Ambient voice technology (a category of tools that use microphones and speech recognition to capture and document clinical consultations in real time) has moved quickly from novelty to near-ubiquity in clinical settings, but the regulatory frameworks governing it have struggled to keep pace. As AI documentation tools become more sophisticated, generating clinical notes that feed directly into patient records and influence downstream care decisions, a critical question has emerged: when does an ambient scribe become a medical device, and what does that classification actually mean for the clinicians using it?

What MDR Class IIa actually means for AI documentation tools

The EU Medical Device Regulation (MDR 2017/745) classifies devices into four risk categories — Class I, Class IIa, Class IIb, and Class III — based on intended use and potential patient risk, not the underlying technology. Class IIa designates medium-risk devices: those where the potential for harm exists but is considered manageable with appropriate controls.

For software, classification is governed primarily by MDR Rule 11, which applies to software intended to provide information used in making decisions with diagnostic or therapeutic purposes. The classification is not determined by whether a product uses AI, voice recognition, or large language models. It is determined by what the product does in a clinical context and what consequences flow from its outputs.

A product that simply transcribes speech and stores text may sit outside the medical device definition. A product that generates structured clinical notes, proposes diagnostic codes, or produces summaries that directly inform care decisions occupies different regulatory ground.

Why ambient scribes are being classified as medical devices

The regulatory logic follows from the Medical Device Regulation's definition of a medical device, which includes software intended for diagnosis, prevention, monitoring, treatment, or alleviation of disease. When an ambient scribe generates a consultation note that a clinician uses to make or communicate clinical decisions, that output arguably meets this definition.

Independent analysis from Hardian Health concludes that clinical summaries and reports produced by large language model (LLM) based tools carry a clear medical purpose under the MDR's intended purpose framework. This analysis draws a parallel with US Food and Drug Administration (FDA) Clinical Decision Support guidance, which applies similar logic to software that influences clinical judgement.

The distinction that matters in practice is between tools that are purely administrative (formatting text, managing appointments, sending reminders) and those with a clinical function. As Tandem Health's regulatory analysis notes, Medical Device Coordination Group (MDCG) 2019-11 guidance on intended use is central here. If the manufacturer's stated or reasonably foreseeable purpose involves clinical decision support, the device definition is likely engaged.

There is an additional regulatory layer to consider. Under the EU AI Act, which began applying high-risk AI obligations from August 2026, Class IIa medical devices requiring Notified Body assessment are automatically classified as high-risk AI systems. This triggers additional requirements around data governance, transparency, human oversight, and post-market monitoring, on top of existing MDR obligations.

What the MDR Class IIa certification process requires from vendors

Achieving Class IIa certification is not a self-declaration exercise. Unlike Class I devices, which manufacturers can self-certify, Class IIa devices require involvement of a Notified Body, an independent third-party organisation accredited by a national authority to assess conformity with MDR requirements.

The obligations a vendor must meet include:

• Clinical evaluation: A systematic review of clinical data demonstrating that the device performs as intended and that residual risks are acceptable relative to clinical benefits

• Quality Management System (QMS): Implementation and maintenance of a QMS compliant with ISO 13485, covering design, development, production, and post-market activities

• Post-market surveillance (PMS): A proactive system for collecting and analysing real-world performance data, including a Post-Market Clinical Follow-Up (PMCF) plan

• Technical documentation: Comprehensive records covering device design, intended purpose, risk management, and clinical evidence

• Incident reporting: Mandatory reporting of serious incidents and field safety corrective actions to the relevant competent authority

For AI-specific tools, post-market surveillance must also address model drift, the gradual degradation of model performance as clinical language, workflows, or patient populations evolve. This is not a standard requirement for conventional software and reflects the additional complexity regulators have recognised in AI-enabled devices.

What certification signals to clinicians about safety and accountability

A CE mark under MDR is not a one-time badge awarded at product launch. It represents an ongoing compliance obligation that requires the vendor to continuously monitor device performance, respond to safety signals, and report incidents to regulators. If evidence emerges that the device is performing below the standard established in its clinical evaluation, the vendor must act, and regulators have enforcement powers if they do not.

