implemented without amendments. In this scenario, the Commission continues to conclude that there is a need for further clarification in the form of implementing or delegated acts. Sub-scenarios arise here regarding the content of the implementing or delegated acts:

            • Sub-scenario 1: Specific AI requirements are very closely aligned with the AIA.
            • Sub-scenario 2: Specific AI requirements are based on Chapter III, Section 2 of the AIA, but take appropriate account of the specific features of medical device law.

            2. Scenario analysis

            Whether and to what extent action is required by affected medical device manufacturers ultimately depends heavily on how the legislative process regarding the MDR reform unfolds.

            Scenario 1

              What is certain, in any case, is that gap analyses in the past have shown that the MDR/IVDR does indeed contain regulatory gaps regarding the use of AI technology; however, these should be addressed in a manner that is aligned with existing sector-specific regulations. Not least for this reason, the horizontally chosen ‘ ’ regulatory approach met with widespread opposition from the medtech industry as early as the legislative process for the AIA (see Schreitmüller, ‘Regulation of Intelligent Medical Devices’, for details). With the Commission’s current initiative, the concerns of the medtech industry raised during the legislative process for the AIA appear to have finally been heard, which is why Scenario 1 can be tentatively ruled out with cautious optimism. This is also supported by the Commission’s parallel efforts to delay the entry into force of the AIA through the proposal for a Digital Omnibus Regulation.

              Scenario 2

              This leaves scenarios 2 and 3 for the medical device manufacturers concerned. Taking into account the wording in Recital 23 of the Commission’s draft (“…where necessary…”), one might be inclined to think that the Commission assumes the MDR and IVDR are, in principle, suitable for adequately addressing AI-specific issues. However, Scenario 2 seems rather unlikely, given that the MDR/IVDR would not have been incorporated into the AIA had the Union legislator not identified any regulatory gaps from the outset.

              Scenario 3

              For these reasons, Scenario 3 appears the most likely. However, AI-specific requirements that are very closely aligned with the provisions of the AIA are very unlikely to be developed, given the complex legislative process required to provide an appropriate sectoral regulatory approach. Otherwise, the existing regulation could have been left in the AIA; a particular criticism in this context is that sector-specific characteristics are not sufficiently taken into account in the AIA, such as the requirements for human oversight, which are entirely alien to medical device law. A direct transposition of the AIA requirements into the MDR therefore seems highly implausible.

              Rather, AI-specific requirements that take sufficient and appropriate account of the specific features of medical device law are desirable and, in all likelihood, also the Commission’s long-term objective. These are expected to be drafted in such a way that they incorporate the substantive requirements underlying the AIA, at least as cornerstones for the delegated act. Affected medical device manufacturers should therefore already familiarise themselves sufficiently with the aspects of transparency, risk assessment, traceability, human oversight and data governance.

              However, it would be short-sighted to assume that AI-based medical devices will be deregulated as a result. Rather, the aim – quite rightly – is to regulate AI-based medical devices consistently and in a manner tailored to sector-specific characteristics. Even if a reduction in the substantive requirements does not appear likely at this stage, there should nevertheless remain hope that, despite numerous requirements, the nature and content of the requirements will be easier to implement, as they will be better drafted and more harmonised from a legislative perspective.

              Conclusion and outlook

                Taken as a whole, adopting a wait-and-see approach and hoping that the Commission’s proposal will be implemented into law as intended is not entirely naive; however, this initiative should not be interpreted as a measure aimed at deregulation. , AI-based medical devices will in future most likely no longer be regulated in parallel by the MDR, IVDR and AIA, but will instead be regulated at a purely sectoral level in a more granular manner than has been the case to date.

                It remains to be seen, therefore, whether the AI-specific guidelines to be developed in the future will be convincing in terms of content and quality, and whether they can lead to greater legal certainty and, ultimately, to a noticeable reduction in the regulatory burden for the medical device manufacturers concerned.

                Do you have any questions about this news, or would you like to discuss it with the author? Please contact: Dr. Zeynep Schreitmüller

                15. April 2026 Dr. Zeynep Schreitmüller
                Bild Dr. Zeynep Schreitmüller
                Dr. Zeynep Schreitmüller
                Lawyer / Associate

                You may also be interested in:

                What’s changing in 2026: Life Science

                In 2026, the developments initiated in 2025 continue. The focus remains on the draft proposal published by the European Commission on 16 December 2025 concerning the reform of the MDR and IVDR. Beyond this, digitalization continues to represent a central theme in the life sciences sector, including at the national level. In this context, particular emphasis is placed on reducing bureaucratic burdens as well as on data protection and data transparency.

