The regulatory landscape for medical devices is becoming more complex as artificial intelligence becomes part of diagnosis, monitoring, treatment, and clinical decision support. For manufacturers, understanding the EU AI Act medical devices requirements is now essential alongside the existing Medical Device Regulation (MDR).
When is an AI-enabled medical device high-risk?
The first question is whether the AI system is classified as high-risk. Under Article 6(1) of the AI Act, an AI system can be high-risk when it is itself a product, or a safety component of a product, covered by certain EU harmonisation legislation and that product requires a third-party conformity assessment. The MDR and IVDR are included in Annex I, Section A of the current consolidated AI Act text. This means many AI-enabled medical devices that already require Notified Body involvement can fall within the high-risk AI framework.
However, not every AI-enabled medical device automatically becomes a high-risk AI system. The qualification depends on how the AI function relates to the regulated product and whether the relevant third-party conformity assessment conditions are met. Manufacturers therefore need to assess the AI system and the medical device regulatory pathway together.
How the MDR and AI Act work together
The MDR already requires manufacturers to establish and maintain risk management, clinical evaluation, technical documentation, a quality management system, and post-market surveillance. Article 10 sets out these core manufacturer obligations, while Article 52 establishes the relevant conformity assessment procedures.
The AI Act adds requirements specifically focused on AI. These include AI risk management, data and data governance, technical documentation, record-keeping, transparency, human oversight, and appropriate levels of accuracy, robustness, and cybersecurity. Articles 9 to 15 cover these requirements.
Importantly, the two frameworks are not intended to operate as completely separate compliance programmes. Article 8(2) allows relevant testing, reporting, information, and documentation to be integrated into existing procedures under applicable product legislation. Article 43(3) further provides that, for high-risk AI systems covered by Section A of Annex I, the AI Act requirements form part of the relevant product conformity assessment.
MDCG 2025-6, published jointly with the AI Board, further explains this MDR–AI Act relationship. For high-risk medical device AI, the relevant AI Act requirements are assessed within the MDR or IVDR conformity assessment. The guidance also notes that AI Act quality management requirements can be integrated into an existing MDR or IVDR quality management system.
What manufacturers need to prepare
For AI-enabled SaMD, preparation should begin with a clear definition of intended purpose, regulatory qualification, classification, and the role of AI within the device. Manufacturers can then map MDR and AI Act requirements against shared development and quality processes.
Risk management is a good example. The MDR requires a continuous risk management process focused on device safety and performance, while Article 9 of the AI Act extends this to risks affecting health, safety, and fundamental rights across the AI lifecycle.
Data governance is another area requiring attention. The AI Act sets requirements for training, validation, and testing data, including appropriate data governance and management practices. Manufacturers therefore need clear evidence around data provenance, preparation, relevance, quality, and representativeness.
Cybersecurity, human oversight, transparency, and technical documentation should also be addressed early rather than added at the end. Article 15 requires high-risk AI systems to achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle, while Article 14 requires effective human oversight.
For manufacturers, a structured AI medical device regulation consultation can help translate overlapping obligations into one practical compliance strategy. MedQAIR also supports management systems and cybersecurity and privacy for manufacturers working across MDR, AI Act, and related standards.
Start preparing before the deadlines
As of September 2026, the AI Act is generally applicable, but the requirements for high-risk AI systems embedded in regulated products under Article 6(1) and Annex I are scheduled to apply from 2 August 2028.
That transition period should not be treated as a reason to wait. Standards, technical documentation, quality processes, risk management, data governance, and software lifecycle controls all take time to establish and align.
The practical objective is not to create an “AI Act file” alongside an MDR file. It is to build a coherent regulatory system in which AI-specific requirements are traceable within existing medical device quality, risk, software, clinical, and post-market processes.
For AI-enabled SaMD and other AI-based medical technologies, the question is not simply whether the product complies with the MDR or the AI Act. It is how the two frameworks can be implemented together without losing traceability, evidence, or control.
Need support aligning your AI-enabled medical device with the EU MDR and AI Act? Speak with MedQAIR’s AI regulatory experts.