For clinicians, this has concrete implications. A Class IIa certified ambient scribe has, by definition:

• Been reviewed by an independent Notified Body against MDR requirements

• Undergone a formal clinical evaluation with documented evidence of safety and performance

• Established a post-market surveillance system capable of detecting problems in real-world use

• Committed to incident reporting obligations that create a regulatory audit trail

As Tandem Health's analysis of CE marking explains, every note and feature must be designed, tested, and monitored to medical-grade standards. This is a materially different standard from productivity software, which carries no equivalent obligation.

The clinical evidence base for ambient scribes continues to develop. A narrative review in Cardiovascular Diagnosis and Therapy found that AI scribes consistently reduce documentation burden and cognitive load, but also report frequent documentation omissions and occasional clinically significant hallucinations (instances where AI generates plausible but factually incorrect content). A prospective pilot study in JMIR Medical Informatics found that 94.7 per cent of AI-generated notes were free from significant errors, but that a small proportion contained errors carrying risk of serious harm if uncorrected, underscoring the continuing importance of clinician review. Regulatory certification does not eliminate these risks. It creates a structured framework for identifying and managing them.

The clinical risk landscape when ambient scribes are not MDR-certified

The regulatory grey area around ambient scribes has practical consequences for clinicians and healthcare organisations. Tools that arguably meet the medical device definition but are not certified as such operate without the clinical evidence requirements, post-market surveillance obligations, or Notified Body oversight that certification entails.

For clinicians, this creates several areas of exposure:

• Liability: If an uncertified tool generates a clinically significant error and a patient is harmed, questions of regulatory compliance, and whether the tool should have been classified as a medical device, are likely to arise in any subsequent investigation

• Absence of clinical evidence: Without a mandatory clinical evaluation, there is no independently verified evidence base for the tool's performance claims

• No post-market safety obligations: Vendors of uncertified tools are not required to monitor real-world performance systematically or report incidents to regulators

Regulatory classification of AI documentation tools remains an evolving area. Not all jurisdictions have resolved how MDR applies to every category of ambient scribe, and some tools operate in genuine grey areas where classification is contested. The EU healthcare AI regulatory overview notes that the interplay between MDR, the EU AI Act, and national competent authority guidance continues to develop, meaning the regulatory picture for specific products may not always be clear-cut.

How MDR Class IIa certification affects procurement and due diligence

For procurement teams and clinical leads evaluating ambient scribing tools, MDR certification status is a concrete and verifiable data point, unlike many vendor claims about accuracy or safety, which are difficult to assess independently.

Key due diligence questions include:

• Does the product hold a CE mark under MDR? This can be verified through the EUDAMED database (the EU's medical device registry), though registration requirements are being phased in and public search functionality may not yet cover all device categories. Request registration details directly from the vendor to confirm their device is registered

• What is the classification, and under which rule? A Class I self-declaration carries significantly less regulatory weight than a Class IIa certification with Notified Body involvement

• Who is the Notified Body? The identity of the reviewing body and its accreditation status are relevant to the rigour of the assessment

• Is there a published or accessible clinical evaluation report? Vendors should be able to provide evidence of the clinical evaluation underpinning their certification, even if the full report is commercially confidential

• What does the post-market surveillance plan cover? Specifically, how does the vendor monitor for model drift and clinical errors in real-world use?

As Tandem's MDR certification announcement notes, Tandem Health argues that certification can reduce governance friction that typically slows AI adoption from pilot to operational deployment. However, while MDR certification addresses regulatory conformity, it does not automatically resolve all procurement, information governance, or local clinical governance requirements that procurement teams must answer.

Class IIa is becoming a broader benchmark for regulated AI across clinical environments, not only for standalone scribing tools. In May 2026, InterSystems IntelliCare became the first AI-native medical record system to achieve MDR Class IIa certification, indicating that this standard is extending across a wider range of clinical AI products.

Data security, GDPR, and MDR: understanding the overlap

MDR certification and General Data Protection Regulation (GDPR) compliance are distinct legal obligations that address different aspects of a clinical AI tool's operation, and neither substitutes for the other.

MDR governs safety and performance as a medical device. GDPR governs how personal data, including health data, which carries special category status, is collected, processed, stored, and protected. A product can be MDR-certified and still fall short of GDPR requirements, or vice versa.

For ambient scribes, the relevant data governance questions include:

• Data residency: Where is patient data processed and stored? EU data residency is a common requirement for NHS and European health system procurement, ensuring data does not leave jurisdictions with equivalent protection standards

• Access controls: Who within the vendor organisation can access patient data, under what conditions, and with what audit trail?

