Applies now
MDR: EU Medical Device Regulation applies
Rules for software as a medical device included.
Healthcare & Life Sciences
Less administration, with the clinician still deciding.
What we would build for private hospital groups, clinic chains, pharmaceutical manufacturers and medical device exporters: health data flows on open standards, administrative AI that stays out of clinical decisions, validated systems ready for inspection, and patient information handled as sensitive personal data under the Personal Data Protection Act 2010 (PDPA).
For private hospital groups, clinic chains, pharmaceutical manufacturers and medical device exporters that answer to Malaysian law and, on exports, to EU rules.
25 March 2025
EU Health Data Space in force
Rights of patient access, exchange across borders and secondary use of health data in the EU, introduced step by step.
1 June 2025
Amended PDPA: DPO and breach notice
Data controllers appoint a data protection officer where thresholds are met and report personal data breaches to the Commissioner.
SourcePersonal Data Protection Act 2010 (Act 709) (opens external site)
2 August 2028
EU AI Act duties for AI in medical devices
High-risk duties for AI that is a regulated product or its safety component, relevant to device exporters selling into the EU.
What is changing for healthcare and life sciences
Patient information is sensitive personal data
Under the PDPA, health information counts as sensitive personal data, which a private provider may process only on the grounds in section 40, starting with explicit consent. Since 1 June 2025, a data controller must also notify personal data breaches to the Commissioner, within 72 hours under the Commissioner’s guidance.
Paperwork takes clinical hours
Clinical notes, coding, referrals and insurer approvals take hours that belong to patients. Well-bounded assistance can give some of that time back, as long as the clinician remains the author of the record.
The device boundary matters
Once software informs a diagnosis or a treatment choice, it can become a medical device; sold in the EU, it then falls under the MDR, and any AI inside it is high-risk under the EU AI Act. Keeping administrative AI on the safe side of that line is a deliberate design choice.
SourceRegulation (EU) 2017/745
Recovery has to be rehearsed
Ransomware has shown what happens to care when recovery was never practised. In the EU, healthcare providers fall under NIS2; in any market, resilience and segmentation belong in the architecture.
Problems and how we would respond
- The problem
Clinicians finish their notes after hours.
How we would respondLetters and summaries are drafted from structured data and clinical notes. The clinician corrects and signs them, and an unsigned draft never enters the record.
- The problem
Referrals and admission forms arrive in every possible format.
How we would respondIntake processing sorts referrals, extracts the clinical question and flags gaps for staff to complete, with a full audit trail.
- The problem
Systems within one group do not share a language.
How we would respondConnections built on HL7 FHIR and IHE profiles with common terminology such as SNOMED CT, rather than a custom interface for every pair of systems.
- The problem
Research and quality teams wait months for usable data.
How we would respondPipelines with pseudonymisation, documented lineage and access control, so data leaves the care setting only in a form your consent basis and policies allow.
- The problem
Every change to a validated system takes months.
How we would respondRisk-based computerised system validation in line with GAMP 5: automated tests and traceable requirements, so validation evidence comes with each release instead of after it.
- The problem
Medical, quality and regulatory knowledge is spread over thousands of documents.
How we would respondKnowledge search across SOPs, labelling and regulatory correspondence, citing the controlled version of each source.
Three zones above one data layer
We separate administrative support, clinical decision support and secondary use from the start. Every zone keeps its own rules, approvals and evidence, and all three rest on one interoperability layer.
Illustrative example
The assistance described on this page sits only in the administrative zone. Clinical decision support takes a medical-device route.
Read the diagram as text
One interoperability layer (HL7 FHIR, IHE profiles, SNOMED CT) links the electronic health record and other clinical systems, and three zones sit on top of it.
The administrative zone holds documentation drafts and coding and referral intake. Nothing reaches the record before a clinician signs it off.
Clinical decision support is a zone of its own: such software is validated as a medical device, under the MDR for the EU market, and counts as high-risk under the EU AI Act.
