AI and CE marking: what to check in healthcare software

The European Commission has once again placed the AI Regulation (AI Regulation) at the centre of the legal framework for the use of AI systems in the EU, while the BOE (Spain’s official gazette) maintains the focus on training materials and syllabuses linked to the GDPR and the LOPDGDD (Spain’s Data Protection Act). This context requires clinics and private practices in Spain to review, before buying or renewing technology, two fronts at once: whether the software falls within the scope of a “medical device” with CE marking and what role the clinic assumes (as data controller) when the provider integrates AI that processes health data, according to the framework described by the European Commission and the data protection content published in the BOE.

What changes with the AI Regulation in a private practice

The European Commission summarises that the AI Regulation establishes a comprehensive legal framework to regulate AI in the EU, alongside other digital laws, with a governance and obligations approach based on the risk posed by the system (according to the European Commission in its explanatory material on the AI Regulation).

For a clinic, the immediate practical implication is not “deploying AI” but classifying what it already buys or uses: schedules with automated triage, voice-to-text transcription, assistants that draft reports, internal chatbots, coding solutions or decision-support tools integrated into clinical platforms. Although the Commission’s documentation does not act as a sector-specific health guide, it does set a checkpoint for management: any solution marketed as AI or that incorporates advanced automation requires due diligence in purchasing and contracting.

Who should do what: provider, clinic and data processors

In practice, the clinic typically acts as the system’s client and user and, for data protection, as the data controller of health data when it determines purposes and means (an approach consistent with the GDPR perspective found in syllabuses published in the BOE). The software provider may be a data processor and, under the AI Regulation, could also have its own obligations as the system provider.

Implication for management: when negotiating a contract or renewal, it is advisable to require the provider to set out in writing which components are AI, the purposes for which they are used and the roles assumed by each party, without presuming that “if the software is healthcare-grade everything is covered”. The European Commission describes the AI Regulation as a general regulatory framework; therefore, how a system fits can depend on how it is used in the clinic.

CE marking and medical software: why it remains a purchasing filter

CE marking functions as a regulatory signal when software is marketed as a medical device or meets the requirements to be one. In the regulatory ecosystem referenced in the sources, Real Decreto 192/2026, according to the reference published by Noticias Jurídicas, includes an explicit mention of situations in which certain products may not bear CE marking, within a context of accelerated and exceptional market introduction.

Without delving into technical casework, that reference serves as a reminder for a clinic: CE marking and “health software” are not synonymous, and there may be scenarios in which a product does not carry CE marking. The purchasing manager should treat it as a documentary and due-diligence requirement, not as a commercial detail.

What to review when buying or renewing

From a management perspective, the relevant action is to request evidence and leave a documented trail. When evaluating software that affects clinical processes or the handling of health information, the clinic should ask the provider, at minimum, for:

• A declaration on whether the product bears CE marking and, if so, under what conditions it is marketed.
• Intended-use documentation (to avoid a “management” tool being used as if it had a regulated clinical purpose).
• The actual functional scope: whether it includes AI modules (e.g., summary of the clinical record, automatic classification, data extraction), so that use aligns with what was contracted.

These checks do not replace the advice of counsel or technical review, but they help the clinic avoid assuming risks through lack of verification.

Data protection: the BOE puts the GDPR back in the foreground

The BOE has published a provision (Provision 20626 of BOE no. 247 of 2026) that lists the Regulation (EU) 2016/679 (GDPR) and the Ley Orgánica 3/2018 (LOPDGDD) as syllabus material. Although this is curricular content, for the private sector it is a clear sign: data protection remains a transversal axis in procedures, inspections and compliance culture.

In a clinic, the especially sensitive data is health data. If software includes AI (for example, to transcribe consultations or structure free text), data flows can expand: cloud providers, sub-processors, temporary storage, and reuse to improve models. At that point, management must ensure that the contract and the provider’s documentation do not leave grey areas.

Three management checks before “activating” AI functions

Based on the GDPR framework cited in the BOE, and on the fact that the AI Regulation establishes obligations according to system type (according to the European Commission), the clinic can structure an internal review around three practical controls:

1. Purpose and configuration: confirm which data are processed and for what purpose when an AI function is enabled (e.g., transcription, field extraction).
2. Orders and sub-processor arrangements: identify whether third parties have access to data and whether they are covered by a data processing agreement.
3. Information and internal record-keeping: ensure the clinic can document the processing and respond to requests or incidents, consistent with the GDPR/LOPDGDD framework.

What it means for the clinic in procurement and vendor audits

Alongside the regulatory focus, the analysis on regulation and innovation referenced by elEconomista points to a practical consequence: compliance may be manageable for large companies and costly for smaller ones (according to the elEconomista document). Applied to healthcare procurement, this can create a market of providers with uneven documentation, evidentiary capacity and responsiveness.

Implication for the clinic: in private tenders or vendor comparisons, price and features are not enough. You must include criteria for compliance capability: response times to audits, contractual clarity, and availability of documentation on CE marking (where applicable) and on the use of AI (if present).

What remains pending and how to follow developments without jumping the gun

The European Commission presents the AI Regulation as a broad framework. For a private practice, some operational detail may depend on subsequent developments, guidance and market practice (for example, how providers label AI functions or what documentation they supply). Therefore, when a provider promises “full compliance”, it is wise to request verifiable documentary references and to keep a record of what is delivered.

On the data protection side, the inclusion of the GDPR and the LOPDGDD in BOE publications does not by itself impose new obligations on the clinic, but it reinforces that any healthcare software project with AI should be born with contracts, records and organised access controls.

References and links

• AI Regulation (European Commission documentation): European Commission
• GDPR and LOPDGDD (syllabus published in the BOE, Provision 20626): BOE
• CE marking and limitations in accelerated introduction (reference to Real Decreto 192/2026 in Noticias Jurídicas): Noticias Jurídicas
• Regulatory compliance and cost for small companies (document referenced by elEconomista): elEconomista

This article summarises public sector information. It is not legal or tax advice.