Case files · #2

Wellness on the label, medical in the code

A skin-check app with an AI risk score

A skin app is marketed as wellness, then as melanoma detection. The advert makes the problem visible, but the risk score had already made it a medical device.

Last reviewed: 13 October 2026 · First published on LinkedIn: 12 October 2026

Composite caseMedical devicesMDR Rule 11Annex IC-329/16

01

The scenario

A startup builds a skin-check app. You photograph a mole, an AI model gives it a risk score, and the app tracks how it changes over time.

On the app store it says "Track your skin." The founders see a wellness product. Then marketing launches a campaign: "Detect melanoma early."

The question the team asks is whether the campaign turned their app into a medical device. The better question is whether it was one already.

02

Roles and classification

  • The startup is the manufacturer under the Medical Device Regulation MDR Art. 2(30) and the provider under the AI Act Art. 3(3).
  • The intended purpose comes from everything the manufacturer says: label, instructions, promotional and sales material MDR Art. 2(12). An advert counts.
  • The function counts too. Since the Court of Justice ruling in Snitem and Philips France C-329/16, 2017, software that processes a patient's own data for a medical purpose is a medical device, whatever it is called. The MDCG guidance on software qualification MDCG 2019-11 follows the same logic.
  • Classification: software that provides information used for diagnostic decisions is at least class IIa, and higher if a wrong decision can cause serious deterioration MDR Annex VIII, Rule 11. Class IIa and above need a notified body.
  • AI Act: a medical device that needs a notified body is high-risk Art. 6(1), Annex I, from 2 August 2028. Consumers using the app privately are not deployers Art. 2(10); a clinic using it is.

03

The variants

The same app at four stages. What decides is the function and the claim together, and the stricter of the two wins.

VariantWhat the product does and saysMDREU AI ActFrom
1A photo diary: stores pictures and dates of a mole; the user compares them by eye. No analysis, no scoreNot a medical device. No processing of the user's data for a medical purpose.No AI, or minimal riskNow
2Adds an AI risk score on each mole. Marketed as "Track your skin"Medical device by function, whatever the label: a patient-specific score that informs a diagnostic decision C-329/16. At least class IIa. Selling it without CE marking is already a breach.High-risk via Annex I, once a notified body is requiredMDR: now · AI Act: 2 Aug 2028
3Same app, marketed as "Detect melanoma early"Medical device beyond doubt. The claim must also be backed by clinical evidence MDR Art. 61 and may not go beyond what the evidence supports MDR Art. 7High-risk via Annex IMDR: now · AI Act: 2 Aug 2028
4Same model, sold to dermatology clinics as a triage aid for professionalsMedical device; the class depends on the decisions it supportsHigh-risk; the clinic is a deployer with its own duties Art. 26MDR: now · AI Act: 2 Aug 2028

Under the GDPR, photos of a person's skin analysed for health purposes are health data Art. 9; for a consumer app, explicit consent is the usual basis.

04

What the company did

The startup has two honest options. The first is to step back to variant 1: drop the score, keep the diary, and never mention melanoma again in an advert, a pitch or a post.

The second is to own the medical purpose: a quality system under ISO 13485, a software life cycle under IEC 62304, clinical evaluation, a notified body. Twelve to twenty-four months, realistically. One consolation: the AI Act lets providers of Annex I products fold its requirements into the same technical documentation Art. 8(2).

What it cannot do is stay in variant 2, telling users "wellness" while the code does medicine.

Updated after discussion on LinkedIn. The first version of this case presented the "Track your skin" app, with its risk score, as a wellness product that the advert pushed over the line. Readers with deep SaMD experience pointed out, rightly, that the score alone already makes it a medical device. The table now reflects that.

05

Lessons for teams

  1. Qualification looks at the function and the claims together. The stricter of the two decides, and wording can only make things worse.
  2. Map every feature to the decision a user would take from it. A score, a flag or an alert that steers "see a doctor or don't" is a medical function.
  3. Treat marketing copy as a controlled input. Review new claims under the same change control as software releases.
  4. If you go the medical route, plan one technical file for the MDR and the AI Act from day one, and one evidence plan that also serves reimbursement.
  5. Telling someone a mole is fine is as serious a claim as raising an alarm. Validate for false negatives, not only for detection.

06

Open questions

  • Is consumer melanoma risk scoring class IIa or IIb under Rule 11? It depends on how the decisions it informs are framed, and notified bodies may read it differently.
  • Where does a photo diary stop? Side-by-side comparison is fine; an overlay that highlights "changes detected" is already analysis.
  • For a Swiss startup, the Medical Devices Ordinance mirrors the MDR, but selling in the EU requires an EU authorised representative. What does that change in practice?

Related

AI Act: high-riskAI Act: datesCase #1: Same camera, four laws
← All case files

Questions

A case like yours?

If your product sits close to one of these lines, the first question is what exactly it does. Write to me if you want to talk it through.

Start a conversation

Case files are study material, not legal advice. Cases are composite or anonymised; any resemblance to a specific company is not intended.