                This article is the penultimate part of the blog series “What’s Changing in 2026,” in which the experts of the Produktkanzlei summarize key topics from their respective practice areas. Here, we examine the developments relating to the MDR, including the Commission’s draft amending regulation for the MDR/IVDR (see under A.). At the national level, we discuss the simplification of the conduct and approval of clinical investigations and performance studies (see under B.). Further topics include the Data Act (see under C), the AI Act in the medical device sector (see under D.), the rollout of the electronic patient record (see under E.), and updates regarding digital health applications (see under F.). Finally, we provide an overview of the changes in cosmetics law (see under G.).

                A. MDR and IVDR

                In 2026, the MDR and IVDR continue to be at the forefront of both regulatory and practical developments. The European Commission’s latest reform proposal, the expiration of transitional periods, and emerging advances in digitalization are collectively shaping the evolving regulatory landscape.

                I. Draft Reform

                On 16 December 2025, the Commission published a draft amending regulation for the MDR and IVDR. This proposal contains numerous, in part fundamental, adjustments. The overarching aim of the reform is to make the MDR/IVDR more efficient, transparent, and innovation‑friendly – without reducing the high standards for safety, quality, and patient protection. The primary focus is on simplifying and reducing the regulatory burden, which has proven substantial under the current framework.

                The intended improvements include clearer structuring of conformity assessment procedures, increased predictability, and enhanced cost‑efficiency. For example, fee reductions may be introduced for SMEs and orphan devices, and the Commission would be empowered to define the structure and amount of such fees. A new dispute‑resolution mechanism between manufacturers and notified bodies is also planned: the authority responsible for the notified body would act as an “ombudsman” in case of disagreements.

                At the same time, digitalization should be used to speed up processes and simplify communication between manufacturers, authorities and notified bodies.

                To promote innovation, the draft reform provides for the introduction of so-called ‘regulatory sandboxes’. These enable manufacturers to develop, test, validate and, if necessary, use innovative products under real conditions for a certain period of time under official supervision without having to meet all regulatory requirements.

                A particular focus lies on enhanced harmonization within the EU to avoid regulatory overlap and ensure a coherent framework. For instance, the MDR/IVDR and the AI Act are to be better aligned.

                The draft additionally introduces new information‑sharing and cooperation obligations for Member States to mitigate structural issues related to shortages. The EMA will monitor shortages and support national authorities and the Commission. Moreover, aligned with the newly effective Article 10a MDR/IVDR (early 2025), a positive list of critical medical devices shall be established, and an IT portal for reporting supply interruptions will be created.

                The public consultation runs until 16 March 2026, so comments on the draft can be submitted until then. The proposal will now be presented to the European Parliament and Council for adoption. The trilogue negotiations are planned for spring 2026. It remains to be seen whether the reform will be implemented within 2026.

                II. Transition Periods

                On 26 May 2026, the transitional period for custom‑made implantable Class III devices under the MDR ends.

                2026 also marks the end of the IVDR transition period for Class C products, for which the involvement of a notified body was already required under the IVDD. A formal application for these products must be submitted to the notified body by 26 May 2026. As a result, a written contract with a notified body must be in place no later than four months after the application is submitted, i.e. by 26 September 2026, for these products to continue to be placed on the market.

                III. Electronic Instructions for Use – eIFU

                In 2025, the scope for electronic instructions for use was significantly expanded, but only for professional users, not laypersons. On 25 June 2025, the Commission adopted Implementing Regulation (EU) 2025/1234 amending Implementing Regulation (EU) 2021/2226 regarding the types of medical devices for which instructions may be provided electronically. The amending regulation provides for a significant expansion of the scope of application of electronic instructions for use (eIFU) in place of paper instructions for use, but it is still not possible to introduce eIFU across the board for products intended for use by laypersons. Implementation remains optional for manufacturers. The implementing regulation entered into force on 26 July 2025.

                IV. EUDAMED

                On 27 November 2025, the Commission published Decision (EU) 2025/2371 on the announcement of the functionality and fulfilment of the functional specifications of certain electronic systems contained in the European Database on Medical Devices and on the declaration of functionality of the first four modules in the Official Journal of the European Union. In accordance with the transitional provisions of Regulation (EU) 2024/1860, this marks the start of the six-month transition period.

                Accordingly, the first four EUDAMED modules will become mandatory from 28 May 2026:

                • Actor registration (Art. 30 MDR / Art. 27 IVDR) — already nationally mandatory in Germany since 26 May 2021 
                • UDI database and device registration (Art. 28–29 MDR / Art. 25–26 IVDR) 
                • Notified bodies and certificates (Art. 57 MDR / Art. 52 IVDR) 
                • Market surveillance (Art. 100 MDR / Art. 95 IVDR)

                For legacy products placed on the market before 28 June 2025, an additional transition period applies: Manufacturers and distributors of systems and treatment units must have registered such existing products in the UDI/Product Module by 27 November 2026 at the latest.

                B. Simplification of Clinical Investigations and Performance Studies – Standard Contractual Clauses

                On 18 September 2025, the German Federal Government published the Regulation on on standard contractual clauses for the conduct of clinical trials (Standard Contractual Clauses Regulation – StandVKlV) for medicinal products. This regulation applies to contracts for clinical trials of medicinal products concluded on or after 17 December 2025.

