The Non-Device Trap in EU Pharma AI

The Non-Device Trap in EU Pharma AI

US pharma companies building AI into drug discovery and R&D are moving fast, with the AI-in-pharma market projected to grow over 40% annually through 2030 pharmaphorum.com. Many of these companies have run the obvious compliance check: is this a medical device under MDR or IVDR? If the answer is no, teams often stop there, treating device classification as the gate that decides whether Europe applies at all.

That gate does not exist. The EU AI Act attaches to use case and risk, not to device status, and a drug discovery tool that never touches MDR or IVDR can still land in a high-risk category on its own terms pharmaphorum.com. Layer on GDPR and the European Health Data Space, and the exposure compounds. A tool that processes European patient data for training, validation, or secondary research use inherits GDPR obligations and, increasingly, EHDS data-sharing rules regardless of whether it was ever submitted for conformity assessment as a device www.arnoldporter.com.

Academic work is catching up to this reality faster than most compliance functions. A recent integrated framework argues that medical AI governance in Europe cannot be handled framework by framework. The AI Act, MDR, IVDR, GDPR, and EHDS interact, and a compliance program built to satisfy one in isolation will leave gaps the others exploit www.frontiersin.org. That is the operational core of the problem for US innovators entering Europe: there is no single regulator or single filing that clears all four at once, and the ongoing MDCG debate over how AI-enabled technologies get treated in the MDR/IVDR revision means even the device boundary itself is not settled www.arnoldporter.com.

Cybersecurity adds a fifth stack that does not care about device classification either. IEC 81001-5-1 and the EU Cyber Resilience Act impose secure software lifecycle requirements on health-adjacent software independent of whether it clears the MDR bar, which means a discovery platform can be fully outside device regulation and still owe a documented security lifecycle to sell into the EU market medqair.com.

The decision this creates for compliance leaders is not whether to pursue device classification. It is whether the organization has built a governance architecture that maps AI Act risk tier, GDPR data flow, EHDS secondary-use exposure, and cybersecurity lifecycle obligations as four independent tracks, each capable of triggering compliance duties on its own. Treating “not a device” as a compliance conclusion rather than a single data point is the failure mode. The AI Act was written to reach AI systems wherever they create risk, not wherever MDR happens to already be watching.

For US pharma innovators, the practical test is simple to state and hard to satisfy. Can you show, tool by tool, which of the five frameworks applies, why, and what evidence supports that determination. If the answer today is “we checked MDR and moved on,” the gap is not theoretical. It is the next audit finding waiting to be written.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. Core argument that non-device AI still faces EU regulatory obligations is coherent and well-structured, but the claim that IEC 81001-5-1 and the Cyber Resilience Act apply to software ‘fully outside d
Source & Claim Verification	Qwen · local	cleared. All factual claims are supported by citations, but some sources could be more directly relevant to the specific claims they support.
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately reflects the interplay between the EU AI Act, MDR/IVDR, GDPR, and EHDS without conflating their scopes, though it omits explicit ISO 42001 alignment.
Technical Accuracy	Llama	cleared. The article accurately highlights the complexities of EU regulations (AI Act, MDR, IVDR, GDPR, EHDS, and cybersecurity laws) applicable to AI in pharma, emphasizing that non-device classification does
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies a common oversight in compliance, but could benefit from explicitly stating potential counterarguments or alternative interpretations of the regulatory landscape.
Novelty & Non-Duplication	Grok	held. Core ‘non-device trap’ thesis and multi-framework stack (AI Act/GDPR/EHDS/cyber) are already laid out in the cited Pharmaphorum guide, Frontiers compliance-by-design paper, and Arnold Porter digest, m
Validation	DeepSeek	cleared. The central claim that EU AI regulation applies independently of medical device status is factually supported by the EU AI Act’s risk-based framework and corroborated by the provided sources.

Sources cited: 14. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.