The EU Medical Device Regulation (MDR) is the legal framework that can classify software as a medical device when its intended purpose is medical, such as diagnosis, prevention, monitoring, prediction, prognosis, treatment, or clinical decision support. The key test is not what topic the software discusses, but what the provider says it is for and how it is designed, marketed, or deployed.
In cyber security, MDR matters because regulated medical software must meet stronger expectations for safety, quality, and post-market oversight. That usually includes secure development, vulnerability handling, access control, update management, and evidence that the system behaves reliably under attack or misuse. In real environments, a general chatbot may fall outside MDR, yet still process sensitive health data or be connected to clinical workflows. If an attacker can alter outputs, inject prompts, or steal stored records, the result can be both a privacy breach and a patient-safety risk. Correct MDR classification helps defenders decide when a system needs medical-grade governance rather than ordinary IT controls.