Prepare AI/ML-enabled medical devices and other high-risk AI systems for the EU AI Act, from classification to notified body review, and define deployer duties in healthcare.
Applies in stages under Article 113
High-risk obligations for stand-alone use cases
High-risk obligations for AI/ML-enabled MD and IVD
MDR/IVDR and AI Act in a single set of documentation
At MedQAIR, we are well positioned to support organisations developing high-risk AI systems to comply with the European AI Act, or Regulation (EU) 2024/1689.
Involved since the first proposal
First of all, our co-founder and CEO, Leon Doorn, has been involved in shaping the AI Act from its first proposal, through the development of extensive consultation documents for the European Commission, and through standardisation activities in discussion with the European Commission (e.g. in CEN-CENELEC JTC 21).
Built on the New Legislative Framework
Secondly, the AI Act is based on the NLF (New Legislative Framework) and the chosen controls (e.g. technical documentation, risk management, quality management system) strongly align with the medical device and in vitro diagnostic medical device sector. Standards such as EN 18286 (Quality Management) and prEN 18228 (Risk Management) are closely aligned with EN ISO 13485 (Quality Management) and EN ISO 14971 (Risk Management).
Shared documentation
Ultimately, both medical devices and high-risk AI systems require accompanying documentation, such as instructions for use, and a declaration of conformity against the respective regulations.
GDPR and information security
Similarly, we are well aware of the GDPR (EU) 2016/679 requirements and have practical experience in implementing information security management systems, such as ISO/IEC 27001.
The development of the AI Act already started in 2021, when the first draft text was published for open consultation. Through our participation in the NEN working group on AI/ML in healthcare, we provided an extensive consultation document back to the European Commission.
After its further development and the trilogue discussions, the AI Act entered into force on 1 August 2024 and applies in stages under Article 113. Amongst others, due to the delay in standardisation activities (after publication of M/593, later amended by M/613), the Digital Omnibus (Regulation (EU) 2026/1744) was published. The Digital Omnibus delays the dates of application for high-risk AI systems as shown in the table below. In addition, it moved the Machinery Regulation (EU) 2023/1230 from Annex I Section A into Section B. The Digital Omnibus also narrowed the definition of a safety component (Article 3(14)) and allows the Commission to limit, through implementing acts, AI Act requirements that duplicate sectoral legislation such as the MDR and IVDR.
| Date | What applies |
|---|---|
| 2 February 2025 | General provisions, including AI literacy (Article 4, since amended by Regulation (EU) 2026/1744, with the amended text applying from 27 July 2026), and the prohibited AI practices in Article 5 |
| 2 August 2025 | Rules on notified bodies (Chapter III, Section 4), general-purpose AI models (Chapter V), governance (Chapter VII) and penalties (Chapter XII, except Article 101) |
| 2 August 2026 | General application of the Act, including the transparency obligations in Article 50 |
| 2 December 2027 | High-risk requirements and obligations (Chapter III, Sections 1 to 3) for stand-alone systems listed in Annex III |
| 2 August 2028 | High-risk requirements and obligations (Chapter III, Sections 1 to 3) for AI systems covered by Annex I, including AI/ML-enabled medical devices and in vitro diagnostic medical devices |
In addition, for generative AI systems placed on the market before 2 August 2026, the obligation for machine-readable marking under Article 50(2) applies from 2 December 2026.
Initially, the European Parliament amended the Digital Omnibus proposal to move all legislation in Annex I from Section A to Section B. This was not agreed during the trilogue discussions, apart from the Machinery Regulation. As a result, the MDR and IVDR remain in Section A of Annex I, and AI/ML-enabled medical devices remain under the full high-risk regime.
In parallel, the MDR and IVDR are undergoing a simplification process. The Commission’s December 2025 proposal for a targeted revision of the MDR and IVDR (COM(2025) 1023) would move both regulations into Section B, where the high-risk requirements would be implemented through the MDR and IVDR frameworks themselves. This proposal is still in the legislative process.
There are two routes through which an AI system can become high-risk under Article 6. Before looking at these routes, you first need to determine whether the software meets the definition of an AI system under Article 3(1).
