Digital health is where AI regulation is at its most layered, and where the omnibus postponements bought the most useful time. A Turkish healthtech serving EU users faces medical-device law, the AI Act’s product track, KVKK’s strictest data category and Ministry of Health rules simultaneously. The good news: the sequence is now clear enough to plan against.
First question: is your AI a medical device?
Everything turns on intended purpose. Symptom checking that informs diagnosis, triage that prioritises care, dosing support, image analysis; these are medical purposes, pulling the software into the EU MDR as software-as-a-medical-device and, in Türkiye, into the parallel TİTCK framework. Wellness positioning (fitness, general lifestyle) stays outside, but the boundary is what your marketing says, not what your disclaimer says. A “wellness” app whose app-store screenshots promise detection of disease has classified itself.
The AI Act’s two tracks for health
- Product track (Annex I): AI that is a safety component of an MDR-regulated device follows the medical-device conformity route, with AI Act requirements layering into it; obligations now applying from 2 August 2028 after the omnibus.
- Use track: non-device AI in health contexts (emergency triage falls under Annex III) rides the December 2027 high-risk timeline; plain administrative AI (scheduling, transcription) mostly carries only the Article 50 transparency duties from August 2026.
KVKK: health data has no easy path
Health data is special-category under KVKK Article 6, processable essentially with explicit consent or by persons under secrecy obligations for defined health purposes. Product consequences: consent flows designed as first-class UX, not checkbox debt; training on Turkish patient data effectively requiring anonymisation that survives scrutiny (pseudonymised is still personal data); and cross-border architecture decisions (most model APIs process abroad) that must clear Turkish transfer rules for the most sensitive category there is.
What we tell healthtech founders to build now
- Write the intended-purpose statement first and align marketing to it; reclassification after launch is the most expensive sentence in digital health.
- Run the two-track map: which features are device-adjacent (2028 track), which are Annex III (Dec 2027), which are transparency-only (Aug 2026). Roadmap accordingly.
- Design the clinician-in-the-loop honestly: oversight that is technically overridable but practically always accepted will be read as automation.
- Treat anonymisation as an engineering deliverable with documented methodology, not an adjective in your privacy notice.
- Contract the liability chain: hospital customers will push malpractice-adjacent risk to you; your model vendor pushes it back; the gap is closed in your contracts or it is yours.
Digital health is one of our named verticals; the intersection of AI & Algorithm Law and KVKK + GDPR work. For the FRIA angle that applies to some deployments, see our FRIA walkthrough.
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro callMore from Vircon Insights
From the ICTA to the Cybersecurity Presidency: Türkiye's New Digital Authority Map and the Two-Hour Rule
August 4, 2026Article 50 Is Live: The Two-Week Transparency Runbook for AI Products Serving EU Users
August 18, 2026Türkiye's First Official RWA Move: The Digital Precious Metals Communiqué Opens a Third Lane for Tokenization
August 11, 2026Türkiye's 12th Judicial Package Through a Technology Lens: The Full Map of Law No. 7589
August 10, 2026The Classification Memo: How to Map Your Product to the AI Act in One Afternoon
July 30, 2026AI in Games: Generated Assets, LLM NPCs, Player Data and a Studio’s Legal Map
July 27, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Startup Law
Incorporation, founder agreements, ESOP, term sheets, regulatory matters.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →