Medical AI in Europe (2026): rules, a checklist for evaluating tools, and the landscape

Medical AI in Europe means AI tools that help clinicians and students find, summarise or apply medical knowledge, used under European law. Three bodies of EU law matter most. The GDPR treats health data as a special category ([1]). The EU AI Act has applied in general since 2 August 2026, with longer transition periods for high-risk systems ([2]). The Medical Device Regulation (MDR) decides whether a tool is a regulated medical device, and that depends on the manufacturer's intended purpose ([3], [4]). Before you rely on any tool, check where your data goes, whether every statement can be traced to a source, and what the tool's regulatory status is.

As of October 2026. This article is general information for healthcare professionals, not legal advice.

Disclosure: this article is published by Medelix, which makes a medical AI tool itself. Statements about other providers rest on the linked sources as of 13 October 2026; see our editorial policy.

What counts as "medical AI"?

The term covers very different products:

• Evidence search and question answering: you ask a clinical question, and the tool searches guidelines and literature and writes an answer with sources.
• Reference works with an AI layer: an established textbook or reference database that you can now query in plain language.
• Clinical decision support: software that combines patient-specific data with medical knowledge to recommend diagnosis or treatment for a specific patient.
• Documentation and administration: dictation, discharge letters, coding.
• General-purpose chatbots: large language models without specialist medical retrieval.

The difference is more than technical. It decides which rules apply and how far you should trust an answer.

The rules: GDPR, EU AI Act, MDR

GDPR: health data is special-category data

Under Article 9 GDPR, "data concerning health" is a special category. Processing it is prohibited unless an exception applies, such as explicit consent ([1]). For day-to-day practice this means never enter identifying patient data into a tool unless there is a clear legal basis and a data-processing agreement. Also ask where the provider processes data and which subprocessors are involved. Transfers to third countries need their own safeguards under Articles 44 ff. GDPR ([1]).

EU AI Act: in general application since August 2026

According to the European Commission, the AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and "became applicable on 2 August 2026, with some exceptions" ([2]):

The "Digital Omnibus on AI" moved these deadlines. The Commission reports that it reached political agreement on 7 May 2026 and entered into force on 27 July 2026 ([2]). The MDCG FAQ from June 2025 still gives 2 August 2027 for medical devices, because it predates the Omnibus ([5]).

When is medical AI "high-risk"? According to MDCG 2025-6, an AI system is high-risk under Article 6(1) AI Act if it is itself a medical device (or a safety component of one) and must undergo third-party conformity assessment by a notified body under the MDR ([5]).

MDR: intended purpose decides

Software is a medical device if its manufacturer intends it for a medical purpose for individual patients. The MDCG guidance on software qualification (MDCG 2019-11, revision 1, June 2025) draws the line ([4]):

• Usually not a medical device: "simple search", meaning retrieval of information such as "library functions". Software is also not considered to benefit individual patients if it only provides "generic diagnostic or treatment pathways (not directed to individual patients), scientific literature, medical atlases".
• Possibly a medical device: search that "contributes to achieving a medical purpose", including search using natural language processing ([4]).
• Qualified as a medical device: decision-support software that combines medical knowledge "with patient-specific data" to give recommendations "for diagnosis, prognosis, monitoring and treatment of individual patients" ([4]).

In practice, two tools can look almost the same and still have different regulatory status. One is certified as a medical device; the other declares a purely informational purpose and does not accept patient data. Neither is "better" in itself. What matters is that the tool's declared purpose matches how you use it.