Under Article 6(1), an AI system is high-risk when both of the following conditions are met:
Condition 1: the AI system is a safety component of a product, or is itself a product, covered by the legislation listed in Annex I (since Regulation (EU) 2026/1744, AI that only serves non-safety purposes, such as convenience or efficiency, is not a safety component unless its failure would endanger health or safety)
Condition 2: the product must undergo third-party conformity assessment under that legislation
Under Article 6(2), the systems listed in Annex III are high-risk, independent of any product legislation. For healthcare providers, relevant entries include:
The MDR and IVDR are listed as items 11 and 12 in Annex I, Section A. The joint MDCG 2025-6 / AIB 2025-1 FAQ of June 2025 links high-risk status to MDR devices above class I and IVDR devices above class A non-sterile, as these classes require the involvement of a notified body. This means that:
Please note that high-risk status under the AI Act does not change the device class under the MDR or IVDR. Instead, the MDR or IVDR class determines the AI Act status.
Under Article 6(3), a provider may conclude that an Annex III system is not high-risk when it does not pose a significant risk of harm, e.g. because it only performs a narrow procedural task or a preparatory task. However, an Annex III system that performs profiling of natural persons is always high-risk. When relying on Article 6(3), the provider must document this assessment before placing the system on the market (Article 6(4)). The system must still be registered in the EU database (Article 49(2)), although Regulation (EU) 2026/1744 reduced the information required for this registration.
Work down each question. An arrow to the right exits the flow with an outcome.
Software placed on the EU market
Start with the AI system definition
Does it meet the AI system definition?
Article 3(1)
No
Not an AI system
High-risk rules do not apply
Yes
Annex I product needing a notified body?
e.g. MDR class Is/Im/Ir, IIa, IIb, III · IVDR class B, C, D, sterile A
Yes
High-risk
Article 6(1)
No
Does it match an Annex III use case?
e.g. emergency patient triage, health insurance pricing
No
Not high-risk
Article 50 may still apply
Yes
Profiling, or significant risk of harm?
More than a narrow procedural or preparatory task
Yes
High-risk
Article 6(2)
No
Not high-risk under Article 6(3)
Document the assessment (Art. 6(4)) and register (Art. 49(2))
Simplified overview of Article 6. The MDR or IVDR class determines the AI Act status, not the other way around.
| Product | Main product legislation | AI Act position |
|---|---|---|
| SaMD, AI/ML-enabled medical devices (class Im/s/r, IIa and above) | MDR | High-risk through Article 6(1) |
| SaIVD (class B and above, sterile class A) | IVDR | High-risk through Article 6(1) (sterile software would not exist) |
| Class I SaMD or non-sterile class A SaIVD with AI | MDR or IVDR | Not high-risk through Article 6(1); check Annex III and Article 50 (sterile software would not exist) |
| EHR systems with AI functions | EHDS, Regulation (EU) 2025/327 | High-risk only if a function qualifies as a medical device needing a notified body, or falls under Annex III; Article 50 may apply |
| Wellness applications with AI | EHDS (where they claim interoperability with EHR systems) | Same test as EHR systems |
| Other healthcare software, for example hospital maintenance planning tools | CRA, Regulation (EU) 2024/2847 | Usually outside Annex I and Annex III; Article 50 may apply |
The AI Act assigns obligations by role. The provider (Article 3(3)) develops an AI system, or has it developed, and places it on the market or puts it into service under its own name or trademark. For AI/ML-enabled medical devices, this is normally the manufacturer under the MDR or IVDR. The deployer (Article 3(4)) uses the AI system under its own authority, for example, a hospital or clinic. Please note that a user under the MDR or IVDR is not automatically a deployer under the AI Act (MDCG 2025-6 / AIB 2025-1). The high-risk obligations below apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI/ML-enabled medical devices.
Under Article 16, providers of high-risk AI systems must:
Under Article 26, deployers of high-risk AI systems must:
Bodies governed by public law and private entities providing public services, which includes many hospitals, must also perform a fundamental rights impact assessment before deploying an Annex III high-risk AI system (Article 27). This does not apply to AI/ML-enabled medical devices, as these are high-risk through Article 6(1). In addition, AI literacy (Article 4) and the transparency obligations of Article 50 already apply to deployers, independent of the high-risk status.
A deployer, distributor, importer or other third party takes on the provider obligations when it puts its name or trademark on a high-risk AI system, makes a substantial modification to it, or changes its intended purpose so that it becomes high-risk (Article 25). For healthcare organisations, retraining, fine-tuning or repurposing a model therefore needs to be assessed against both Article 25 of the AI Act and Article 16 of the MDR or IVDR.
Also note our contribution to the following (peer-reviewed) scientific publication, written by K. van Leeuwen, L.J. Doorn & E. Gelderblom: The AI Act: responsibilities and obligations for healthcare professionals and organizations
At MedQAIR, we support healthcare organisations in defining their deployer duties, setting up AI governance, and assessing whether internal changes turn them into a provider.
