Health apps, telemedicine and digital therapeutics

• Regulation (EU) 2017/745 — MDR where the software has a medical purpose
• Regulation (EU) 2016/679 — GDPR, Articles 9 and 27
• Regulation (EU) 2024/1689 — AI Act
• Regulation (EU) 2025/327 — European Health Data Space
• National telemedicine rules

Who has to appoint one

Providers outside the Union offering health applications to users in the EU. The decisive question is intended purpose: software that diagnoses, monitors, predicts or treats is a medical device, while wellness and information tools are not.

Thresholds and exemptions

None. Most software with a medical purpose is Class IIa or higher under Rule 11, which surprises developers who expect Class I.

What must appear on the label

CE marking with the notified body number where applicable, manufacturer and EC REP details, UDI, and the instructions for use accessible in the app. The Article 27 representative goes in the privacy notice.

Marketplace fields

App stores review medical claims, and national health systems have their own assessment frameworks for reimbursement, such as the German DiGA route, which require evidence beyond CE marking.

Documentation you must hold

MDR technical documentation, clinical evaluation, risk management under ISO 14971, software life cycle under IEC 62304, usability, cybersecurity documentation, EUDAMED registration, and on the data side the Article 30 record, the Article 9 condition, a data protection impact assessment and the transfer mechanism.

Standards and testing

Clinical evaluation appropriate to the claims, usability validation with representative users, and algorithm performance evaluation where AI is used, with accuracy declared under the AI Act where the system is high-risk.

Language requirements

App content, instructions and patient information in the language of the users, which for a medical device is mandatory rather than commercial.

When it applies

Certification before placing on the market. National telemedicine rules on who may consult and prescribe apply separately and differ substantially between member states.

How long records are kept

Ten years for the device documentation. Health data only as long as necessary, with clinical records following national health law.

What happens if you do not comply

Withdrawal and prohibition, and GDPR fines up to 4% of turnover. Marketing an unregistered medical device is the most common and most serious finding in this sector.

Who enforces it

Medical device competent authorities, data protection authorities, national health regulators and AI Act market surveillance authorities.

Where the boundary lies

Rule 11 of the MDR classification rules pushes most decision-support software to Class IIa or above, so the notified body route is the norm rather than the exception. A symptom checker that suggests a diagnosis is a device; one that provides general information is not, and the wording of the interface decides.

Questions we are asked

Is our symptom checker a medical device?

If it provides information used to take decisions for diagnostic or therapeutic purposes, yes, and under Rule 11 it is usually Class IIa or higher.

Can we launch as a wellness app and add medical claims later?

Adding a medical claim changes the intended purpose and requires conformity assessment before that version is placed on the market.