Article Index
The demographic transition and population aging in nations such as Italy are accompanied by the need to implement healthcare models equipped with automation. The development of artificial intelligence and medical robotics responds to this need with evolutionary cycles that challenge the legislator’s timelines. The digital transition represents a clinical and managerial paradigm shift aimed at improving the effectiveness of care.
The regulatory framework of the European Union governs this scenario through a normative triad: the Medical Devices Regulation (EU Regulation 2017/745, MDR), the Artificial Intelligence Act (EU Regulation 2024/1689, AI Act), and the Directive on liability for defective products (EU Directive 2024/2853, rPLD). This framework requires strategic reflection in the face of a transformation intertwined with patient rights.
The provisions place the protection of the individual at the center. In the digital healthcare market, regulatory deadlines and deferments outline a quantitative gradation for a qualitative approach to patient protection. This timeframe configures a strategic balance for healthcare management and manufacturing companies. Greater computing power corresponds to a redefinition of legal, strict, and contractual liability. Software companies choose to structure legal safeguards in harmony with the evolution of careful and rigorous jurisprudence.
Synoptic table of the jurisprudential and regulatory framework
The following table offers a map of the sources and disputes that outline risk management in the medical-technological sector.
| Source or Jurisprudence | Subject of the Decision or Norm | Real Event Brought to Trial | Principle of Law and Regulatory Impact |
| Dir. EU 2024/2853 (rPLD) | Liability for defective products | Placing software and AI on the market (from December 2026) | Classifies software as a “product” and foresees the presumption of defectiveness in cases of algorithmic opacity. |
| CJEU, C-568/24 (Sof Medica) | Public procurement and equivalence | Cluj-Napoca Hospital tender for robotic surgery systems | Requires the consideration of infrastructural limits and invites the inclusion of equivalence clauses between manufacturers. |
| General Court EU, T-38/21 (Inivos) | Direct awards in urgency | Purchase of disinfection robots by the European Commission during the COVID-19 emergency | Sets the limits for procedures without a call for competition and confirms the obligation to ensure performance standards. |
| CJEU, C-68/21 (Iveco Orecchia) | Competition and supply in procurement | Supply of spare components for bus fleets | Guides administrations to avoid closed ecosystems, requiring the acceptance of declarations of equivalence. |
| CJEU, C-410/19 (Software Incubator) | Qualification of intangible assets | Supply of software with a perpetual license | Includes software in the notion of “goods” and “product”, outlining strict liability. |
| Court of Siena, Judg. 49/2026 | Classification and CE marking | Sanctions the sale in pharmacies of artisanal insoles classified as medical devices | Emphasizes the perceived intended use over the manufacturer’s intent and disclaimers. |
| Court of Florence, Ord. 4329-1/2025 | Regulatory obstacles in urgency | Development of ocular software on an infusion pump for a patient requesting assisted suicide | Distinguishes between a therapeutic device and hardware for self-determination, validating the tests of the auxiliary body (CNR). |
| CJEU, C-203/22 (Dun & Bradstreet) | Transparency versus trade secret | Denial of a contract based on an automated credit scoring algorithm | Requires the operator to balance trade secrets with the injured party’s right to know the algorithmic logic. |
| CJEU, C-407/19 (Katoen Natie) | Equal treatment | System for recognizing and assigning work to Belgian dockers | Promotes the use of objective and impartial metrics in decision-making systems. |
| CJEU, C-817/19 (Ligue droits humains) | Limitations on data usage | Processing and retention of air passenger data (PNR Directive) | Regulates massive processing and sets protection parameters applicable to AI training on medical records. |
| CJEU, C-65/20 (KRONE-Verlag) | Delimitation of defective product | Injuries caused to a reader by medical advice (horseradish compress) published in a newspaper | Specifies that a professional opinion or informational content does not constitute a defective product. |
Impact of taxonomy and public procurement in European jurisprudence
European jurisprudence is constantly engaged in resolving disputes related to formal classifications and public procurement procedures. These dynamics dictate the timelines for placing technologies on the market, regulating the innovation chain to protect safety standards. Attention is focused on the infrastructural integration of hospital software and emergency procedures.
In public procurement, tender specifications require to weigh the infrastructural limits of the contracting authorities. The Court of Justice (case C-568/24, Sof Medica v. Cluj-Napoca Hospital) offers an exemplary case. On the issue of acquiring robotic surgery systems, the judges outlined the limit for administrations to formulate requirements capable of identifying a single manufacturer, suggesting the acceptance of offers based on functional equivalence. Manufacturers of AI platforms have the opportunity to design open architectures, ensuring interoperability to prevent practices of technological closure or lock-in.
