What the agent can and cannot do

The strictest line of the six, so it effectively sets the bar for the whole product. Regulation is triggered by the manufacturer's intended purpose, assessed objectively from how the product is designed, described, marketed and used. The February 2026 AI guidance explicitly names chatbots that use large language models to apply clinical triage protocols as in-scope. The clinical decision support carve-out is narrow and oriented to clinician-facing tools, not patient-facing symptom interpretation.

Structurally the worst place to be misclassified. Under MDR, any software with a medical purpose is a device, and Rule 11 is severity-based, so almost no standalone medical-purpose software stays Class I. The AI Act stacks on top: medical-device AI is high-risk, and a compliant product must satisfy both MDR and the AI Act. The Digital Omnibus package agreed in late 2025 pushes the AI Act compliance dates back: standalone high-risk AI to 2 December 2027, and AI embedded in MDR or IVDR devices to 2 August 2028. Rule-based software with no learning component is not covered by the AI Act at all.

Post-Brexit Great Britain runs its own regime but keeps the same intended-purpose logic and is aligning with EU MDR and IMDRF. The MHRA's Software and AI as a Medical Device Change Programme is one of the most active in the world. Post-market surveillance regulations are already in force. The draft Medical Devices (Amendment) Regulations 2026, published 11 May 2026, introduce risk-proportionate classification, Predetermined Change Control Plans for SaMD and AI, an International Reliance Pathway, and Regulation 19D prohibiting misleading or unsubstantiated promotional claims. A dedicated AI framework is expected during 2026.

The most permissive regime for clinician tools, and it just got more so, but that does not help a patient-facing use case. The January 2026 CDS final guidance, which supersedes the 2022 version, broadens the non-device clinical decision support exemption: it removed the automatic time-critical equals device rule and now allows single-recommendation tools under enforcement discretion. But the guidance remains focused exclusively on tools that support a healthcare professional. It is silent on consumer-facing chatbots, symptom checkers, and patient decision support, and the earlier enforcement-discretion proposals for consumer tools were never reinstated.

Draft but directionally clear. The October 2025 draft guidance confirms that software performing a medical purpose falls within the MDR 2017 regime, classified A to D on intended use, information significance, and situation severity. Crucially, the guidance states that administrative and non-clinical software, such as billing or appointment management systems, stays outside scope. A triage-capable agent would likely be Class C under central CDSCO licensing. The Telemedicine Practice Guidelines 2020 separately bar platforms from making clinical decisions, so both regimes point the same way.

Reliance-based. Federal Decree-Law 38 of 2024 took effect 2 January 2025 and consolidated regulation under the Emirates Drug Establishment, which by early 2026 absorbed the medical-device functions previously held by MOHAP. The UAE uses GHTF-style classification and relies primarily on approvals from reference regulators such as EU CE marking or US FDA clearance. The Abu Dhabi DOH and Dubai DHA each publish AI healthcare policies that sit inside the broader federal and emirate framework, including data protection.