Introduction
If you are developing an AI-enabled medical device, you do not need to build a second compliance system from scratch. Your MDR or IVDR quality system already covers much of the underlying work: risk management, technical documentation, verification and validation, conformity assessment, and post-market surveillance. But MDR or IVDR conformity does not automatically demonstrate conformity with the EU AI Act. The AI Act adds a separate classification test and requirements that existing medical-device frameworks only cover in part. The biggest gaps usually concern training and validation data, bias, fundamental rights, model behaviour, logging, human oversight, and performance over time. This guide shows you how to identify the requirements that apply, reuse evidence you already have, and focus your gap assessment on the AI-specific work that remains.Source and scope. This guide translates the official text of Regulation (EU) 2024/1689 into a practical overview for medical-device teams. Its legal-status information was checked on 14 July 2026. It is general information, not a substitute for a case-specific regulatory or legal assessment.
How the EU AI Act risk framework works
The AI Act follows a risk-based approach. The more an AI system can affect health, safety, or fundamental rights, the more control and evidence the Act requires. The commonly used labels “unacceptable,” “high,” “limited,” and “minimal” risk are useful shorthand, but they can hide important details. A system outside the high-risk category may still be subject to AI literacy, prohibited-practice, or transparency rules. General-purpose AI models follow a separate obligation path.Current EU AI Act timeline
The AI Act entered into force on 1 August 2024 and applies in phases.1
2 February 2025
Definitions, AI literacy duties, and prohibited AI practices began to apply.
2
2 August 2025
Governance provisions and obligations for providers of general-purpose AI models began to apply.
3
2 August 2026
Most remaining provisions apply under the law currently in force, including the high-risk rules for systems listed in Annex III and the Article 50 transparency requirements.
4
2 August 2027
The high-risk rules for AI systems covered by Article 6(1) apply under the law currently in force. This includes qualifying AI systems embedded in products regulated under the MDR or IVDR.
First identify your role
Your obligations depend on what you do in the AI value chain, not only on the technology you use.Provider
You develop an AI system or have one developed, and you place it on the market or put it into service under your name or trademark. A medical-device manufacturer will often be the provider of AI embedded in its device.
Deployer
You use an AI system under your authority in a professional context. A hospital using an AI-enabled device may be a deployer.
Importer
You are located or established in the EU and place on the market an AI system that bears the name or trademark of an entity established outside the EU.
Distributor
You make an AI system available in the EU supply chain without being the provider or importer.
When is an AI medical device high-risk?
For regulated products, Article 6(1) uses a two-part test. An AI system is high-risk when both conditions are true:- The AI system is itself a product, or a safety component of a product, covered by legislation listed in Annex I of the AI Act. The MDR and IVDR are included.
- The product requires a third-party conformity assessment before it can be placed on the market or put into service.
Not every piece of software used by a medical-device company is automatically a high-risk medical-device AI system. An internal writing assistant, customer-support chatbot, or administrative tool needs its own assessment. It may fall under transparency or other rules without meeting the Article 6(1) high-risk test.
1
Confirm that it is an AI system
Compare the system with the AI Act definition. Do not classify a product from its marketing label alone.
2
Document the intended purpose
State what the system does, who uses it, whose decisions it affects, and whether it performs a medical-device or safety function.
3
Apply the regulated-product test
Determine whether the system is a product or safety component under the MDR or IVDR and whether third-party conformity assessment is required.
4
Check other obligation paths
If Article 6(1) does not apply, check Annex III high-risk use cases, prohibited practices, Article 50 transparency duties, and any general-purpose AI obligations.
5
Record the rationale
Keep the decision, supporting evidence, reviewer, and review date under change control. Reassess it when the intended purpose, model, product, or regulatory guidance changes.
What high-risk AI compliance requires
High-risk AI compliance is not one document. It is a controlled evidence system that covers the full lifecycle.Human oversight must be designed, not assumed
Putting a clinician in the workflow does not automatically meet the human-oversight requirement. The interface, instructions, training, and operating controls must allow that person to:- understand what the output means and where its limits are;
- recognise anomalies or over-reliance;
- intervene before harm occurs;
- disregard, override, or reverse an output when appropriate; and
- stop the system or move to a safe state when necessary.
Data governance goes beyond data quality
Good model performance on one validation dataset is not the same as controlled data governance. For datasets covered by Article 10, document:- where training, validation, and test data came from;
- why the data is relevant to the intended purpose and target population;
- how you identified and addressed missing, imbalanced, or biased data;
- which preprocessing, annotation, and exclusion rules you applied;
- which limitations remain and how you control them; and
- how you will detect material changes in real-world input data.
How existing frameworks help—and where they stop
Standards can reduce duplicated work. Under the law currently in force, none of them replaces the legal classification, role assessment, or conformity obligations in the AI Act. The approved but not-yet-in-force amendment would add a targeted mechanism to reduce overlap. Through delegated acts, the Commission could limit specific requirements in Articles 9–15 and obligations in Articles 17–25 where Annex I sectoral legislation, including the MDR or IVDR, provides equivalent or higher protection. This would not create automatic equivalence: it would apply only after the amendment enters into force and the Commission adopts the relevant delegated act.
The cleanest approach is to map AI Act requirements into your existing quality system. Reuse procedures and records where they genuinely satisfy both frameworks. Add AI-specific evidence where they do not.
A practical EU AI Act compliance plan
1
1. Build one AI inventory
Include AI you develop, buy, embed, rebrand, or use internally. Record the owner, intended purpose, users, model or supplier, affected product, data, market, and lifecycle status.
