Digital health is where AI regulation is at its most layered, and where the omnibus postponements bought the most useful time. A Turkish healthtech serving EU users faces medical-device law, the AI Act’s product track, KVKK‘s strictest data category and Ministry of Health rules simultaneously. The good news: the sequence is now clear enough to plan against.
First question: is your AI a medical device?
Everything turns on intended purpose. Symptom checking that informs diagnosis, triage that prioritises care, dosing support, image analysis; these are medical purposes, pulling the software into the EU MDR as software-as-a-medical-device and, in Türkiye, into the parallel TİTCK framework. Wellness positioning (fitness, general lifestyle) stays outside, but the boundary is what your marketing says, not what your disclaimer says. A “wellness” app whose app-store screenshots promise detection of disease has classified itself.
The AI Act’s two tracks for health
- Product track (Annex I): AI that is a safety component of an MDR-regulated device follows the medical-device conformity route, with AI Act requirements layering into it; obligations now applying from 2 August 2028 after the omnibus.
- Use track: non-device AI in health contexts (emergency triage falls under Annex III) rides the December 2027 high-risk timeline; plain administrative AI (scheduling, transcription) mostly carries only the Article 50 transparency duties from August 2026.
KVKK: health data has no easy path
Health data is special-category under KVKK Article 6, processable essentially with explicit consent or by persons under secrecy obligations for defined health purposes. Product consequences: consent flows designed as first-class UX, not checkbox debt; training on Turkish patient data effectively requiring anonymisation that survives scrutiny (pseudonymised is still personal data); and cross-border architecture decisions (most model APIs process abroad) that must clear Turkish transfer rules for the most sensitive category there is.
What we tell healthtech founders to build now
- Write the intended-purpose statement first and align marketing to it; reclassification after launch is the most expensive sentence in digital health.
- Run the two-track map: which features are device-adjacent (2028 track), which are Annex III (Dec 2027), which are transparency-only (Aug 2026). Roadmap accordingly.
- Design the clinician-in-the-loop honestly: oversight that is technically overridable but practically always accepted will be read as automation.
- Treat anonymisation as an engineering deliverable with documented methodology, not an adjective in your privacy notice.
- Contract the liability chain: hospital customers will push malpractice-adjacent risk to you; your model vendor pushes it back; the gap is closed in your contracts or it is yours.
Digital health is one of our named verticals; the intersection of AI & Algorithm Law and KVKK + GDPR work. For the FRIA angle that applies to some deployments, see our FRIA walkthrough.
Sources. Regulation (EU) 2024/1689 (AI Act) and Law No. 6698 on the Protection of Personal Data (KVKK). Statute links open the official consolidated Turkish texts on mevzuat.gov.tr.
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
More from Vircon Insights
The Regulator Will See You Now: How Startups Get Into the AI Act Sandboxes (Deadline Moved to August 2027)
August 25, 2026Article 50 Is Live: The Two-Week Transparency Runbook for AI Products Serving EU Users
August 18, 2026A 12-Month Cap on Off-Exchange Share Sales: Rebuilding the Post-IPO Exit Plan
September 1, 2026Three Ways to Move Up the IPO Queue: Türkiye's New Priority Criteria
September 1, 2026English Is No Longer the Exception on KAP: The Process to Build Before 1 October 2026
August 31, 2026Your Users Are Younger Than Your Terms Say: Children, Age Assurance and AI Products
August 31, 2026Related Practice Areas
Privacy & Cybersecurity
KVKK and GDPR compliance, breach response, cybersecurity governance.
View service →Startup Law
Incorporation, founder agreements, ESOP, term sheets, regulatory matters.
View service →Mergers & Acquisitions
End-to-end M&A: due diligence, structuring, documentation, negotiation.
View service →