Skip to main content
FromNine
Menu

Healthcare & Life Sciences

Fewer forms for clinicians, who still make every call.

We work for hospitals, community services, health insurers and pharma and medtech manufacturers. We connect health data across systems, build administrative AI that stays out of clinical decisions, and deliver validated systems that hold up when an inspector visits.

For hospitals, community services, health insurers and pharma and medtech manufacturers in Ireland, working to Irish regulators and EU health rules.

Talk to us about your projectSee the matching solutions
Laboratory glassware lined up in neat rows and columns

  1. 25 March 2025

    Health Data Space Regulation in force

    Patients’ access to their data, exchange between countries and reuse for research, introduced step by step.

    SourceRegulation (EU) 2025/327 (opens external site)

  2. 2 August 2028

    AI Act duties reach medical devices

    AI that is itself a regulated product, or a safety component of one, becomes high-risk; the date follows the 2026 amendment.

    SourceRegulation (EU) 2024/1689 (opens external site)

  3. 26 March 2029

    EHDS exchange and research access start

    Patient summaries and ePrescriptions move between countries, and health data access bodies begin to issue permits.

    SourceRegulation (EU) 2025/327 (opens external site)

What is shifting for health and life sciences in Ireland

  1. Health data starts to travel with the patient

    Under the European Health Data Space, patients get electronic access to their own records and exchange follows shared formats. Health data access bodies will allow regulated reuse for research and policy, inside secure processing environments.

    SourceRegulation (EU) 2025/327

  2. Paperwork takes time from patients

    Notes, coding, referrals and approvals eat into hours that belong to patient care. Carefully limited assistance can hand some of it back, provided the clinician remains the author of the chart.

  3. Where a medical device begins

    Software that supports diagnosis or treatment can fall under the MDR as a medical device, and any AI in it counts as high-risk under the AI Act. In Ireland the HPRA regulates medicines and devices and is also one of the sector authorities for the AI Act. Keeping administrative AI on the right side of that line is something you decide in the design.

    SourceRegulation (EU) 2017/745

  4. Hospitals count as critical infrastructure

    NIS2 covers healthcare providers. Ransomware attacks on health services have shown the cost of a recovery that was never practised, so segmentation and resilience have to be part of the architecture.

Where care and life-sciences teams get stuck, and what we build

  1. The challenge

    Consultants and nurses finish their notes long after their shift ends.

    What we do

    An assistant prepares letters and summaries from structured data and clinical notes. The clinician edits and signs, and nothing goes into the record without that signature.

  2. The challenge

    Referrals and intake forms come in every shape and format.

    What we do

    Intake processing sorts referrals, picks out the clinical question and flags gaps for staff to fill, with every step written to an audit trail.

  3. The challenge

    Clinical systems cannot understand each other.

    What we do

    Integration built on HL7 FHIR and IHE profiles with shared terminology such as SNOMED CT, linked to national eHealth services instead of a new one-off interface each time.

  4. The challenge

    Researchers wait months before they get data they can use.

    What we do

    Pipelines that pseudonymise, record lineage and control access, so data is ready for a secure processing environment and for requests to a health data access body.

  5. The challenge

    At a pharma or medtech site, validation slows down every change.

    What we do

    Computerised system validation scaled to risk, in line with GAMP 5: automated tests and traceable requirements, so the evidence comes out of each release instead of being assembled afterwards.

  6. The challenge

    Medical, quality and regulatory knowledge is spread over thousands of documents.

    What we do

    Search across SOPs, labelling and correspondence with regulators such as the HPRA, citing the controlled version of each source.

Three separate zones on a shared data layer

Administrative support, clinical decision support and reuse for research are separated by design. Each zone carries its own rules, approvals and evidence, and all three sit on one interoperability layer.

Illustrative example
ADMINISTRATIVE SUPPORTCLINICAL DECISION SUPPORTRESEARCH REUSE (EHDS)Draft documentationCoding and intake of referralsSign-off by the clinicianValidated on its own as amedical device (MDR,high-risk under the AIAct)Permit from a health data accessbodySecure processing environmentResearch teams and registriesInteroperability layer with HL7 FHIR, IHE profiles and SNOMED CTEHR and other clinical systems
Administrative AI, clinical decision support and research reuse in separate zones

The assistance described on this page lives only in the administrative zone. Clinical decision support takes the medical-device route.