                Sec. 31c of the Medical Devices Implementation Act (MPDG) also provides for the possibility of establishing standard contractual clauses for clinical trials and performance studies by means of a statutory order for medical devices and IVDs.

                The enactment of a corresponding regulation is expected in the near future in 2026. The aim is to standardise and facilitate contract negotiations for manufacturers, sponsors and trial centres.

                C. Data Act

                The Data Act (Regulation (EU) 2023/2854) entered into force in January 2024, establishing a legal framework for fair access to and use of data. Its provisions have been binding since 12 September 2025.

                In Germany, the federal government adopted a draft bill from the Federal Ministry of Digital and Public Service Modernisation on 29 October 2025. The aim is to adapt national legislation so that the provisions of the Data Act can be enforced without hindrance and violations can be effectively sanctioned. In this respect, the designation of the Bundesnetzagentur as the competent national authority (Sec. 2 of the draft) is also of central importance.

                D. Artificial Intelligence Act – AI Act

                The AI Regulation will apply from 2 August 2026. The central classification rules and requirements for high-risk AI systems will only apply from 2 August 2027, in accordance with Art. 6(1) AI Act.

                However, the Commission has now published a proposal for a digital omnibus regulation on AI in order to simplify and relax the rules. According to this omnibus proposal, the rigid application deadlines previously envisaged are to be replaced by a dynamic mechanism. For systems covered by Annex I AI Act, companies would be given 12 months longer to adapt to the changed legal situation. This also applies to the MDR and IVDR. However, the relevant obligations may apply earlier if the Commission confirms that sufficient measures to support compliance (such as harmonised standards and common specifications) are in place. The proposal is currently still in the legislative process – whether and in what form the changes will actually be implemented is currently open. Manufacturers should therefore not rely on this proposal, but should already start addressing the complex additional requirements of the AI Act.

                Irrespective of this, structural changes for medical devices in conjunction with the AI Act are to be expected in view of the planned reform of the MDR and IVDR. The Commission’s draft MDR reform provides for the MDR and IVDR, which are currently listed in Annex I of the AI Act, to be moved to Section B. As a result, the full high-risk regime of the AI Act would no longer apply directly to medical devices and IVDs, but the application of the AI Act would be limited to the horizontal provisions referred to in Art. 2(2) AI Act. At the same time, a revision of Art. 5(8) MDR is intended to clarify that the European Commission must take into account the requirements for high-risk AI systems in accordance with Chapter III, Section 2 AI Act when drafting implementing and delegated acts. As a result, the requirements of the AI Act would not be completely eliminated, but would be systematically integrated into the MDR. In this way, the Commission aims to avoid unclear overlaps between the MDR/IVDR and the AI Act.

                E. Electronic Patient Record (ePA)

                Since 1 October 2025, the use of the ePA has been mandatory for all doctors in Germany.

                From 1 January 2026, software systems that have received confirmation of conformity for the use of the ePA and are therefore ‘ePA-ready’ must be in use. Doctors who use systems that are not ePA-compatible or who cannot provide proof of using a compliant system risk having their fees reduced and their IT flat rate cut. To avoid hardship cases, the National Association of Statutory Health Insurance Physicians can issue corresponding interpretation guidelines.

                In addition, the ePA will be supplemented by a medication plan in the course of 2026. The electronic medication plan supplements the medication list with information such as dosage and instructions for use.

                F. Digital Health Applications (DiGA)

                Further developments are ongoing with regard to DiGA. On 28 October 2025, the Federal Ministry of Health published a draft bill to amend the Digital Health Applications Regulation (DiGAV).

                This draft amendment primarily takes into account applications that constitute an AI system in accordance with the AI Regulation. Furthermore, new regulations for the gradual implementation of the AbEM were defined on the basis of the legal requirements of SGB V.

                G. Changes in Cosmetics Law

                The Omnibus VI Regulation (2025/0531/COD) aims to introduce not only simplifications in chemicals legislation, but also amendments to Regulation (EC) No 1223/2009 (hereinafter “Cosmetic Regulation”). The adoption of the draft is expected later this year.

                The amendments concern, among other things, a new procedure for the inclusion of additional colourants, preservatives and UV-filters in Annexes IV, V and VI of the Cosmetic Regulation. Where it can be scientifically demonstrated that the use of a substance in a cosmetic product is safe, its inclusion should be made possible through a procedure set out in a new Article 14a Cosmetic Regulation. The timeline for this procedure is intended to be accelerated through legally defined deadlines.

                Art. 15 Cosmetic Regulation generally prohibits the use of substances classified as CMR under Regulation (EC) No 1272/2008 in cosmetic products. The changes introduced by Omnibus VI involve a substantial expansion of the possibilities for the exceptional use of such CMR substances.