• Security certification: Does the vendor hold ISO 27001 certification, the international standard for information security management?

• Data processing agreements: Is the vendor prepared to enter into a Data Processing Agreement (DPA) that meets GDPR Article 28 requirements?

The EU healthcare AI regulatory overview also notes the European Health Data Space (EHDS) Regulation, which entered into force in March 2025 and introduces additional requirements around health data access and secondary use. This is a further layer of compliance that vendors operating in the EU must address.

Clinicians should expect vendors to demonstrate compliance across MDR, GDPR, and relevant security standards, rather than treating any single certification as sufficient.

What clinicians should expect from a certified ambient scribe in practice

Regulatory certification shapes how a tool should behave in clinical use, not only how it was built. For clinicians, a Class IIa certified ambient scribe should, in practice:

• Be transparent about its limitations: The clinical evaluation underpinning certification should have identified the conditions under which the tool performs well and those where performance is reduced, and this information should be accessible to users

• Support, not replace, clinical review: Evidence consistently shows that AI-generated notes require clinician review. A longitudinal study in NPJ Digital Medicine found that ambient scribes reduced documentation time per consultation, though inaccurate summaries remained a concern, and the vendor's post-market surveillance system should be designed to detect and address these

• Provide an incident reporting mechanism: Clinicians who identify errors or safety concerns should have a clear route to report them to the vendor, who is obligated under MDR to investigate and respond

• Maintain performance over time: The vendor's post-market surveillance obligations mean they cannot simply release a product and move on. Ongoing monitoring for model drift and real-world performance degradation is a regulatory requirement

A randomised crossover trial published in the Journal of the American Medical Informatics Association (JAMIA) comparing two ambient scribe technologies found that both reduced burnout and improved workflow satisfaction, but that performance differences between products were meaningful. Certification sets a floor, not a ceiling, for clinical performance.

Key questions to ask before adopting an ambient scribe

The following questions are designed to support clinicians and clinical leads in evaluating ambient scribing tools before organisational adoption:

Regulatory status

• Is the product CE marked under EU MDR 2017/745?

• What is the device classification, and under which MDR rule was it determined?

• Which Notified Body conducted the conformity assessment, and what is its accreditation status?

• Is the product registered on EUDAMED?

Clinical evidence

• Has the tool undergone a formal clinical evaluation? Can the vendor provide a summary of findings?

• What error types have been identified, and at what frequency? (Omissions, hallucinations, accidental inclusions)

• Has the tool been validated in your specialty or care setting, or only in the context in which it was originally developed?

Post-market obligations

• What post-market surveillance mechanisms are in place?

• How does the vendor monitor for model drift?

• What is the process for clinicians to report errors or safety concerns?

• How are serious incidents reported to regulators?

Data governance

• Where is patient data processed and stored?

• Does the vendor hold ISO 27001 certification?

• Is the vendor prepared to sign a GDPR-compliant Data Processing Agreement?

• How is data used? Is it used to train or improve models, and if so, under what conditions?

Ongoing obligations

• What is the vendor's process for updating the tool following changes to clinical guidelines or coding standards?

• How are clinicians informed of material changes to the product that may affect its performance or intended use?

• What contractual obligations does the vendor accept regarding performance and incident response?

These questions address the areas where regulatory status, clinical evidence, and data governance intersect, and where the gap between certified and uncertified tools is most consequential for clinical practice.

Frequently asked questions

▶ When does an ambient scribe become a medical device under EU MDR?

A tool that simply transcribes speech and stores text may sit outside the medical device definition. But when an ambient scribe generates structured clinical notes, proposes diagnostic codes, or produces summaries that directly inform care decisions, it likely meets the EU Medical Device Regulation's definition of a medical device. The classification is determined by what the product does in a clinical context and what consequences follow from its outputs, not by whether it uses AI or voice recognition.

▶ What does MDR Class IIa certification require from ambient scribe vendors?

Class IIa certification requires involvement of a Notified Body, an independent third-party organisation accredited to assess conformity with EU Medical Device Regulation requirements. Vendors must complete a formal clinical evaluation demonstrating the device performs as intended, implement a Quality Management System compliant with ISO 13485, establish a post-market surveillance system, maintain comprehensive technical documentation, and report serious incidents to the relevant competent authority. For AI tools specifically, post-market surveillance must also address model drift, the gradual degradation of model performance as clinical language, workflows, or patient populations change.