Regarding urgent negotiated procedures, the General Court of the European Union recalls the importance of performance standards. In the Inivos case (case T-38/21) on the purchase of hospital disinfection robots, the ruling sets a clear principle: derogations dictated by pandemic necessities keep the safety thresholds unchanged for machinery.
To protect competition, jurisprudence guides administrations to avoid drafting tenders likely to favor closed software ecosystems (Iveco Orecchia case, case C-68/21). By analogy in the medical sector, healthcare organizations evaluate the acceptance of supplementary modules developed by third parties. The qualification of intangible assets completes the architecture. With case C-410/19, the Court establishes that software falls within the legal concepts of goods and products, overcomes the figure of service provision, and initiates reflection on civil liability.
National jurisdictional applications
Similar dynamics of adaptation emerge in the Italian jurisdictional context. The confrontation between innovation and regulatory precepts takes on concrete outlines. The application of the discipline highlights the boundaries of the certification framework. The Court of Siena (judgment no. 49/2026) confirmed an administrative sanction against a merchant for the marketing of footwear insoles. The products, although accompanied by exculpatory disclaimers, exhibited commercial purposes related to foot ailments. The authority outlined the qualification of unregistered medical devices based on objective appearance and therapeutic promise. This ruling illustrates the sanctionary exposure linked to inaccurate self-assessments, with significant risk profiles for companies called upon to classify complex algorithmic triage systems.
Regarding assisted suicide, the Court of Florence (order no. 4329-1/2025) offers a precedent of balancing. Faced with the needs of an immobilized patient, private companies had declined to adapt the instruments in compliance with the MDR. The Court appointed the National Research Council (CNR) to engineer an ad hoc solution, integrating an infusion pump with ocular software. The Ministry of Health raised objections due to the impossibility of qualifying the new hardware as a medical device. The Court harmonized the requests and validated the functional tests carried out in a real environment at the patient’s home, in derogation of the timelines of ministerial laboratories. The case highlights the delicate balance between the patient’s biological needs and administrative timelines.
Evolution of the regulatory framework and reallocation of corporate risk
The entry into force of the Directive on liability for defective products (rPLD) in December 2026 introduces a reallocation of civil risk. The directive frames medical software and machine learning systems as products, including SaMD and SiMD, and grants injured parties the right to act under strict liability against the developing company.
Therefore, a legal presumption of system defectiveness is outlined if the manufacturer fails to disclose the design specifications. The protection of trade secrets finds a limit in favor of transparency. The Court of Justice (case C-203/22, Dun & Bradstreet) confirms the principle whereby the operator reconciles the protection of intellectual assets with the transparency of decision-making logic towards the injured party.
The directive expands the notion of manufacturer. Hospital structures that carry out the local retraining (fine-tuning) of a commercial predictive algorithm with internal datasets assume the subjective qualification of manufacturers, with the associated burden of strict liability. Algorithmic training requires new parameters. Decision-making processes require impartial metrics (Katoen Natie case, C-407/19) and foresee limitations on the massive use of data (PNR ruling, C-817/19), valuable rules for the management of medical records.
To balance the framework, the Court (case C-65/20, KRONE-Verlag) protects the medical profession: a professional opinion does not constitute a defective product. Consequently, liability for an inaccurate algorithmic output involves the manufacturing company, while the conduct of the healthcare professional remains guided by the parameters of professional negligence.
Operational strategies for managing regulatory risk
To promote business continuity and limit legal liabilities, companies and healthcare management must adopt clear strategic measures. An operational priority coincides with the revision of contracts coordinated with the functional organizational adaptation of personnel. Contracts require the definition of warranty and indemnity regimes. If the structure introduces calibration interventions, the agreements take care to demarcate the scope of liability, protecting the original supplier with respect to alterations beyond their control.
A technological prerequisite becomes the implementation of security and explainability right from the design phase (explainability by design). The conception of the software aims to ensure the comprehensibility of decision-making logic by the physician. Overcoming the black box paradigm is the tool to prevent the application of the presumptions of defectiveness of the rPLD.
The strategy encourages joining regulated experimentation spaces (regulatory sandboxes). Validation within these ecosystems allows developers to test algorithms under exemption from ordinary market procedures, structuring a documented risk management in the phases prior to commercial launch.
Adaptation, therefore, invites the healthcare, legal, and engineering departments to work in synergy, overcoming the silo approach. This evolution transforms regulatory compliance from a burden into a factor of stability, reliability, and competitiveness for digital healthcare.