Read the diagram as text

Three zones sit above a single interoperability layer based on HL7 FHIR, IHE profiles and SNOMED CT, and that layer connects to the EHR and other clinical systems.

In the administrative zone are draft documentation, coding and the intake of referrals. Nothing reaches the record before a clinician has signed it off.

Clinical decision support is a zone of its own: that software is validated as a medical device under the MDR and is high-risk under the AI Act.

Research reuse follows the European Health Data Space: a health data access body issues a permit, the data is processed in a secure processing environment, and research teams and registries work with the results.

  • Signed off by the clinician

    No draft or suggestion enters the record until a named clinician has approved it.

  • A visible device line

    Once a function begins to inform diagnosis or treatment, it moves onto a medical-device development path instead of slipping in as a feature update.

  • Standards rather than custom links

    FHIR resources, IHE profiles and shared terminology take the place of point-to-point interfaces built for one pair of systems.

  • Research access only with a permit

    Data for research leaves the care zone pseudonymised, under a permit, and goes into a secure processing environment.

Key dates for care, pharma and medtech

These dates shape health data platforms, AI and validated systems. Some depend on implementing acts that are not finished yet.

  1. In application

    MDR: Medical Device Regulation in application

    With rules for software that is itself a medical device.

  2. In application

    NIS2: EU deadline for national NIS2 laws

    Healthcare providers are covered. Ireland’s National Cyber Security Bill had not been enacted by autumn 2026.

  3. In application

    EHDS: Health Data Space Regulation in force

  4. In application

    EU GMP: Drafts of a revised Annex 11 and a new Annex 22 on AI published

    The consultation has closed; the final texts were not yet adopted at the status date.

  5. Position at 2 October 2026

  6. Upcoming

    EHDS: The regulation applies in general

    Implementing acts fix the detailed formats and requirements.

  7. Upcoming

    MDR: First transition deadline for legacy devices

    For class III and implantable class IIb devices; a targeted revision of the MDR is being discussed.

  8. Upcoming

    AI Act: Duties for AI in regulated products in application

    Includes AI in medical devices, following the 2026 amendment.

  9. Upcoming

    EHDS: First priority categories exchanged, research access opens

    Patient summaries and ePrescriptions; health data access bodies up and running.

  10. Upcoming

    EHDS: Second set of priority categories

    Medical imaging, lab results and discharge reports.

Rules and standards at a glance

The legal texts that most often sit behind a specification in care, pharma or medtech, and what each one changes for delivery.

Use this overview to prepare planning discussions; it is not legal, regulatory or clinical advice. Dates checked on 2 October 2026.

GDPR: health data as special-category dataScopeEU-wide

Article 9 treats health and genetic data as special categories. You need a specific legal basis to process them, and processing at scale normally calls for a data protection impact assessment. In Ireland the Data Protection Commission supervises, under the Data Protection Act 2018.

What changes for your programme

Access limits, pseudonymisation and retention are settled before the build, and we give you the technical input your DPIA needs.

SourceRegulation (EU) 2016/679, EUR-Lex (opens external site)

European Health Data SpaceScopeEU-wide

Patients get electronic access to their health data, there is one European format for exchange with requirements for electronic health record systems, and health data access bodies manage reuse for research and policy. The rules take effect in stages from 2027 to 2031.

What changes for your programme

A system built today should already offer data in standard formats and log access so that it meets the EHDS later without being rebuilt.

SourceRegulation (EU) 2025/327, EUR-Lex (opens external site)

Medical Device Regulation (MDR)ScopeEU-wide

Software meant for diagnosis, prevention, monitoring or treatment can qualify as a medical device, usually class IIa or above under the classification rule for software. Regulation (EU) 2023/607 lengthened the transition periods for legacy devices. The HPRA is the Irish regulator for medical devices.

What changes for your programme

We pin down the intended purpose at the start. Administrative tools are built to stay outside the definition of a device, and device software follows a regulated lifecycle.

SourceRegulation (EU) 2017/745, EUR-Lex (opens external site)

EU AI ActScopeEU-wide

AI that is a medical device, or a safety component of one, counts as high-risk. Following the 2026 amendment, those duties start on 2 August 2028, next to the MDR conformity assessment. In Ireland, S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, lists the HPRA among the sector market surveillance authorities.