In the EU, secondary use follows the European Health Data Space: a health data access body grants a permit, processing happens in a secure environment, and researchers and registries receive the results.
Clinician sign-off
No draft or suggestion is written to the record without approval from a named clinician.
A firm device boundary
A function that begins to shape diagnosis or treatment leaves this zone and follows a medical-device route; it is never slipped in as a minor update.
Standards over custom interfaces
FHIR resources, IHE profiles and shared terminology replace bespoke point-to-point links.
Secondary use under control
Data for research leaves the care zone only pseudonymised, under a documented approval, into a secure processing environment.
EU dates for health data, devices and validated systems
Dates that matter to Malaysian exporters, groups with EU operations and validated systems. Several depend on implementing acts still in preparation.
Applies now
NIS2: National NIS2 laws take effect
EU healthcare providers come into scope.
Applies now
EHDS: Health Data Space regulation enters into force
Applies now
EU GMP: Drafts of Annex 11 and a new AI Annex 22 published
Consultation closed; no final texts adopted by the status date.
Status on 2 October 2026
Coming
EHDS: Regulation applies in general
Implementing acts fix the detailed formats and requirements.
Coming
MDR: First deadline for legacy devices
Class III and implantable class IIb devices; a targeted MDR revision is being discussed.
Coming
AI Act: Duties for AI in regulated products begin
AI in medical devices included, under the 2026 amendment.
Coming
EHDS: First priority data exchanged; secondary use opens
Patient summaries and ePrescriptions; health data access bodies in operation.
Coming
EHDS: Second set of priority categories
Medical images, laboratory results and discharge reports.
Rules and standards in brief
For Malaysian exporters and groups with EU operations, these EU instruments sit behind most health and life-sciences specifications. Each entry closes with its practical consequence.
For planning discussions only, not legal, regulatory or clinical advice. EU dates checked on 2 October 2026; Malaysian dates on 6 November 2026.
- GDPR: health data as a special categoryScopeEU law
Article 9 lists health and genetic data as special categories. Processing needs a specific legal basis, and large-scale processing generally calls for a data protection impact assessment. The GDPR reaches a Malaysian provider that offers services to people in the EU (Article 3(2)).
What it means in practiceWe settle access limits, pseudonymisation and retention before building and provide the technical input for impact assessments. Patients in Malaysia are covered separately by the PDPA rules on sensitive personal data.
SourceRegulation (EU) 2016/679, EUR-Lex (opens external site)
- European Health Data SpaceScopeEU law
Under Regulation (EU) 2025/327, people in the EU get electronic access to their own health data, health record systems must meet common requirements and a shared exchange format, and research use runs through health data access bodies. Its parts apply step by step between 2027 and 2031.
What it means in practiceRelevant if you sell health record systems or provide care in the EU. A system that already uses standard formats and logs every access can meet those rules later without being rebuilt.
SourceRegulation (EU) 2025/327, EUR-Lex (opens external site)
- Medical Device Regulation (MDR)ScopeEU law
Software meant for diagnosis, prevention, monitoring or treatment may itself be a medical device, typically class IIa or above under the software rule. Legacy devices received longer transition periods through Regulation (EU) 2023/607.
What it means in practiceA Malaysian manufacturer exporting devices to the EU should fix the intended purpose early. We keep administrative tools outside the device definition and run device software through a regulated lifecycle.
SourceRegulation (EU) 2017/745, EUR-Lex (opens external site)
- EU AI ActScopeEU law
AI counts as high-risk when it is itself a medical device or a safety component of one. After the 2026 amendment, those duties start on 2 August 2028 and run alongside MDR conformity assessment.
What it means in practiceWhere AI and device rules overlap, we plan a single set of technical documentation that serves both.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
- EU GMP Annex 11 and GAMP 5ScopeEU law
For GMP settings, Annex 11 lays down rules for computerised systems, while GAMP 5 is the industry’s guide to validating them by risk. In July 2025 the European Commission published draft texts of a revised Annex 11 and of a new Annex 22 on AI.
