Architecture review

AI SOVEREIGNTY CHECK · MEDTECH & PHARMA

May your AI use case with health data go into production? Know in three weeks.

Health data, data protection impact assessments and, from 2028, the AI Act's high-risk obligations for medical devices: we assess one AI use case against the Swiss FADP, the GDPR and the AI Act, assess every service used in ClearSky and deliver the target architecture. Fixed price CHF 14,500, three weeks.

Request the Sovereignty Checkcontact@dxzio.ch

Who it is for

MedTech manufacturers, pharma companies and healthcare providers in Switzerland and the EU that are piloting or planning an AI use case, such as capturing pharmacovigilance reports, drafting technical documentation or searching quality and study records, and need to know whether it may go into production as it is.

Which rules apply

Health data is sensitive personal data under the Swiss FADP and a special category under the GDPR; high-risk processing requires a data protection impact assessment beforehand. Since 2 February 2025 the AI Act has required AI literacy and transparency. AI that is itself a medical device, or a safety component of one assessed by a notified body, is high-risk; those obligations apply from 2 August 2028.

What you have after three weeks

A classification of your use case under the FADP, the GDPR and the AI Act, with your role as provider or deployer and the touchpoints with the MDR. An assessment of every service and provider used in ClearSky, each finding with severity, owner and status. The technical basis for the data protection impact assessment: data flows, storage locations, access, retention periods and transfers abroad. And a target architecture with an action plan and a fixed price for implementation.

Three weeks, three results

01 /

Week 1: classification

Capture the use case and data flows, clarify roles, determine the AI Act category. On Friday you decide: continue, or stop at half the price.

02 /

Week 2: assessment

Assess services and providers in ClearSky, prepare the basis for the data protection impact assessment.

03 /

Week 3: target picture

Target architecture with data location, human oversight and audit trail, action plan, handover to regulatory affairs and data protection.

Frequently asked questions

Do you need real patient data?

No. We work with descriptions, data flows and documentation of the services used.

Do you determine whether our software is a medical device?

We provide the technical facts for that question. Qualification as a medical device, classification and conformity assessment remain with you and your notified body.

Do you promise that Swissmedic or a notified body will accept the result?

No. We provide the architecture and the evidence your regulatory affairs team can argue with. We do not give legal advice.

What happens after the check?

The action plan states a fixed price for implementation. The price of the check is fully credited if you implement with us.