Regulatory Landscape for Medical AI: FDA, CE Marking, and Ukrainian MHSU

Article #6 in Medical ML for Ukrainian Doctors Series

By Oleh Ivchenko | Researcher, ONPU | Stabilarity Hub | February 8, 2026

Context: Why Regulatory Understanding Matters

For ScanLab and any medical AI initiative targeting Ukrainian healthcare, regulatory compliance isn’t optional—it’s existential. Understanding the regulatory landscape determines:

• Market access: Which markets can you legally enter?
• Development priorities: What documentation and validation is required from day one?
• Timeline and cost: Regulatory pathways vary from weeks to years and from thousands to millions in investment
• Trust building: Physician adoption correlates strongly with regulatory approval status

As we noted in Article #5 on data requirements, medical AI development must build regulatory-ready documentation from the start. This article maps the three key regulatory environments relevant to Ukrainian medical AI developers.

1. United States: FDA Framework for AI/ML Medical Devices

The Regulatory Structure

The U.S. Food and Drug Administration (FDA) has been regulating medical devices since 1976 and has emerged as the global leader in AI-specific medical device regulation. The FDA defines Software as a Medical Device (SaMD) as software intended for medical purposes that performs without being part of a hardware device.

Classification and Pathways

The FDA employs a risk-based classification system:

The 2024-2025 AI/ML Action Plan

In December 2024, the FDA finalized groundbreaking guidance introducing the Total Product Life Cycle (TPLC) approach specifically designed for AI/ML devices:

Predetermined Change Control Plans (PCCP)

• Manufacturers can pre-specify allowed modifications to AI algorithms
• Updates within the approved PCCP scope don’t require re-approval
• Addresses the fundamental tension between AI’s adaptive nature and regulatory requirements for “locked” algorithms

Good Machine Learning Practice (GMLP) – 10 Principles

1. Representative and unbiased training datasets
2. Robust cybersecurity practices
3. Transparent communication with end-users about algorithm updates
4. Documented data management and retraining protocols

Transparency Gaps

Despite progress, studies reveal significant transparency issues:

Key FDA Definitions

2. European Union: MDR and AI Act Double Regulation

The Regulatory Duality Challenge

European medical AI developers face a unique challenge: compliance with two overlapping regulatory frameworks:

1. Medical Device Regulation (EU MDR 2017/745) – sector-specific medical device law
2. EU AI Act (Regulation 2024/1689) – horizontal AI legislation

“Companies risk being caught between overlapping regulatory frameworks.” — MedTech Europe

EU AI Act Risk Classification

“`mermaid
graph TD
A[AI System Assessment] –> B{Medical Device?}
B –>|Yes – Requires Notified Body| C[HIGH-RISK AI]
B –>|No| D{General Purpose?}
D –>|Yes| E[GPAI Requirements]
D –>|No| F{Manipulation Risk?}
F –>|Yes| G[PROHIBITED AI]
F –>|No| H[LOW-RISK AI]

C –> I[Full Compliance Obligations]
G –> J[Banned Outright]
E –> K[Transparency Requirements]
H –> L[Minimal Obligations]

style C fill:#dc3545,color:#fff
style G fill:#000,color:#fff
style E fill:#ffc107,color:#000
style H fill:#28a745,color:#fff
“`

Compliance Timeline

“`mermaid
timeline
title EU AI Act Compliance Milestones
May 2025 : General-purpose AI obligations apply
August 2025 : Prohibited AI practices enforced
August 2026 : High-risk AI obligations (most systems)
August 2027 : Full obligations for medical devices under MDR/IVDR
“`

High-Risk AI Requirements (Beyond MDR)