                Furthermore, the notification requirement for products containing nanomaterials within the meaning of Art. 16 (3) – (7) Cosmetic Regulation is to be removed. In addition, the glossary of ingredient names is to be abolished, with future references made directly to the International Nomenclature of Cosmetic Ingredients (INCI) in order to avoid delays in incorporating new entries into the glossary.

                On 12 January 2026, Regulation (EU) 2026/78 (as part of Omnibus VIII) was adopted, amending the Cosmetic Regulation by adding newly classified CMR substances and placing them on the respective lists of prohibited, restricted or permitted substances.

                Do you have any questions about this news or would you like to discuss it with the author? Please contact: Prof. Dr. Boris Handorn and Anna Christ

                20. January 2026 Prof. Dr. Boris Handorn & Anna Christ
                Bild Prof. Dr. Boris Handorn
                Prof. Dr. Boris Handorn
                Lawyer / Partner
                Bild Anna Christ
                Anna Christ
                Lawyer

                You may also be interested in:

                The transition periods for the Eudamed rollout for medical devices and IVDs are getting specific

                News for economic operators and notified bodies from the major project Eudamed, the European database for medical devices.

                The use of the first four Eudamed modules will be mandatory as of 28.05.2026. Manufacturers and distributors of systems and treatment units must register their existing products in the UDI/Product-Module with a further transition period until 27.11.2026 at the latest.

                With Regulation (EU) 2024/1860, the EU legislator enabled the gradual introduction of modules for the European database in June 2024. With Decision (EU) 2025/2371 of 26.11.2025, the Commission has now notified the functionality of certain Eudamed modules in accordance with Art. 34(1) of Regulation (EU) 2017/745 (‘MDR’). This decision was published on 27.11.2025 in the Official Journal of the European Union.

                This confirms that the following Eudamed modules are functional and meet the functional specifications set out in Art. 34(2) MDR:

                • the electronic system for the registration of economic operators – ‘Actor Module’ (Art. 30 MDR / Art. 27 IVDR) (Please note: this module has been mandatory for use at national level since 26.05.2021, as announced by the Federal Ministry of Health);
                • the UDI database and the electronic system for registering products – ‘UDI/Device Registration’ (Art. 28 and 29 MDR / Art. 25 and 26 IVDR);
                • the electronic system for notified bodies and certificates – ‘Notified Bodies and Certificates’ (Art. 57 MDR / Art. 52 IVDR);
                • the electronic system on market surveillance – ‘Market Surveillance’ (Art. 100 MDR / Art. 95 IVDR).

                In accordance with Art. 123(3)(d) MDR, the publication in the Official Journal of the European Union marks the start of a six-month transition period for the mandatory use of these Eudamed modules. After this period, the modules must be used on a mandatory basis ‘from the date corresponding to 6 months from the date of publication of the notice referred to in Article 34(3)’.

                In particular, the following deadlines apply to manufacturers of medical devices and IVDs as well as to distributors of systems and treatment units (Art. 22 MDR) for registering their products in Eudamed:

                • Product registration in the UDI/product module is mandatory as of 28.05.2026.
                • For series of existing products that are placed on the market before 28.05.2026 with a specific UDI-DI, a transition period of 12 months from the publication of the notice on functionality (Art. 123(3)(e) MDR) applies. These existing products must therefore be entered into the UDI/Product-Module until 27.11.2026 if they are to continue to be distributed with this UDI-DI after 27.11.2026.
                • This means that product series that are to be placed on the market with a new UDI-DI as of 28.05.2026 must be registered in the UDI/Product-Module before the first product is placed on the market, without any further transition period.

                Do you have any questions about this news or would you like to discuss it with the author? Please contact: Prof. Dr. Boris Handorn

                27. November 2025 Prof. Dr. Boris Handorn
                Bild Prof. Dr. Boris Handorn
                Prof. Dr. Boris Handorn
                Lawyer / Partner

                You may also be interested in:

                New version of the Medical Device Operator Ordinance entered into force

                The new version of the Medical Devices Operator Regulation (MPBetreibV) was promulgated in the Federal Law Gazette on 19.02.2025. The new version of the regulation comes into force on 20.02.2025.

                At the same time, the MPBetreibV in the version published on 21.08.2002 (BGBl. I p. 3396), which was last amended by Art. 7 of the regulation of 21.04.2021 (BGBl. I p. 833), will expire. Simultaneously, the First Amendment Regulation of the MPBetreibV was promulgated, which also comes into force on 20.02.2025.

                A. Background

                The first draft bill to revise the MPBetreibV was submitted to the Federal Council in May 2024 and adopted in July 2024 with additional amendments. The Federal Council’s decision completely changed the new regulation on the reprocessing and reuse of single-use devices that the BMG was aiming for. The BMG originally wanted to include two reprocessing procedures intented by the EU and subject to approval at national level in the regulation. However, the Federal Council’s decision only included one of these procedures.

