Getting under the skin of medical devices and the law

Article by Adam Green, freelance journalist.

As people live longer, more of us are living with chronic illness. An ageing population means growing numbers managing conditions such as cancer, diabetes and kidney disease. This rise is not confined to the elderly. By 2040, 9.1 million people in England are projected to be living with a major illness, 2.5 million more than in 2019. Rates of Type 2 diabetes and hypertension are also increasing among younger people.

Medical technology is responding to this growing burden of chronic disease with digital tools that monitor vital signals like blood glucose levels. Modern med-tech is culminating in what Professor Muireann Quigley, Professor of Law, Medicine and Technology at the University of Birmingham, calls integrated goods – devices so intimately connected to our bodies that they blur the line between human and machine, transforming us into 'everyday cyborgs'. ­

They include conventional devices like pacemakers and artificial limbs and emerging applications, from smart-e-pants that deliver electrical stimulation to prevent bed sores to biosensitive tattoo ink that change colour when athletes become dehydrated. Such gadgets interact with the human body dynamically, generating troves of intimate, personal data with implications for legal questions like identity, autonomy and control.

Professor Quigley is leading the Everyday Cyborgs 2.0 initiative, a five-year project funded by the Wellcome Trust. The multidisciplinary initiative, which convenes experts across law, medicine and ethics, is revealing how medical device innovation, from glucose monitors to hearing devices and prosthetics, tests the limits of our existing frameworks. The team has already helped inform government policy at the intersection of humans and medical devices, and is now looking to support more ambitious legal modernisation.

Whose property, whose data?

Governments are now revisiting rules and regulations to adapt to the kinds of risks that medical technology could bring. The UK government has begun a phased overhaul of the medical devices regulations and championed the benefits of them for both patients and economic growth. Yet existing legal frameworks are not yet equipped to address some of the challenges emerging from the joining of people and increasingly complex technologies.

“Medical devices like pacemakers are unequivocally pieces of property when they're manufactured or sold to the NHS, but whose property are they once implanted into or attached to patients – the NHS’s or the patient’s?” Professor Quigley asks. “Answers to this are not clear because there is a hybridity here – of person and thing – that the law doesn’t yet adequately take account of and confounds our traditional legal categorisations. We have to start conceptualising these things in a different way because it’s not just about the device or the person.”

Another example Professor Quigley points to is the issue of data collected by these devices that manufacturers end up storing and controlling, in ways that the person from whom the data has come from maybe doesn't want. For instance, some people living with diabetes want greater control of their data in order to use open-source solutions to manage their condition. One of these, NightScout, was created by people with diabetes and parents of children living with diabetes as an open-source cloud application to visualise, store and share continuous glucose monitor (CGM) data in real time. “It exists because the commercial ecosystem failed to provide adequate tools,” says Professor Quigley. “Similarly, members of the diabetes community created open-source software which connects a user’s CGM and insulin pump, semi-automating insulin delivery and thereby reducing the burden of managing their diabetes.”

Yet, innovators within the community cannot freely or easily access the data needed to develop open-source diabetes management solutions without having to painstakingly reverse engineer their diabetes devices. This is because manufacturers restrict the movement of device data, often citing cybersecurity concerns. “Thus, the tension between protecting proprietary systems and enabling device user autonomy creates real barriers to effective condition management,” says Professor Quigley.

Even though commercial hybrid closed-loop technologies, which link CGMs with insulin pumps, are now accessible on the NHS, certain restrictions mean they are not yet available to all who would benefit. Each area in the UK has its own local policy, making access nationally uneven. This, alongside the greater customisability of the open-source systems, means that some with diabetes prefer to continue to use the community-led technologies.

Who's responsible, who's liable?

Questions of rights and control are deeper than data, however. Traditional property law insists that only things separate from persons can be property. But a pacemaker isn't separate – it's under the skin, functioning from the inside. “In some cases, without this medical device, there would be no subject, because it is helping keep the person alive,” Professor Quigley notes, “but overall, this challenges the very doctrinal foundations of law.” The distinction between person and property, fundamental to centuries of legal thinking, begins to dissolve.

If the pacemaker malfunctions, is this a property law issue or personal injury? If you modify your insulin pump's software, are you tampering with someone else's intellectual property or exercising control over your own body? These questions can determine who bears liability when things go wrong, who can authorise repairs, and ultimately who controls life-sustaining technology.

Responsibility and accountability become murky when multiple parties – patient, manufacturer, healthcare provider – all interact with the same integrated system. Yet restricting patient control to avoid liability questions creates its own problems, leaving people unable to fully manage conditions affecting their own bodies.

A common law approach to reform

Modernising the law requires both rigorous doctrinal analysis and imaginative reform. Professor Quigley's Everyday Cyborgs 2.0 initiative brings together legal scholars, medical professionals and ethicists. “The core problem that animated the project was looking at how advancing medical devices challenge how the law conceptualises and deals with related issues,” she explains.

The team undertook extensive doctrinal work assessing existing law, conducting empirical interviews with clinicians, device users, and others, and engaging with the latest legislative developments. They critically analysed the creation of what became the Medicines and Medical Devices Act 2021, working with House of Lords peers to draft amendments, some of which were incorporated into the final Act. This direct engagement demonstrates how academic research can influence policy development in real time.

Yet reform faces an obstacle: the perceived rigidity of 'black letter law', which refers to well-established doctrines and fixed legal rules from statutes or case law. “Sometimes people think in very narrow ways on this topic,” Professor Quigley observes. This inhibits the conceptual flexibility needed to address genuinely novel situations.

Nevertheless, the common law system itself offers a model for flexible interpretation that can adapt to changing circumstances. “One of the markers of the common law system is that it evolves,” Professor Quigley notes. “It just takes an imaginative judge to finesse the previous case law principles or to apply them to a new situation at the right level within the courts, and then the law can improve.”

Groups are also converging to produce frameworks and principles to inform decisions. The Diabetes Data Rights Charter, for example, launching later in 2026, will provide guidance to stakeholders and researchers on enabling safe and secure data control for people with diabetes. The charter responds to a fundamental problem: people with diabetes neither have full access to, nor have control over, the data generated, collected, and analysed by their devices, despite the centrality of that data for diabetes care and long-term outcomes. This initiative represents a practical step to clarifying ambiguous relationships.

As medical devices become both more sophisticated and prevalent, the legal questions they raise will intensify. The challenge is ensuring the law evolves to protect people's autonomy, dignity, and practical control over the technologies keeping them alive. Without reform, the gap between technological capability and legal protection will only widen, leaving patients increasingly vulnerable in the face of devices they cannot fully control.