▶ What does a CE mark under MDR actually mean for clinicians using an ambient scribe?

A CE mark under MDR is an ongoing compliance obligation, not a one-time badge. A Class IIa certified ambient scribe has been reviewed by an independent Notified Body, undergone a formal clinical evaluation with documented evidence of safety and performance, established a post-market surveillance system capable of detecting real-world problems, and committed to incident reporting obligations that create a regulatory audit trail. Every note and feature must be designed, tested, and monitored to medical-grade standards, which is a materially different standard from productivity software.

▶ What are the risks of using an ambient scribe that isn't MDR-certified?

Tools that arguably meet the medical device definition but aren't certified operate without the clinical evidence requirements, post-market surveillance obligations, or Notified Body oversight that certification entails. For clinicians, this creates several areas of exposure. If an uncertified tool generates a clinically significant error and a patient is harmed, questions of regulatory compliance are likely to arise in any subsequent investigation. Without a mandatory clinical evaluation, there's no independently verified evidence base for the tool's performance claims. Vendors of uncertified tools are also not required to monitor real-world performance systematically or report incidents to regulators.

▶ How does the EU AI Act interact with MDR Class IIa for ambient scribes?

Under the EU AI Act, which began applying high-risk AI obligations from August 2026, Class IIa medical devices requiring Notified Body assessment are automatically classified as high-risk AI systems. This triggers additional requirements around data governance, transparency, human oversight, and post-market monitoring, on top of existing Medical Device Regulation obligations. The interplay between MDR, the EU AI Act, and national competent authority guidance continues to develop, so the regulatory picture for specific products may not always be clear-cut.

▶ What due diligence questions should procurement teams ask about ambient scribe certification?

Procurement teams should ask whether the product holds a CE mark under EU MDR 2017/745, verifiable through the EUDAMED database or directly with the vendor. It's worth confirming the device classification and which MDR rule determined it, since a Class I self-declaration carries significantly less regulatory weight than a Class IIa certification with Notified Body involvement. Teams should also ask which Notified Body conducted the conformity assessment, whether a clinical evaluation report is accessible, and how the vendor monitors for model drift and clinical errors in real-world use.

▶ Are MDR certification and GDPR compliance the same thing?

No. MDR certification and General Data Protection Regulation compliance are distinct legal obligations that address different aspects of a clinical AI tool's operation, and neither substitutes for the other. MDR governs safety and performance as a medical device. GDPR governs how personal data, including health data, which carries special category status, is collected, processed, stored, and protected. A product can be MDR-certified and still fall short of GDPR requirements, or vice versa. Clinicians should expect vendors to demonstrate compliance across MDR, GDPR, and relevant security standards such as ISO 27001.

▶ What data governance questions should clinicians ask ambient scribe vendors?

Clinicians should ask where patient data is processed and stored, since EU data residency is a common requirement for NHS and European health system procurement. It's worth confirming whether the vendor holds ISO 27001 certification, the international standard for information security management, and whether they'll sign a GDPR-compliant Data Processing Agreement. Clinicians should also ask how data is used, specifically whether it's used to train or improve models, and under what conditions.

▶ Does MDR certification mean an ambient scribe's notes don't need clinician review?

No. Regulatory certification doesn't eliminate the need for clinician review. A prospective pilot study in JMIR Medical Informatics found that 94.7 per cent of AI-generated notes were free from significant errors, but that a small proportion contained errors carrying risk of serious harm if uncorrected. A narrative review in Cardiovascular Diagnosis and Therapy also found that AI scribes report frequent documentation omissions and occasional clinically significant hallucinations, instances where AI generates plausible but factually incorrect content. Certification creates a structured framework for identifying and managing these risks, not removing them.

▶ What should a Class IIa certified ambient scribe look like in clinical practice?

A Class IIa certified ambient scribe should be transparent about its limitations, with the clinical evaluation identifying the conditions under which performance is reduced and making that information accessible to users. It should support, not replace, clinician review of generated notes. It should provide a clear mechanism for clinicians to report errors or safety concerns, since the vendor is obligated under MDR to investigate and respond. The vendor's post-market surveillance obligations also mean ongoing monitoring for model drift and real-world performance degradation is a regulatory requirement, not optional.