                As a result, the BMG decided not to promulgate the regulation for the time being and prepared a new draft bill to amend the (yet to be promulgated) new version of 07.10.2024. This draft bill included a revision of Sec. 9 on the reprocessing of single-use devices and was again submitted to the federal states and interest groups for comment.

                The new version and the amending regulation were finally submitted to the Federal Council for a vote on 14.02.2025.

                The new version of the MPBetreibV meets the increased requirements for digital medical devices and now also takes into account risky software products. At the same time, the documentation and testing requirements for low-risk products are reduced.

                When reading the new version, it should be noted that the First Amendment of the MPBetreibV, which was announced at the same time, repeals the ban on the use of single-use devices reprocessed in accordance with Art. 17 para. 2 MDR on humans in the same legal second and regulates the reprocessing and reuse of single-use devices by healthcare facilities in accordance with the legal situation that already applied.

                B. Innovations

                The changes affect key areas of the MPBetreibV in different ways.

                I. Definitions (Sec. 2)

                In the new version of the MPBetreibV, the terms “user” and “provider” are defined for the first time:

                • “User” is anyone who uses a device on a patient.
                • “Provider” is anyone who has to provide products to the patient on the basis of a legal or contractual obligation.

                II. General requirements (Sec. 4)

                Sec. 4 para. 3 has been supplemented by a special obligation to provide instruction on software. Now there is an obligation to provide instruction not only when using software for the first time, but also after each installation or update of software, provided that this changes the handling by the user not only slightly.

                III. Reprocessing and reuse of single-use devices (Sec. 9)

                While in the old version of the MPBetreibV, reprocessing was generally regulated in Sec. 8, there is now a differentiation between general medical devices and single-use devices in Sec. 8 and 9. While the new version provided for a ban on the use of single-use devices reprocessed in accordance with Art. 17 para. 2 MDR on humans, the First Amendment immediately returns to the old legal framework of Sec. 8 para. 4 to para. 7 MPBetreibV and incorporates this into the new Sec. 9 MPBetreibV. According to Sec. 9 MPBetreibV in the version of the First Amendment, the reprocessing and reuse of single-use devices by healthcare facilities remains permissible in accordance with the requirements of Art. 17 para. 3 MDR and the common specifications issued in accordance with Art. 17 para. 5 MDR.

                IV. Safety checks (Sec. 12)

                One of the key changes concerns the safety checks (STK) for automatic external defibrillators (AED). These are no longer required if the AED has a self-test function, and a regular visual inspection is carried out by the operator.

                V. Special obligations for certain software (Sec. 17)

                Sec. 17 was newly introduced, which regulates special obligations for the operation of software as a class IIb and III medical device. Operators must ensure that the software is properly installed and that users are instructed in the proper handling and operation of the software. However, this regulation does not come into force until August 1, 2025 in accordance with Sec. 20 para. 3 of the new version of the MPBetreibV.

                Do you have any questions about this news or would you like to discuss it with the author? Please contact: Dr. Boris Handorn and Anna Christ

                20. February 2025 Prof. Dr. Boris Handorn
                Bild Prof. Dr. Boris Handorn
                Prof. Dr. Boris Handorn
                Lawyer / Partner

                You may also be interested in:

                What’s changing in 2025: Life Science

                For medical device manufacturers, the year 2025 begins with new information obligations in accordance with Art. 10a MDR. In contrast, urgently needed reforms to the MDR will continue to be evaluated in 2025. The life science sector will also be dominated by digitalization in 2025. In particular, topics relating to AI regulation in the medical device sector, flanked by data protection and data transparency, will come to the fore. Integration into the existing infrastructure in particular will play a central role.

                This article is the fourth part of the series of blog posts entitled “What’s changing in 2025”, in which the experts from the Product Law Firm team summarize the relevant topics from their respective areas of expertise. Here, we first highlight the effects of the 3rd amending Regulation (EU) 2024/1860 to the MDR/IVDR (see A.) and the implementation of the German Medical Research Act (see B.). We report on the current status of the legislative process for the European Health Data Space (see C.) and provide an overview of the Data Act (see D.), the implementation of the AI Regulation in the medical device sector (see E.), the introduction of the electronic patient file (see F.) and the innovations for digital health applications (see G.).”

                A. New information obligations for medical device and IVD manufacturers

                In 2025, there will be several relevant developments relating to MDR.

                I. Art. 10a MDR/IVDR

                Already since 10.01.2025, manufacturers of medical devices and in-vitro diagnostics have been subject to new information obligations in the event of interruption or termination of the supply of certain products. The regulations were introduced with the 3rd Amendment Regulation (EU) 2024/1860 in the new Art. 10a Regulation (EU) 2017/745 (“MDR”) and in Art. 10a Regulation (EU) 2017/746 (“IVDR”) with identical wording.