1. Risk Management System (Art. 9): AI-specific risk assessment aligned with MDR
2. Data Governance (Art. 10): Requirements for training, validation, and testing datasets including:
   • Assessment of data availability, quantity, and suitability
   • Bias examination for health and safety impacts
   • Consideration of geographic, contextual, and demographic settings
3. Technical Documentation (Art. 11): Comprehensive documentation of design, training, and validation
4. Transparency (Art. 13): Clear disclosure of accuracy levels and limitations
5. Human Oversight (Art. 14): Ensuring appropriate human control over AI outputs
6. Quality Management System (Art. 17): AI QMS integrating with ISO 13485

CE Marking Pathway

“`mermaid
graph TD
A[1. Classification
MDR Annex VIII] –> B[2. Technical Documentation
B –> C[3. Quality Management System
C –> D[4. Conformity Assessment
D –> E[5. EU Declaration of Conformity]
E –> F[6. CE Mark Affixation]
“`

3. Ukraine: MHSU and EU Integration Path

Current Regulatory Framework

• Ministry of Health of Ukraine (MHSU/MOH): Central executive body for technical regulation
• State Service of Ukraine on Medicines and Drugs Control (SSMD): Market supervision authority
• Technical Regulations: Based on Decrees No. 753, 754, 755 (October 2013)

2025 Reform: State Regulatory Authority (SRA)

A major reform announced in 2025 establishes the State Regulatory Authority (SRA)—a single regulator that will:

• Grant market access for medicines, medical devices, substances of human origin, and cosmetics
• Replace the current fragmented regulatory structure
• Align more closely with EU institutional practices

Medical Device Classification in Ukraine

EC Certificate Recognition (Simplified Pathway)

Ukraine offers a simplified pathway for devices already CE-marked in the EU:

• EC Certificate from EU notified body with mutual recognition agreement
• Authorized representative in Ukraine (minimum 5-year commitment)
• Ukrainian language labeling and instructions for use
• Declaration of conformity for Ukrainian market

AI-Specific Considerations

4. Comparative Analysis

Pathway Comparison

Market Access Strategy for Ukrainian Developers

“`mermaid
graph LR
A1[ISO 13485 QMS] –> A2[MDR Documentation]
A2 –> A3[AI Act Annex IV]
A3 –> A4[GMLP Compliance]
B1[Notified Body Selection] –> B2[Conformity Assessment]
B2 –> B3[EU Market Entry]
C1[Authorized Representative] –> C2[EC Certificate Recognition]
“`

5. Practical Implications for ScanLab

Immediate Actions

1. Establish ISO 13485 QMS: Foundation for all regulatory pathways
2. Document AI development per GMLP: Training data, validation, testing—all from project inception
3. Design for transparency: Build explainability features that satisfy both clinical and regulatory needs
4. Plan for adaptive algorithms: Implement change control processes compatible with FDA PCCP concept

Documentation Requirements Matrix

Regulatory Timeline Considerations for ScanLab

6. Open Questions for Future Research

1. How will Ukraine’s planned SRA handle AI-specific medical device requirements?
2. What will be the timeline for Ukrainian MDR harmonization?
3. How are notified bodies preparing for joint MDR/AI Act assessments?
4. What predicate devices exist for AI-based X-ray analysis under FDA 510(k)?
5. How should developers handle the gap between AI Act requirements and current Ukrainian regulation?

Key Insights Summary

Questions Answered

✅ How do FDA, EU, and Ukrainian frameworks differ?

FDA leads in AI-specific guidance with TPLC/PCCP; EU creates dual regulatory burden with MDR + AI Act; Ukraine relies on older Directive-based rules with EC recognition pathway.

✅ What are market authorization pathways?

FDA: 510(k)/De Novo/PMA; EU: CE marking via notified body; Ukraine: Direct assessment or EC Certificate recognition.

✅ How can Ukrainian developers prepare for international access?

Develop to EU AI Act + MDR standards; this documentation base supports all three markets with minimal adaptation.

Next in Series: Article #7 – US Experience: FDA-Approved AI Devices

Series: Medical ML for Ukrainian Doctors | Stabilarity Hub Research Initiative

Author: Oleh Ivchenko | ONPU Researcher | Stabilarity Hub