What it means in practiceValidation becomes part of the delivery pipeline, with each requirement traced to a test, evidence produced at every release and AI use cases measured against the draft Annex 22, as manufacturers supplying the EU will need.
SourceEudraLex Volume 4, European Commission (opens external site)
- NIS2 for healthcareScopeEU law
NIS2 applies in the EU to healthcare providers, EU reference laboratories and makers of certain medical products, who must manage risk, report incidents and secure their supply chain.
What it means in practiceSegmentation, backups and rehearsed recovery are part of the architecture. As a supplier we support your incident reporting, and your PDPA breach notification to the Commissioner where personal data is affected.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
Illustrative scenarios
Illustrative exampleDischarge summary drafting
A draft summary would be assembled from structured data and notes, then edited and signed by the responsible doctor.
Referral and admission intake
Incoming referrals would be sorted and checked for completeness, with missing details requested before triage.
Adverse event intake
At a pharmaceutical manufacturer, adverse event reports would be extracted into structured cases; a safety specialist assesses and decides on each one.
SOP and quality search
Staff would get answers from controlled SOPs and quality documents, with the approved current version cited every time.
Patient enquiries in Malay and English
An assistant would handle appointment, admission and billing questions and pass anything medical to staff.
Platforms for health and life sciences
Salesforce
Summit PartnerPatient service, medical representatives and partner programmes, with PDPA consent records kept and clinical data left in the clinical systems.
SAP
Gold PartnerSupply chain, batch management and finance for pharmaceutical and device manufacturing, linked to quality and validation processes.
FromNine holds the partner levels shown. Product names belong to their respective owners.
Malaysia
Patient data under the PDPA, devices under EU rules for export
In Malaysia, health information processed by private providers is sensitive personal data under the PDPA: section 40 starts from explicit consent. Since 1 June 2025, data controllers notify personal data breaches to the Commissioner, within 72 hours under the Commissioner’s guidance, and appoint a data protection officer where the thresholds are met.
Pharmaceutical and device companies that export to the EU meet a second frame: the MDR, the EU AI Act for AI in devices and, for EU operations, the GDPR and the EHDS. We design health data flows on international standards first, so serving an EU market adds an integration project rather than a rewrite.
- Personal Data Protection Act 2010 (PDPA)Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727): data protection officer, breach notification, data portability (opens external site)
- MDRMedical Device Regulation (EU) 2017/745 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
- GDPRGeneral Data Protection Regulation (EU) 2016/679 (opens external site)
- European Health Data SpaceEuropean Health Data Space Regulation (EU) 2025/327 (opens external site)
Frequently asked questions
Could an AI assistant make our software a medical device?
It turns on intended purpose. We keep documentation, coding and intake assistants administrative, and a clinician approves each output. If a feature would start to shape diagnosis or treatment, we tell you at once and plan the medical-device route.
Where would patient data be processed?
Within the limits of your consent basis and policies, normally in your own environment or a cloud region agreed with you, with the encryption keys in your hands. Data flows, retention and access are written down before build, and the hosting location goes into the contract.
Can you connect to other health systems and EU exchange formats?
Integration is designed on HL7 FHIR and IHE profiles, so it can connect to the systems of other providers, insurers and third-party administrators, and to the European exchange format for EU operations, without proprietary interfaces.
How do you handle validation in GxP settings?
Risk-based and in line with GAMP 5: requirements traced to automated tests, evidence generated with every release and change control your quality unit can follow.
What happens when the AI is wrong?
Sometimes it will be, and the design expects that. No draft is filed without sign-off, extractions with low confidence go to a reviewer, and agreed test sets measure quality before and after every release.
Plan your health or life-sciences project
Cutting documentation time, preparing device software for EU export or modernising a validated system? Begin with the workflow and the rules that govern it.