Providers of high-risk AI systems must establish and maintain a documented quality management system (QMS) under Article 17. Medical device manufacturers can integrate the AI Act elements into their existing QMS under the MDR or IVDR (Article 17(3)), so one ISO 13485 based QMS can cover both regulations. As the MDR and IVDR remain in Section A of Annex I, EN 18286 is the reference standard for the AI Act elements of the QMS. This may change if the proposed MDR and IVDR revision moves both regulations to Section B.
Article 17(1) lists 13 elements. Based on our experience, the elements that most often require new or updated procedures in an ISO 13485 system are:
Data management
acquisition, collection, analysis, labelling, storage, filtration, mining, aggregation and retention of data used before and for placing on the market (Article 17(1)(f))
Risk management
a risk management system meeting Article 9, which covers risks to health, safety and fundamental rights
Post-market monitoring
post-market monitoring under Article 72 and serious incident reporting under Article 73
Communication
communication with competent authorities, notified bodies, other operators and customers
Accountability
an accountability framework setting out management and staff responsibilities
The QMS must be proportionate to the size of the provider’s organisation (Article 17(2)). In addition, SMEs, including start-ups, may comply with certain QMS elements in a simplified manner (Article 63, as amended by Regulation (EU) 2026/1744).
EN 18286:2026, Artificial intelligence – Quality management system for EU AI Act regulatory purposes, was approved by CEN and CENELEC on 12 July 2026. It is the first European standard specifically developed for Article 17. Once its reference is published in the Official Journal, the harmonised standard provides a presumption of conformity under Article 40.
ISO/IEC 42001:2023 specifies requirements for an AI management system at organisational level. It is useful for AI governance, but it is not designed to demonstrate conformity with Article 17.
At MedQAIR, we implement and audit management systems covering ISO 13485, EN 18286 and ISO/IEC 42001, and perform internal audits in preparation for notified body audits.
A provider must draw up the technical documentation of a high-risk AI system before it is placed on the market and keep it up to date (Article 11). For AI/ML-enabled medical devices, Article 11(2) requires a single set of technical documentation, which includes both the AI Act information and the content required by Annex II and III of the MDR or IVDR. Article 8(2) further allows manufacturers to integrate the AI Act testing, reporting and documentation into their existing procedures under the MDR or IVDR.
Annex IV defines the minimum content of the technical documentation in 9 sections (SMEs and small mid-cap enterprises may provide this information in the simplified form established by the Commission, which notified bodies must accept):
Most medical device manufacturers will need to add the following aspects to their existing technical documentation:
In addition, a “substantial modification” under the AI Act (Article 3(23)) is a different legal concept than a significant change under the MDR or IVDR, so your change control procedure needs to assess both. Most of these additions also support compliance with the AI/ML questionnaire issued by Team-NB, the association of notified bodies.
AI/ML-enabled medical devices follow the conformity assessment procedure of the MDR or IVDR, where the notified body also assesses the AI Act requirements (Article 43(3)). For this, the notified body must meet the requirements of Article 31(4), (5), (10) and (11). The manufacturer then issues a single EU declaration of conformity covering both regulations (Article 47(3)).
The provider must keep the technical documentation, QMS documentation, notified body decisions and the EU declaration of conformity available to national authorities for 10 years after the system is placed on the market (Article 18).
At MedQAIR, we write and review technical documentation for SaMD, SaIVD and AI/ML-enabled medical devices, and support manufacturers in managing model updates and releases through software lifecycle management under IEC 62304.
A provider established outside the EU must appoint an authorised representative established in the EU, by written mandate, before making a high-risk AI system available on the Union market (Article 22). This obligation applies from 2 December 2027 for Annex III systems and from 2 August 2028 for AI/ML-enabled medical devices.
The mandate must allow the authorised representative to:
The mandate must also allow competent authorities to address the authorised representative in addition to, or instead of, the provider. If the authorised representative considers that the provider is acting contrary to its obligations, it must terminate the mandate and inform the market surveillance authority and, where applicable, the notified body.
Please note that the AI Act appointment is separate from the authorised representative appointment under Article 11 of the MDR or Article 11 of the IVDR. A non-EU manufacturer of an AI/ML-enabled medical device therefore needs both mandates, each covering the tasks set by the respective regulation. In addition, providers of general-purpose AI models established outside the EU already have a separate obligation under Article 54 since 2 August 2025.
