AI consultant in Leiden

According to the Rijksoverheid, software is a medical device if its maker intends it for medical use, such as making a prognosis or predicting a disease. The EU Medical Device Regulation (MDR) then applies. According to the Inspectie Gezondheidszorg en Jeugd, it also sets requirements for healthcare organisations that make their own devices.

Your regulatory or legal department determines whether this applies to your model. During development and management, we document what they can use as evidence.

If a notified body must assess the device, the AI system is also classified as high-risk under European guidance MDCG 2025-6. According to that guidance, this does not apply to a device that a healthcare organisation makes solely for its own use. Following the AI Omnibus, those requirements will apply to AI in such regulated products from 2 August 2028.

The legal interpretation is for your lawyer or compliance department. We help you identify your AI systems, prepare their risk classification and set up governance. You can read more about this under the AI Act.

According to the Autoriteit Persoonsgegevens, processing health data is prohibited unless an exception under the GDPR applies. In healthcare, the legal basis is usually set out in law, such as the WGBO. If the law provides no legal basis, the Autoriteit Persoonsgegevens identifies explicit consent as one possibility, for example in scientific research.

Using data from a study for another purpose constitutes a new purpose. Your data protection officer assesses whether that is permitted. We set up the data flows accordingly and keep research and healthcare data separate where necessary.

Yes. The LUMC project runs on on-premise, sovereign infrastructure, with the aim of keeping control of data and models with the hospital. In the cloud, we build on Databricks or Microsoft Fabric.

That choice is also a privacy question. The Autoriteit Persoonsgegevens states that an organisation processing health data in the cloud remains fully responsible for it. The right option depends on the data, the integrations and who manages the system.

If the electronic health record (EPD) supports it, you can retrieve its data via FHIR, an HL7 standard for the electronic exchange of healthcare information. Medical images and their associated data come from the PACS, the medical image archive, via DICOM, the international standard for this.

The result should appear where the healthcare professional already works: in the EPD or in the PACS viewer. That is why we discuss the integration with the first department from the outset, rather than waiting until go-live.

Set this out before the model goes live: who owns it, who intervenes if the input changes and who approves an updated model for release. Your own team can take over, or we can handle it through management and continuous improvement. For how the technology works, read about MLOps.

If the model comes from a collaboration, such as a Medical Delta programme in which LUMC and Universiteit Leiden work with TU Delft and Erasmus MC, among others, also agree which partner will be responsible for its management.

Leiden Bio Science Park identifies AI and data science as a theme spanning all its focus areas, from early diagnosis to vaccines. If a model comes from R&D rather than a clinical setting, the questions remain the same: is it reproducible, where does it run, who manages it and which rules apply?

We do not have a case study of our own at Bio Science Park; our references are in hospitals and pharmacies. For Nederlandse Farmaceutische Zorggroep, we built a virtual assistant using information from contracts with health insurers. “The NFZ Virtual Assistant has significantly improved our customers’ workflow.” Alberto Fernandez, Project Pharmacist - NFZ

When the department has not asked for it, an existing product does the same thing, or the model has only been tested on a small, outdated dataset. In those cases, buying a product, validating the model first or stopping is more sensible than building.

If you are unsure whether the problem lies with the data, processes or organisation, start with a data maturity assessment. At Albert Schweitzer Ziekenhuis, such an assessment mapped where the hospital stood, from culture and processes to technology and governance.