What changes for your programme

Where the AI rules and the device rules overlap, we plan a single body of technical documentation that covers both.

SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)

EU GMP Annex 11 and GAMP 5ScopeEU-wide

Annex 11 lays down what computerised systems in a GMP setting must do, and GAMP 5 is the industry guidance on validation by risk. In July 2025 drafts appeared of a revised Annex 11 and of a new Annex 22 covering artificial intelligence.

What changes for your programme

Validation runs inside the delivery pipeline: each requirement linked to its tests, evidence produced with every release, and AI use cases checked against the draft Annex 22.

SourceEudraLex Volume 4, European Commission (opens external site)

NIS2 for healthcareScopeEU-wide

Healthcare providers, EU reference laboratories and makers of certain medical products fall within NIS2, with duties on risk management, incident reporting and supply-chain security. Ireland has not enacted its NIS2 law yet: as of autumn 2026 the National Cyber Security Bill is at General Scheme stage and S.I. No. 360 of 2018 still applies.

What changes for your programme

Segmentation, backups and a recovery you have actually practised belong in the architecture, and as a supplier we help with your incident reporting.

SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)

Example use cases (illustrative)

Illustrative example

  1. Drafting discharge letters at a hospital

    The letter is put together from structured data and notes; the consultant responsible edits and signs it.

    Document intelligence

  2. Taking in referrals

    Each referral is sorted and checked for gaps, and missing details are requested before triage.

    Document intelligence

  3. Adverse event intake for a pharma company

    Safety reports turned into structured cases; a drug safety specialist reviews and decides on each one.

    Document intelligence

  4. SOP search at a medtech plant

    Answers drawn from controlled SOPs and quality documents, always pointing to the version currently approved.

    Enterprise knowledge

  5. Help for patients and insurance members

    An assistant for bookings, cover and practical questions that hands anything medical straight to staff.

    Service assistance

Platforms we use in health and life sciences

  • Salesforce

    Summit Partner

    Service for patients and members, field teams and partner programmes, while clinical data stays in the clinical systems where it belongs.

  • SAP

    Gold Partner

    Supply chain, batch management and finance at pharma and medtech sites, linked to quality and validation processes.

The partner levels shown are FromNine’s own. Product names belong to their owners as trademarks.

Ireland

Irish care and an Irish life-sciences base, under EU rules

In Ireland the HSE runs public health services next to voluntary hospitals and private providers, and many pharma and medtech manufacturers operate validated sites here. The HPRA regulates medicines and medical devices, the Data Protection Commission supervises health data under the GDPR and the Data Protection Act 2018, and S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026, names the HPRA among the sector authorities for the AI Act.

We build health data flows on European standards such as FHIR first and then connect them to the national services a system has to use, so a care setting and a GxP site can share one architecture and a second country becomes an integration task, not a rewrite.

Questions we are often asked

Does adding an AI assistant make our software a medical device?

That depends on the intended purpose. Assistants for notes, coding or intake are built to remain administrative, and a clinician approves each output. If a function would start to inform diagnosis or treatment, we raise it early and plan the medical-device route, with the HPRA as the Irish regulator for devices.

Where is the health data processed?

Wherever your legal basis and your policies permit, usually in your own environment or in an EU cloud region where you hold the encryption keys. Data flows, retention and access rights are written down before the build, ready for your DPIA and for any question from the Data Protection Commission.

Can you connect to national eHealth services?

Integration is designed on HL7 FHIR and IHE profiles, so it can link to national eHealth services in Ireland and to the European exchange format without proprietary interfaces.

How do you validate systems at a GxP site?

By risk, along GAMP 5 principles: requirements linked to automated tests, evidence created with every release, and change control your quality unit can follow from start to finish.

And when the AI makes a mistake?

Now and then it will. So drafts are never filed without a signature, extractions the system is unsure of are flagged for a person, and quality is measured against agreed test sets before and after each release.

Talk through your health or life-sciences project

Cutting the documentation load, getting ready for the EHDS or modernising a validated system? Begin with the workflow and the rules it has to meet.

Talk to us about your projectHow enterprise knowledge works