EU AI Act and Medical Devices: What Applies When?

Artificial intelligence is found in more and more medical devices: in image analysis, decision support and monitoring systems. Since August 2024, the European Artificial Intelligence Act (AI Act) has applied alongside the MDR. In July 2026, the so-called Digital Omnibus postponed the deadlines for high-risk AI. This article explains when AI in a medical device counts as high-risk AI, which obligations follow, and how the AI Act and MDR can be combined in practice.

The legal basis

• Regulation (EU) 2024/1689 (AI Act), in force since 1 August 2024
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), in force since 27 July 2026, which among other things changed the application dates for high-risk AI
• MDR (EU) 2017/745, which continues to apply to the medical device itself

The Medical Device Coordination Group has also published guidance document MDCG 2025-6 on the interplay between the two regulations.

When is AI in a medical device "high-risk"?

Under Article 6(1) of the AI Act, an AI system is high-risk when both conditions are met:

1. The AI system is itself a product, or a safety component of a product, covered by the Union harmonisation legislation listed in Annex I. The MDR and IVDR are listed there.
2. The product is required to undergo a third-party conformity assessment under that legislation, i.e. with the involvement of a notified body.

This leads to a simple rule of thumb:

MDR class of the device	Notified body	High-risk under Art. 6(1)?
Class I (self-certified)	no	no
Class Is, Im, Ir	for specific aspects	assess case by case
Class IIa, IIb, III	yes	yes

Because software is often at least class IIa under MDR Rule 11 (see MDR classification), a large share of AI-based medical device software falls under the high-risk obligations. The MDR classification therefore indirectly determines the AI Act classification as well.

Deadlines after the Digital Omnibus

What	Original date	After the Omnibus
Prohibited AI practices	2 February 2025	unchanged
Obligations for general-purpose AI models	2 August 2025	unchanged
High-risk AI under Annex III (stand-alone use cases)	2 August 2026	2 December 2027
High-risk AI in Annex I products, including medical devices	2 August 2027	2 August 2028

AI in medical devices therefore has one more year than originally planned. That is no reason to wait: data governance, logging and human oversight are hard to retrofit into an existing product. In addition, the AI literacy obligation under Article 4 already applies. Providers and deployers must take measures to ensure their staff are sufficiently familiar with AI. The Omnibus merely clarified that this does not require guaranteeing a specific level for every individual.

Which obligations apply to high-risk AI?

The requirements are set out in Articles 9 to 15 of the AI Act, supplemented by quality management and post-market monitoring:

• Risk management (Art. 9) throughout the life cycle of the AI system
• Data and data governance (Art. 10): training, validation and test data must be relevant, sufficiently representative and, as far as possible, free of errors; possible biases must be examined
• Technical documentation (Art. 11)
• Record-keeping (Art. 12): automatic logging of events
• Transparency and instructions for use (Art. 13)
• Human oversight (Art. 14): the system must be designed so that people can effectively oversee it and intervene
• Accuracy, robustness and cybersecurity (Art. 15)
• Quality management system (Art. 17) and post-market monitoring (Art. 72)

Medical device manufacturers already know many of these points from the MDR, ISO 13485, ISO 14971 and IEC 62304. What is new, and particularly demanding for software teams, are the requirements on data quality and bias, logging and human oversight.

Combining the AI Act and the MDR

The AI Act is explicitly designed so that manufacturers do not have to build a second, parallel structure:

• One technical documentation: for Annex I products, a single set of technical documentation covers the requirements of both regulations (Art. 11(2)).
• One QMS: the elements of Art. 17 can be integrated into the existing QMS under the MDR or ISO 13485.
• One conformity assessment: the MDR procedure applies. The notified body also assesses the AI Act requirements, provided it is designated for them (Art. 43(3)). The Omnibus introduced a joint application and assessment procedure for notified bodies for this purpose.
• One post-market system: the obligations under Art. 72 can be built into the MDR PMS process.

For planning purposes, this means clarifying early with your notified body whether, and from when, it is also designated under the AI Act.

What software and IT teams should do now

1. Build an inventory: which products or components use AI or machine learning? What is their MDR class?
2. Clarify roles: is your company the provider of the AI system, a deployer, or a supplier of a component?
3. Set up data governance: document the origin, selection, preparation and review of training data in a traceable way, and plan bias analyses.
4. Build logging and human oversight into the architecture rather than adding them later.
5. Extend the QMS: integrate processes for data management, model changes and retraining into development and change control.
6. Think about cybersecurity: Art. 15 requires protection against AI-specific attacks such as poisoned training data. Our article on medical device cybersecurity covers the fundamentals.
7. Ensure AI literacy in the team and document training.

Conclusion

From 2 August 2028, AI in medical devices of class IIa and above is subject to the AI Act's high-risk obligations, in addition to the MDR. The postponement through the Digital Omnibus buys time but does not change the requirements. Integrating AI Act requirements into existing MDR documentation, the QMS and the PMS process avoids duplicated work and gives the notified body a single, coherent body of evidence to assess.

We help classify AI products and integrate the requirements into existing QMS structures. Learn more about our MedTech consulting.