Medical record summarisation is the highest-leverage AI use case for clinicians. A discharge summary that takes a junior doctor twenty minutes can be drafted in thirty seconds. The regulatory question is whether the summarisation engine is "just an editor" or a clinical-decision-support tool. The answer determines MDR class, FDA SaMD class, the depth of validation required and the procurement path [1].
Two distinct workflows. Clinician-facing summarisation drafts handover notes, discharge letters, referral letters and case reviews from existing records. Patient-facing summarisation produces lay-language summaries for the patient portal. The clinical risk profile of the two is different even though the underlying technology is similar.
Inputs are protected health data: clinical narrative, lab results, imaging reports, medication history. Outputs are derived clinical documents intended for human review and onward use. The human-review step is what keeps most deployments out of high-risk MDR territory.
MDR Article 2(1) and MDCG 2019-11 frame the question. Software is a medical device if it is intended for diagnosis, monitoring, prediction, prognosis, treatment or alleviation. Pure paraphrasing of existing documentation is not. Summarisation that introduces new clinical conclusions, flags conditions the original record did not mention, or recommends treatments crosses into MDR [2].
Class IIa is the likely class for any summariser whose output materially informs clinical decisions, under MDR Annex VIII Rule 11. CE marking via a notified body is then required. Class I (self-certification) is reserved for software that does not provide information used for diagnosis or therapeutic decisions.
The FDA's framework, aligned with IMDRF, classifies SaMD by the significance of the information provided to the healthcare decision (inform, drive or treat / diagnose) and the seriousness of the condition (non-serious, serious, critical). A summariser whose output informs treatment of a serious condition is at least SaMD Class III in the IMDRF framework [3].
FDA's 2023 guidance on Clinical Decision Support Software clarified which CDS functions remain outside Section 520(o)(1)(E) of the FD&C Act and therefore unregulated. The four-prong test asks whether the software is intended for healthcare professional use, displays the basis of the recommendation, and supports independent review. Summarisation tools that meet all prongs avoid SaMD classification.
Health data is special-category. Processing requires Article 6 lawful basis and Article 9 condition (typically 9(2)(h) healthcare provision plus Member State health-data law). Patient-facing summaries reuse the existing healthcare basis; clinician-facing summaries extend it to AI processing.
The Article 28 data-processing agreement with the AI vendor is the operative instrument. It must include the standard processor obligations, audit rights, sub-processor controls, security measures aligned with Article 32 and breach-notification cooperation. ENISA guidance on health-data processing gives the working baseline for technical measures.
Regulation (EU) 2025/327 establishes the European Health Data Space, with primary use (healthcare provision) and secondary use (research, policy, regulatory) regimes. AI summarisation is primary use within the institution. Where summarised data flows into the secondary-use system, the EHDS Article 50 onward rules on permits and data altruism apply [4].
The EHDS does not create new AI-specific obligations beyond MDR and the AI Act, but it standardises data-format and access expectations that AI vendors must meet. Procurement teams should require EHDS-aligned data interfaces in vendor contracts.
Six elements. Narrow intended-purpose statement (paraphrasing of clinician-authored content, no new clinical conclusions). Mandatory clinician sign-off before document goes to record. Visible source-attribution showing which sentence came from which note. Hallucination-prevention controls (retrieval-grounded generation, no out-of-source claims). Article 28 data-processing agreement with audit rights and EU-residency commitments. Performance monitoring including factual-faithfulness evaluation against source records.
Ready to scope your project? Submit a short brief and we reply within one business day.
Tell us what you would like to build. We reply within one business day.