At MedQAIR, we act as EU authorised representative for medical devices and in vitro diagnostic medical devices through our Digital AR service, and support authorised representatives and other economic operators in defining and documenting their duties.
We support manufacturers of AI/ML-enabled medical devices, SaMD, SaIVD and other high-risk AI systems throughout the full process, from classification up to the notified body review:
qualification as an AI system, classification under the MDR or IVDR, and determination of the high-risk status under Article 6, as part of our regulatory strategy building
assessment of your current QMS and technical documentation against Articles 9 to 17 and Annex IV
integration of the AI Act procedures into your ISO 13485 QMS, using EN 18286 as reference
drafting a single technical file covering both the MDR or IVDR and the AI Act
internal audits and support in answering notified body questions
With the dates of application for high-risk AI systems now set at 2 December 2027 and 2 August 2028, notified bodies will expect the AI Act requirements to be covered in the technical documentation they review from those dates onwards. We therefore recommend starting the QMS and technical documentation work in time.
The legislation, guidance and standards referenced on this page.
Find answers to common questions about the AI Act for AI/ML-enabled medical devices, SaMD, SaIVD and healthcare organisations.
An AI/ML-enabled medical device is a high-risk AI system when it is a safety component of, or itself, a device that needs notified body involvement under the MDR or IVDR (Article 6(1)). The MDR and IVDR are items 11 and 12 in Annex I, Section A. This covers MDR class Is, Im, Ir, IIa, IIb and III, and IVDR class B, C, D and sterile class A (sterile software would not exist), as set out in the joint MDCG 2025-6 / AIB 2025-1 FAQ. High-risk status under the AI Act does not change the MDR or IVDR class.
The high-risk requirements will apply to AI/ML-enabled medical devices from 2 August 2028 at the earliest. The Digital Omnibus, Regulation (EU) 2026/1744, set this date and moved stand-alone high-risk systems listed in Annex III to 2 December 2027. Some obligations already apply: the prohibited practices in Article 5 and AI literacy (Article 4) since 2 February 2025, and the transparency obligations in Article 50 since 2 August 2026. The staged dates sit in Article 113, as amended.
A self-certified class I SaMD is not high-risk through Article 6(1), because no notified body is involved in its conformity assessment. Class I devices that do need a notified body, such as sterile (Is), measuring (Im) or reusable surgical (Ir) devices, are considered high-risk. The same applies to non-sterile class A SaIVD and to in-house devices of health institutions under Article 5(5) of the MDR or IVDR (sterile software would not exist). Class A IVDs placed on the market in sterile condition do need a notified body and are considered high-risk. The software can still be high-risk if it matches a use case in Annex III, and the transparency obligations of Article 50 can apply regardless of risk status.
No, AI/ML-enabled medical devices need a single set of technical documentation covering both regulations (Article 11(2)). This set combines the Annex II and III content of the MDR or IVDR with the information listed in Annex IV of the AI Act. Article 8(2) also lets manufacturers integrate AI Act testing, reporting and documentation into their existing MDR or IVDR procedures, and the manufacturer issues one EU declaration of conformity (Article 47(3)). The technical documentation must also address other applicable Union law, such as the GDPR. Where the AI system processes personal data, the EU declaration of conformity must state that it complies with Regulation (EU) 2016/679 (Annex V, point 5), and any processing of special categories of personal data for bias detection must meet the conditions of Article 10(5).
Most MDR and IVDR technical files lack parts of the data governance, logging, transparency, human oversight and accuracy requirements in Articles 10 to 15 of the AI Act. Typical gaps are bias examination of training, validation and testing data (Article 10), automatic event logging (Article 12), deployer-facing instructions for use (Article 13), human oversight measures (Article 14) and resilience against AI-specific attacks such as data poisoning (Article 15). MedQAIR runs gap analyses of existing QMS and technical documentation against Articles 9 to 17 and Annex IV.
Yes, medical device manufacturers can integrate the Article 17 QMS elements into their existing MDR or IVDR quality management system (Article 17(3)), so one ISO 13485 system can cover both. EN 18286:2026, approved by CEN and CENELEC on 12 July 2026, is the first European standard written for Article 17. It gives a presumption of conformity once its reference is published in the Official Journal (Article 40). ISO/IEC 42001 supports AI governance and is not designed for Article 17. MedQAIR implements and audits management systems covering all three.
