Compliance for MedTech – where regulation meets product success

Yes – in most cases. MedTech companies regularly process health data under Article 9 of the GDPR, which generally makes the appointment of a Data Protection Officer mandatory. This requirement also applies if 20 or more people are permanently involved in automated data processing. An external DPO with MedTech expertise is often the most efficient solution – Proliance takes on this role for MedTech companies throughout the DACH region.

The EU Medical Device Regulation sets out specific requirements for handling clinical data, post-market surveillance, and technical documentation – areas that overlap with the GDPR and ISO 27001. Manufacturers must ensure that patient data is processed in compliance with the GDPR and protected by appropriate security measures. Proliance integrates all three areas of requirement into a coherent compliance strategy.

ISO 13485 governs the quality management system for medical device manufacturers, yet it does not contain its own data protection requirements. However, many processes—such as traceability, customer complaints, and clinical evaluation—involve personal data and must be designed to be GDPR-compliant. ISO 27001 complements the system by addressing information security. Proliance aligns all three requirements and integrates them into a single, unified system.

SaMD is software that independently fulfils medical purposes, such as diagnosis, monitoring, or therapy support. It is subject to the EU MDR, must be developed in accordance with IEC 62304, and processes highly sensitive patient data. GDPR compliance, Data Protection Impact Assessments (DPIA), information security under ISO 27001, and, where applicable, AI governance under the EU AI Act are not optional extras, but prerequisites for approval. Proliance supports SaMD manufacturers throughout the entire compliance development process.

This depends on your role in the supply chain. MedTech companies that are classified directly as critical infrastructure, or that supply critical infrastructure, may fall under the scope of NIS2. The directive mandates enhanced security measures, incident reporting obligations, and regular compliance documentation. Proliance will analyse your specific NIS2 requirements and support you every step of the way, from the initial gap analysis to ISO 27001 certification.

AI-powered medical devices – such as those used for diagnostic imaging, clinical decision support, or automated risk classification – are frequently classified as high-risk AI under the EU AI Act. This entails risk assessments, transparency obligations, human oversight, and comprehensive documentation. Proliance helps you classify your AI applications, establish an AI governance framework, and integrate the requirements of the AI Act into your existing MDR processes.