                Accordingly, manufacturers of medical devices and in vitro diagnostics must, in accordance with Art. 10a para. 1 subpara. 1 MDR/IVDR, inform (1.) the competent authority at their registered office or (for manufacturers outside the EU) at the registered office of the authorized representative and (2.) all economic operators, healthcare institutions and healthcare professionals to whom the manufacturer “directly supplies the device” if they expect the supply of certain devices to be interrupted or terminated. The information obligations apply (only) to products for which it is “reasonably foreseeable” that the interruption or termination of supply may result in “serious harm or a risk of serious harm to patients or public health in one or more Member States”. According to the Q&A published by the Commission on Art. 10a MDR/IVDR (Rev 1, as of December 2024), an interruption of supply should be given regularly (“as a general indication”) from an expected inability of the manufacturer to supply for more than 60 days; however, according to the Q&A, a shorter duration may also be reportable as an “interruption” if, according to the manufacturer’s assessment, there is a risk of serious harm.

                The information must be submitted at least 6 months before the expected interruption or termination, unless there are “exceptional circumstances” – i.e. if the reasons for the interruption or termination of the supply only become known to the manufacturer at shorter notice. MDCG 2024-16 publishes a notification form together with a Device Identification Table in the Annex for manufacturers to submit electronically to the national competent authority.

                The competent authority (in Germany the Federal Institute for Drugs and Medical Devices (BfArM) pursuant to Section 7a MPDG in conjunction with Section 85 para. § Section 85 para. 2 sentence 1 no. 4a MPDG), informs the competent authorities of the other Member States and the Commission of the expected interruption or termination of supply (Art. 10a para. 2 MDR/IVDR). The other economic operators in the supply chain also have their own obligations: For their part, they are each obliged to inform their direct customers in the supply chain, which may consist of several stages, up to and including the healthcare facilities and healthcare professionals affected by the interruption or termination of supply (Art. 10a para. 3 MDR/IVDR).

                Since 10.01.2025, manufacturers have been required to implement appropriate processes in their quality management system to fulfill any information obligations. It is foreseeable that notified bodies and certification bodies will pay attention to this during audits.

                Further reading: Handorn, Neue Informationspflichten bei Unterbrechung oder Beendigung der Lieferung bestimmter Medizinprodukte gemäß Art. 10 a MDR, MPR 2024, 225 ff.

                II. Gradual obligation to use EUDAMED

                The 3rd Amendment Regulation (EU) 2024/1860 paved the way for the gradual entry into force of the provisions on the European database for medical devices – EUDAMED. The amended Art. 34 MDR now enables the gradual mandatory use of individual electronic systems in EUDAMED, in deviation from the original regulation. As soon as each individual module has been tested and the Commission confirms its functionality, the module will be published in the Official Journal of the EU. The current timetable (as of December 2024) envisages that the functionality of the modules for the registration of economic operators and UDI/product registration, for notified bodies and certificates as well as for market surveillance will be published in the Official Journal in mid-2025; 6 months later (i.e. at the beginning of 2026), their use will become mandatory under European law (Art. 123 para. 3 lit. d MDR new version). Manufacturers have a period of 12 months to register legacy products and MDR products that are placed on the market from 6 months after publication (Art. 123 para. 3 lit. e MDR new version).

                The Q&A Gradual Roll-Out of EUDAMED published by the Commission (as of November 2024) provides guidance for economic operators and notified bodies on gradual implementation.

                III. Targeted evalutation of the MDR

                After the reform is before the reform. On 12.12.2024, the EU Commission launched the targeted evaluation of the MDR (EU rules on medical devices and in vitro diagnostics – targeted evaluation). This is intended to take stock of the provisions of the MDR and IVDR – which are still in the transitional stage – and assess whether they are effective, efficient and proportionate. The opportunity to participate in the targeted evaluation with submissions is available until 21.03.2025. Adoption by the Commission is currently scheduled for the 4th quarter of 2025.

                In addition to the reforms that are expected (and often necessary) in the longer term, measures can be expected in 2025 that fall under the banner of reducing bureaucracy and envisage short-term, consensus-based corrections to the MDR and IVDR. For example, the possible extension and reclassification of so-called well-established technologies within the meaning of Art. 52 para. 5 and Art. 61 para. 8 MDR. The Commission has currently announced a public consultation on reclassification.

                B. Implentation of the Medical Research Act

                At national level, the practical implementation of the Medical Research Act of 30.10.2024 is due in 2025. The focus will be on pharmaceutical research. At the same time, research with medical devices is to be facilitated in certain areas.

                I. Pharmaceutical Act

                The German Pharmaceutical Act (AMG) is amended by the Medical Research Act in the following points in particular:

                • Recognition of third country inspections as GMP-compliant
                • Extension of the authority of the Federal Ministry of Health (BMG) to issue ordinances to change responsibilities
                • Creation of an authorization basis for recommendations on the interpretation of EU principles and guidelines of good manufacturing practice (GMP) to support harmonization in the field of advanced therapies
                • Establishment of an indication-based register of advanced therapy medicinal products
                • Creation of a specialized ethics committee for special procedures
                • Introduction of (generally binding, but mutually derogable) standard contractual clauses for clinical trials contracts for medicinal products by means of a statutory order, which is expected to be published in 2025.

