MDR · IVDR · EU AI Act

Regulatory compliance for AI-based medical devices.

You have machine learning in your device — and a notified body that has never seen anything quite like it. I help manufacturers of medical and IVD devices get AI-based products through conformity assessment, and keep them compliant as the models evolve.

Prof. Dr. Oliver Haase · Konstanz, Germany · working in English and German

Why this is hard

AI does not fit neatly into the medical device regulations.

The frameworks were written for deterministic software. Three gaps come up in almost every project.

No path for models that learn

MDR has no equivalent of the FDA's Predetermined Change Control Plan. Every retrained model risks being treated as a significant change — and another external assessment.

Two regulations, one device

The EU AI Act applies on top of MDR and IVDR, not instead of them. Risk management, data governance and post-market monitoring have to satisfy both without duplicating your QMS.

Evidence auditors accept

Clinical evaluation, performance validation and risk controls for a neural network look different from classical software. The burden is on you to explain them — in documentation that holds up in an audit.

Services

Four ways to work together.

From a half-day briefing for your team to sustained work on a technical file.

Training & seminars

Developing AI-based medical and IVD devices in compliance with legal requirements — a practical seminar for development, regulatory and quality teams. Delivered online or on site, in English or German.

  • Half day, compact — core requirements and pitfalls
  • Full day — including hands-on work on your own device
  • Tailored to your product and audience

From €2,500 — half day, up to 50 participants

Gap assessment

A focused review of where your AI-based device stands against MDR/IVDR and the AI Act. You get a written report with prioritised findings and a realistic route to closing them — a good first step before committing to a larger engagement.

  • Document review and structured interviews
  • Findings mapped to specific articles and standards
  • Prioritised action plan

Fixed price — scoped after a first call

Regulatory project work

Hands-on support inside your project: change control for continuously learning models, technical documentation, risk management for ML, and the arguments you will need in front of your notified body.

  • Change control plans for self-learning models
  • Risk management (ISO 14971) applied to ML
  • Software lifecycle (IEC 62304) and AI Act readiness
  • Technical file sections and review responses

Day rate or fixed scope — on request

Expert opinions

An independent, written assessment of a specific question: is this feature a medical device, does this change require reassessment, is this validation evidence sufficient? Useful for internal decisions and for discussions with authorities and auditors.

  • Qualification and classification questions
  • Significant-change assessments
  • Second opinion on validation strategy

Fixed price — scoped after a first call

References

A few of the companies we have worked with.

Trusted by industry leaders

Prof. Dr. Oliver Haase

Who you work with

Prof. Dr. Oliver Haase

Validate ML is deliberately small. You work with me directly — not with a team you meet once at the kick-off.

I am a professor of computer science and a regulatory consultant, which is an unusual combination and the point of the whole thing: I can read your training pipeline and your technical file in the same afternoon. Most regulatory consultants cannot assess whether a validation strategy is scientifically sound; most ML engineers cannot tell you what a notified body will accept. The interesting problems live exactly in that gap.

  • Professor of Computer Science, distributed systems and machine learning
  • Managing Director, Validate ML GmbH, Konstanz
  • Consulting on AI in medical devices since 2020
  • Regular speaker on AI and regulatory affairs in MedTech

LinkedIn

Is your device on solid ground?

Tell me what you are building and where it is stuck. A 30-minute call usually makes it clear whether the problem is small, large, or not really a problem at all.

Write to oh@validateml.de