Not under current law: the MDR and IVDR remain in Section A of Annex I, so AI/ML-enabled medical devices stay under the full high-risk regime. The Commission’s December 2025 proposal for a targeted revision of the MDR and IVDR (COM(2025) 1023) would move both regulations to Section B, where the high-risk requirements would be applied through the MDR and IVDR frameworks. In the Digital Omnibus, only the Machinery Regulation moved to Section B. Until the revision is adopted, plan for the full AI Act requirements.
The notified body that assesses the device under the MDR or IVDR also assesses the AI Act requirements (Article 43(3)). To do this, the notified body must meet the requirements of Article 31(4), (5), (10) and (11). The manufacturer then issues a single EU declaration of conformity covering both regulations (Article 47(3)) and keeps the technical documentation, QMS documentation and notified body decisions available to national authorities for 10 years (Article 18).
For most Annex III systems, the provider demonstrates conformity itself through internal control (Annex VI), without a notified body. This applies to the use cases in points 2 to 8 of Annex III, including the healthcare-related systems in point 5, such as emergency patient triage (Article 43(2)). Only biometric systems under point 1 can require a notified body. Where the provider has fully applied harmonised standards or common specifications, it may choose between internal control and an assessment of its quality management system and technical documentation by a notified body (Annex VII). Where it has not, the notified body route is mandatory (Article 43(1)). In all cases, the provider draws up an EU declaration of conformity, affixes the CE marking and registers the system in the EU database before placing it on the market (Articles 47 to 49).
Yes, a provider established outside the EU must appoint an EU-based authorised representative by written mandate before making a high-risk AI system available on the Union market (Article 22). This mandate is separate from the appointment under Article 11 of the MDR or Article 11 of the IVDR, so a non-EU manufacturer of an AI/ML-enabled medical device needs both. For these devices, the AI Act obligation applies from 2 August 2028. MedQAIR acts as MDR and IVDR authorised representative through its Digital AR service.
A hospital that uses a high-risk AI system under its own authority is a deployer and must meet the obligations in Article 26. These include following the instructions for use, assigning human oversight to trained and competent staff, monitoring the system and reporting risks to the provider, and keeping logs for at least six months. Public bodies and private entities providing public services must also perform a fundamental rights impact assessment before deploying an Annex III system (Article 27). A user under the MDR or IVDR is not automatically a deployer under the AI Act. If AI/ML-enabled medical devices are moved from Section A to Section B of Annex I, as proposed in the targeted revision of the MDR and IVDR, the applicability of these deployer obligations may change, as only a limited set of AI Act provisions applies directly to Section B products (Article 2(2)).
Yes, a deployer becomes the provider of a high-risk AI system when it puts its own name or trademark on it, makes a substantial modification, or changes its intended purpose so that the system becomes high-risk (Article 25). Retraining, fine-tuning or repurposing a model can therefore trigger provider obligations. For AI/ML-enabled medical devices, assess the same change against Article 16 of the MDR or IVDR as well. MedQAIR helps healthcare organisations define their deployer duties, set up AI governance and assess whether internal changes make them a provider.
Annex III makes stand-alone AI high-risk in healthcare when it is used for emergency call evaluation, dispatch or emergency patient triage (point 5(d)), risk assessment and pricing in life and health insurance (point 5(c)), public authority assessment of eligibility for healthcare services and benefits (point 5(a)), or staff recruitment and performance evaluation (point 4). Under Article 6(3), a provider may document that such a system is not high-risk when it poses no significant risk of harm, for example because it only performs a narrow procedural or preparatory task. Systems that profile natural persons are always high-risk.
EHR systems and wellness applications with AI functions are high-risk only when a function qualifies as a medical device that needs a notified body, or matches an Annex III use case. Their main product legislation is the European Health Data Space Regulation, Regulation (EU) 2025/327, which covers wellness applications where they claim interoperability with EHR systems. The transparency obligations of Article 50 can apply regardless of high-risk status, for example when patients interact directly with an AI chatbot.
MedQAIR supports manufacturers of AI/ML-enabled medical devices, SaMD, SaIVD and other high-risk AI systems from classification up to notified body review. This covers AI system qualification and high-risk determination as part of our regulatory strategy building, gap analysis, integration of AI Act procedures into an ISO 13485 QMS, a single technical file for the MDR or IVDR and the AI Act, and internal audits. Our co-founder Leon Doorn has contributed to the AI Act since its first proposal, including standardisation work in CEN-CENELEC JTC 21. Book a 30-minute call with our team.
Explore our blog posts on MDR, IVDR, and AI Act compliance to stay ahead of regulatory changes.
Cookies help us improve your experience on our website. By using our site, you consent to the use of cookies as described in this policy.