                II. Medical Devices Implementation Act (MPDG)

                In particular, the following changes have been made to the MPDG by the Medical Research Act:

                • Implementation of the information requirements of Art. 10a MDR. Accordingly, notifications to the competent authority must be made electronically in machine-readable form to the competent higher federal authority (the BfArM pursuant to Section 85 (2) sentence 1 no. 4a MPDG) (Section 7a MPDG, entered into force on 10.01.2025).
                • Authorization to issue ordinances pursuant to Section 31c MPDG on mandatory standard contractual clauses for the conduct of clinical trials and performance studies. Party agreements deviating from these standard contractual clauses should be possible, just as in the area of clinical drug trials. The promulgation of the ordinance on standard contractual clauses for clinical trials with medical devices is also expected in 2025.
                • Issuance of guidelines for the assessment of clinical trials and performance studies by the Working Group of Medical Ethics Committees in the Federal Republic of Germany (AKEK – https://www.akek.de/) in accordance with Section 32a MPDG.
                • Responsibility of specialized ethics committees according to AMG for performance studies with companion diagnostics according to Section 33 para. 1 no. 4 and 5 MPDG (enter into force on 01.07.2025).
                • For other clinical trials within the meaning of Section 3 No. 4 MPDG, the requirements for the sponsor pursuant to Section 25 MPDG and for the designation of the investigator pursuant to Section 30 MPDG (Section 47 (3) MPDG new) are waived for PMCF trials of CE-marked medical devices within their intended purpose that are not additionally burdensome; this at least partially remedies the misguided inferiority in the area of other clinical trials compared to PMCF trials for conformity assessment purposes.

                III. Radiation Protection Act

                The amendments to the MFG will also simplify the approval procedure under radiation protection law and integrate the notification and approval procedure under radiation protection law into the approval procedure for clinical trials under pharmaceutical and medical device law.

                C. European Health Data Space (“EHDS”) – Current status of the legislation process

                On 24.04.2024, the European Parliament and the Council reached a political agreement on the Commission’s proposal on the European Health Data Space (EHDS).

                The aim of the planned Regulation on the EHDS (EHDS Regulation-E) is to strengthen the interconnection of national healthcare systems through the secure and efficient exchange of health data for primary and secondary use: to give individuals access and control over their electronic health data, to promote the internal market for digital health services and products and to ensure a uniform framework for the use of health data for (also commercial) research, innovation, policy-making and regulation.

                Member states can provide for a specific right to object to the processing of personal electronic health data recorded in EHR systems for primary use (Art. 10 EHDS Regulation, cf. in Germany already the opt-out options under DigiG). For secondary use, the EHDS provides for a right to object at European level (Art. 71 EHDS Regulation), whereby Member States can regulate exceptions to this opt-out at secondary use level under certain conditions (Art. 71 (4) EHDS Regulation).

                From a product law perspective, the conformity assessment and CE marking of so-called EHR systems (electronic health record systems) within the meaning of Art. 2 para. 2 lit. k EHDS-DR: EHR systems will in future be subject to CE harmonization provisions and a dedicated concept of economic operators (Art. 25 et seq. EHDS-DR). The interfaces to medical devices, IVDs and AI systems, which are extremely important in practice, are regulated in Art. 27 EHDS-D as a supplementary conformity assessment of essential requirements in accordance with Annex II Section 2 EHDS-D. For wellness applications within the meaning of Art. 2 para. 2 lit. ab EHDS-DR, Art. 47 et seq. EHDS Regulation now also provide for mandatory requirements for interoperability with EHR systems. Manufacturers of EHDS systems and wellness applications as well as other relevant economic operators should prepare for the upcoming product law requirements at an early stage. The overlaps and additional requirements for digitalized medical devices and IVDs are also evident.

                The EHDS Regulation has yet to be published in the Official Journal of the EU. The EHDS will then enter into force 20 days after publication in the Official Journal. The date of application is generally 2 years after entry into force with further differentiated transitional provisions of 4 to 10 years (Art. 105 EHDS-VO-E).

                D. Data Act

                With the Data Act (Regulation (EU) 2023/2854) coming into force in January 2024, a legal framework for fair access to and fair use of data was created. The rules must then be applied on a binding basis from 12.09.2025.

                According to Recital 14 of the Data Act, medical and healthcare products also expressly fall within the scope of the Act. Medical device manufacturers and companies that offer data processing services (e.g. operators of DiGAs) are affected.

                The Data Act is intended to grant users free access to the data generated by their use of the product or service. Manufacturers of medical devices are to be obliged to disclose all this data. In this context, manufacturers will also be subject to extensive disclosure obligations. They must provide information on what data is generated and to what extent, whether this is done continuously and in real time and how users can access the data. The data should be provided in a fair and non-discriminatory manner. To this end, the data recipient and data sender should conclude contracts.

