Healthcare AI 2025

AUSTRIA Law and Practice Contributed by: Harald Strahberger and Florian Sesztak, Kinstellar

• Hospitals and Health Resorts Act ( Krankenanstalt- en- und Kuranstaltengesetz – “KAKuG”): Regulates the operation of hospitals and health institutions in Austria. AI systems used within hospitals must comply with institutional standards for quality assurance and medical responsibility. • Health Telematics Act ( Gesundheitstelematikge- setz – “GTelG”): Governs the secure exchange of health data via telematics systems. Relevant for AI systems operating across digital health platforms or involving remote diagnostics. • Federal Act on the Organisation of the Health System ( Gesundheitsreformumsetzungsgesetz – “GRUG”): Lays the structural foundation for Austria’s health system, including responsibili - ties for health data infrastructure. AI development involving public health data must respect this legal framework. • Act on the Documentation in the Healthcare System ( Gesundheitsdokumentationsgesetz – “GDDG”): Sets requirements for collecting and processing health data for statistical and planning purposes. AI tools used for healthcare analytics or epidemiology must comply with its provisions. 2.3 Approval and Certification Processes In Austria, healthcare AI systems used for medical purposes are generally regulated as medical devices under the MDR and the MPG. Most of the AI systems used fall into Class IIa or higher, requiring Notified Body involvement for certification. Developers must, therefore (following the MDR), complete a conformity assessment, prepare technical documentation, and conduct a clinical evaluation showing the AI’s safety and effectiveness. In addition to the information that manufacturers of standard medical devices must pro - vide in the market approval procedure, developers of AI systems must also provide the following: • Detailed documentation of the algorithm, including its logic, performance limits, and potential failure modes: Regulators expect transparency about how decisions are made, especially for systems using machine learning. • Continuous monitoring and update mechanisms: The AI systems may evolve, hence the manufactur - ers must ensure that updates do not compromise

safety or performance and must report significant changes. • Stronger clinical and data validation requirements: The clinical benefit and reliability of AI systems must be demonstrated with robust evidence, often going beyond what is required for static or hard - ware-based devices. • After approval, the AI system receives a CE mark, which is valid throughout the EU. Please note that in Austria, there is no dedicated fast-track for mar - ket approval of AI systems. • If AI tools access Austria’s electronic health record system ( Elektronische Gesundheitsakte – “ELGA”), they must meet the standards according to ELGA- G for interoperability and data protection. 2.4 Software as a Medical Device (SaMD) In Austria, AI-based software intended for diagnos - tic, therapeutic, or clinical decision-support purposes is regulated as SaMD under the MDR and the MPG. Accordingly, any software with a medical purpose falls within the scope of these regulations (see in detail 2.1 Regulatory Definition and Classification of Healthcare AI and 2.3 Approval and Certification Processes ). While the MDR assumes a fixed algorithmic structure, continuously learning or adaptive AI systems pose specific regulatory challenges. Current Austrian and EU practice requires that such systems be “locked” at the time of certification. Any future changes to algo - rithm performance or intended use typically require a new conformity assessment unless covered by a pre-defined update protocol. The AI Act requires that high-risk AI systems be designed and developed in a way that ensures their operation is sufficiently transparent, enabling deploy - ers to interpret the system’s output and use it appro - priately. Therefore, a quality and risk management system must be established by which any changes to the algorithm must be documented. Furthermore, high-risk AI systems must have appropriate human- machine interface tools so that natural persons can effectively oversee them during the period in which those systems are in use.

CHAMBERS.COM