Checklist: evaluating a medical AI tool in 10 questions

1. Can every statement be verified? Every clinical claim should link to a source that actually exists. In a study of ChatGPT-generated medical texts, 47% of references were fabricated, 46% were real but inaccurate, and only 7% were real and accurate ([6]).
2. Which sources? Current European and national guidelines, official summaries of product characteristics, peer-reviewed literature, or the open web?
3. Does the tool admit uncertainty? A good tool says when the evidence is thin instead of filling the gap.
4. What is left out? In the NOHARM study (1,100 consultation cases, 20 language models and 4 clinical AI tools), up to 24.6% of cases had potential for severe harm, and omissions caused more than 80% of severe errors ([7]). Ask what is missing from an answer, not only whether what is there is correct.
5. Regulatory status: medical device (which class, which notified body?) or declared information tool? Does the intended purpose match your use?
6. Data location and processing: Where is data stored and processed? Is there a data-processing agreement? Are your questions used to train models?
7. Patient data: Does the tool prohibit identifying data, and does it filter it?
8. Transparency: Is AI-generated content labelled as such (AI Act transparency obligations, [2])?
9. European context: Does the tool prioritise European and national guidelines (ESC, AWMF, NICE and others), or mainly US sources?
10. Language: Can you ask in your own language and still get evidence written in other languages?

The WHO has published guidance on the ethics and governance of large multimodal models in healthcare, which covers many of these points ([8]).

Landscape: medical AI tools available in Europe (as of October 2026)

The table lists products alphabetically. Each description is based on the provider's own statements on the date of review. It is not a ranking or test result, and it is not complete. Each product has its own strengths.

Where Medelix fits. Medelix is a medical AI for doctors and medical students, built in Vienna, Austria ([11], [12]). It answers clinical questions from clinical guidelines, official medicines registers and peer-reviewed literature, which it searches live for each question. Every clinical claim carries a citation, and when the evidence is too thin, Medelix says so ([11]). In its own published figures (checked August 2026), the corpus covers 48 million biomedical publications, more than 10,000 European guidelines and 31,000 authorised medicines from three European agencies ([11]). Medelix servers are in the EU (Helsinki, Finland), and questions are not used to train models ([12]). Medelix is deliberately not a medical device. It is an information tool, its answers are labelled as AI-generated, and identifying patient data must not be entered ([12], [13]). It is free for individual users ([11]). If you need a certified decision-support product for individual patients, a tool with an MDR certificate is the right category.

Conclusion

The best medical AI for Europe is not necessarily the one with the most features. It is the one whose sources you can check, whose data handling you understand and whose intended purpose matches your use. Test tools on questions where you know the answer, and always click through to the original source.

Try it: ask a clinical question in Medelix or use the referenced clinical calculators.

Sources

1. Regulation (EU) 2016/679 (GDPR), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2016/679/oj
2. European Commission, "AI Act – Regulatory framework for AI" (updated 3 Aug 2026): https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
3. Regulation (EU) 2017/745 (MDR), EUR-Lex: https://eur-lex.europa.eu/eli/reg/2017/745/oj
4. MDCG 2019-11 rev.1, Qualification and classification of software (June 2025): https://health.ec.europa.eu/document/download/b45335c5-1679-4c71-a91c-fc7a4d37f12b_en?filename=mdcg_2019_11_en.pdf
5. MDCG 2025-6, FAQ on the interplay between MDR/IVDR and the AI Act (June 2025): https://health.ec.europa.eu/document/download/b78a17d7-e3cd-4943-851d-e02a2f22bbb4_en?filename=mdcg_2025-6_en.pdf
6. Bhattacharyya M et al. High Rates of Fabricated and Inaccurate References in ChatGPT-Generated Medical Content. Cureus 2023: https://doi.org/10.7759/cureus.39238
7. Wu D et al. First, do NOHARM: a medical safety benchmark and randomized study of physician and AI teaming on clinical consultations. arXiv:2512.01241: https://arxiv.org/abs/2512.01241
8. WHO. Ethics and governance of artificial intelligence for health: Guidance on large multi-modal models: https://www.who.int/publications/i/item/9789240084759
9. AMBOSS, AI Mode: amboss.com/de/ai-mode
10. Wikipedia, OpenEvidence: https://en.wikipedia.org/wiki/OpenEvidence
11. Medelix, home page: https://medelix.ai/en
12. Medelix, Privacy policy: https://medelix.ai/privacy
13. Medelix, Legal notice (Impressum): https://medelix.ai/impressum
14. Let's Data Science (28 Apr 2026), OpenEvidence withdraws AI medical app from EU, UK: https://letsdatascience.com/news/openevidence-withdraws-ai-medical-app-from-eu-uk-1447fca2