2
2. Assign your role
Decide whether you are the provider, deployer, importer, distributor, or a combination. Document dependencies on model providers and other suppliers.
3
3. Classify every system
Apply the Article 6 tests, screen prohibited practices, check Article 50 transparency duties, and record the rationale. Do not use a single classification for an entire product portfolio.
4
4. Map requirements to your QMS
Link each applicable AI Act requirement to an existing procedure, record, control, or owner. Mark partial coverage honestly.
5
5. Close the AI-specific gaps
Prioritise dataset governance, bias and affected-group analysis, model documentation, logging, human oversight, AI-specific cybersecurity, and model-change control.
6
6. Define evidence before testing
Set performance metrics, acceptance criteria, subgroup analyses, drift thresholds, oversight tests, and logging requirements before verification and validation begins.
7
7. Integrate the conformity pathway
Align AI evidence with your MDR or IVDR technical documentation and Notified Body plan. Confirm responsibilities and evidence expectations early rather than adding an AI file at the end.
8
8. Monitor changes and real-world performance
Connect model, data, supplier, intended-purpose, and software changes to regulatory reassessment. Feed post-market signals back into risk management, validation, and corrective action.
Conclusion
The product-embedded high-risk date under the law currently in force is 2 August 2027. An approved amendment is expected to move it to 2 August 2028, but you should not plan against the later date until the amendment enters into force. The shortest path is to use the quality system you already have. Start with your MDR or IVDR evidence, map it to the AI Act, and isolate the gaps. Then build AI-specific data, oversight, logging, performance, and monitoring controls into the same lifecycle rather than creating a parallel compliance programme. If you want a second set of eyes on the classification or gap assessment, ask Dovetail to review the regulatory pathway with your team.Main takeaways
Classification comes first
Classification comes first
Your obligations depend on the system’s intended purpose, your role, and the Article 6 classification test. Record the rationale before planning controls.
MDR and IVDR provide a foundation, not automatic AI Act conformity
MDR and IVDR provide a foundation, not automatic AI Act conformity
Reuse your QMS, risk, technical documentation, validation, and post-market processes. Add the AI-specific evidence they do not cover.
Data and lifecycle behaviour are the biggest practical gaps
Data and lifecycle behaviour are the biggest practical gaps
Dataset provenance, representativeness, bias, model versions, logging, drift, human oversight, and real-world performance need explicit controls and evidence.
The later high-risk dates are approved but not yet in force
The later high-risk dates are approved but not yet in force
As of 14 July 2026, the binding product-embedded date remains 2 August 2027. The approved amendment would move it to 2 August 2028 after publication and entry into force. Keep integrating the requirements into development and conformity planning now.
Official sources
- Regulation (EU) 2024/1689 — Artificial Intelligence Act
- Current Article 113 application dates
- Council-approved Digital Omnibus text (PE-CONS 30/1/26 REV 1)
- Draft European Commission guidelines for providers and deployers of high-risk AI systems
- Council final approval of the revised AI Act implementation rules, 29 June 2026
- MDCG 2025-6 FAQ on the interplay between MDR, IVDR, and the AI Act
Frequently asked questions
Does the EU AI Act apply to every medical-device software product?
Does the EU AI Act apply to every medical-device software product?
No. First confirm that the software meets the AI Act definition of an AI system. Then assess its intended purpose, role in the product, conformity pathway, and other possible obligation categories. Software is not high-risk under the AI Act simply because a medical-device company uses it.
Are all AI medical devices high-risk?
Are all AI medical devices high-risk?
Not automatically. Under Article 6(1), the AI must be a regulated product or safety component and the product must require third-party conformity assessment. Systems that do not meet both conditions still need screening for Annex III, prohibited practices, transparency duties, and other applicable rules.
Does MDR or IVDR conformity satisfy the AI Act?
Does MDR or IVDR conformity satisfy the AI Act?
No automatic equivalence applies under the law currently in force. MDR or IVDR conformity gives you substantial reusable evidence, but the AI Act adds its own classification, data governance, transparency, human-oversight, logging, and lifecycle-performance requirements. The approved but not-yet-in-force amendment would let the Commission limit selected AI Act requirements through delegated acts where sectoral law provides equivalent or higher protection. Perform a documented gap assessment unless and until a relevant delegated act applies.
When do high-risk AI rules apply to medical devices?
When do high-risk AI rules apply to medical devices?
Under the law currently in force, the Article 6(1) high-risk rules for qualifying AI embedded in regulated products apply from 2 August 2027. An approved amendment would move this date to 2 August 2028, but as of 14 July 2026 it had not entered into force. Other AI Act obligations already apply or begin earlier, so do not postpone your inventory, literacy, prohibited-practice screening, or transparency work.
Do we need ISO/IEC 42001 certification?
Do we need ISO/IEC 42001 certification?
The AI Act does not make ISO/IEC 42001 certification a universal requirement. The standard can provide a useful governance structure, but certification does not replace the legal requirements or prove that a specific product conforms.
What if our device uses a third-party foundation model?
What if our device uses a third-party foundation model?
Separate the model provider’s obligations from your own. As the manufacturer placing the AI-enabled device on the market, you may still be the provider of the downstream AI system. Define the information, change notifications, performance evidence, security controls, and access rights you need from the supplier.
Where should we start?
Where should we start?
Start with an inventory and classification record. Without those, you cannot reliably determine which controls, evidence, suppliers, deadlines, or owners matter.