                The most important implications for manufacturers:

                • Products must be modified to offer interfaces that meet interoperability specifications and provide data continuously and in real time.
                • The requirements for IT security are now significantly higher.
                • There is an increased risk that competitors will exploit the data.
                • Costs will rise due to free use. Compensation is only permitted if it is proportionate and the data sender does not make a profit.

                The Data Act also contains provisions regarding the provision of data to public bodies, but only in the event of an exceptional need.

                E. Artificial Intellegince Act (AIA)

                On 01.08.2024, Regulation (EU) 2024/1689 laying down harmonized rules on artificial intelligence (“AIA”) entered into force. It is the world’s first AI law and provides the European legal framework for the development, placing on the market, commissioning and use of artificial intelligence in the Union.

                The AIA standardizes a product safety law specific to AI systems across all products (CE legal act). In the area of medical devices, the AI Regulation will in future supplement the sectorally regulated basic safety and performance requirements.

                AI-based medical device software will practically always be classified as a high-risk AI system within the meaning of Art. 6 para. 1 in conjunction with Annex I AIA. Accordingly, an AI system is considered a high-risk AI system if (a) it is intended to be used as a safety component for a device or is itself a device and (b) the device falls under the legal acts listed in Annex I and must subsequently undergo a conformity assessment by a third party. Art. 6 para. 1 AIA refers to the EU regulations on existing product safety law listed in Annex I and thus in particular to the MDR and the IVDR. Whether a smart medical device is therefore to be classified as a high-risk AI system depends crucially on the risk classification according to the MDR, which (namely via the misclassification rule 11 in Annex VIII MDR) practically always leads to the involvement of a notified body in the conformity assessment. As a result, the requirements of the AI Regulation for high-risk AI systems will have to be applied as part of a uniform conformity assessment procedure for AI medical devices. However, the complex interplay between the requirements of the MDR/IVDR on the one hand and the AI Regulation on the other is still uncoordinated or unclear in many areas.

                The AI Regulation will generally come into force on 02.08.2026. The central classification rules and requirements for high-risk AI systems in accordance with Art. 6 para. 1 AI Regulation will apply from 02.08.2027. Manufacturers of digitalized medical devices and IVDs already have to deal with the complex additional requirements of the AI Regulation, particularly in the context of development and conformity assessment.

                A first MDCG document on the interplay between MDR/IVDR and the AI Regulation (“FAQ on interplay between MDR/IVDR and AIA”) is expected early in the first quarter of 2025. In addition, following a consultation carried out at the end of 2024, an EU guideline on the central definition of the AI system and on prohibited practices within the meaning of the AI Regulation has been announced for the first quarter of 2025.

                F. Digital Act (DigiG)- Electronic patient file (ePA)

                The “Act to Accelerate the Digitalization of the Healthcare System” (“Digital Act”, “DigiG” for short) came into force in March 2024.

                The core element of the DigiG is the introduction of the electronic patient file (ePA). As is known, the nationwide roll-out of the ePA originally planned for 15.01.2025 has been delayed, so that the ePA will initially be tested in a four-week pilot phase in Hamburg, Franconia and North Rhine-Westphalia from 15.01.2025. The nationwide roll-out is therefore not expected until after the pilot phase at the earliest, i.e. from mid-February.

                The “ePA for all” is designed as an opt-out model and will therefore be available to all insured persons who do not object. After the roll-out, further content such as the digital medication process and laboratory findings will be gradually integrated. It should also be possible to release the data stored in the ePA for research purposes in the course of the year; an opt-out solution is also planned for this.

                G. Digital health applications – DiGA

                There will also be some relevant developments for DiGA in 2025. Originally, it was planned that DiGA could only be prescribed via e-prescription from 01.01.2025. This timetable was not adhered to, in particular due to concerns on the part of manufacturers. One of the criticisms was that the e-prescription app required to activate DiGA is currently not used by most insured persons. Nevertheless, the planned switch to exclusively electronic DiGA prescriptions should take place in the course of 2025.

                According to the DigiG, the pricing of DiGA is to be more closely aligned with success criteria in future. From January 1, 2026, at least 20 percent of the permanent reimbursement amount for DiGA is to be performance-based, meaning that the National Association of Statutory Health Insurance Funds and the manufacturers’ associations will have to reach corresponding agreements in 2025. It will also be important to observe this year whether the first digital nursing application (DiPA) finally successfully completes the application process and is included in the DiPA directory

                Do you have any questions about this news or would you like to discuss it with the author? Please contact: Dr. Boris Handorn and Anna Christ

                14. January 2025 Prof. Dr. Boris Handorn
                Bild Prof. Dr. Boris Handorn
                Prof. Dr. Boris Handorn
                Lawyer / Partner

                You may also be interested in: