EU AI Act Compliance for MedTech and Medical Device AI
AI-enabled medical devices face a double compliance load: the EU AI Act together with the Medical Device Regulation (MDR 2017/745) or In Vitro Diagnostic Regulation (IVDR 2017/746). Most medical AI falls under Annex I, which extends the core deadline to 2 August 2027, but obligations become unified earlier through the notified-body route.
Take the free 5-minute Risk Classifier, article-grounded scoring against Article 5, 6, Annex III, and Article 50.
Software qualifying as a medical device (SaMD) or embedded in a medical device that is regulated under MDR or IVDR falls into the EU AI Act's Annex I high-risk category under Article 6(1). The effective compliance deadline is 2 August 2027, one year later than the Annex III general deadline.
The central design decision in the Act is to integrate AI Act conformity assessment with existing MDR/IVDR notified-body procedures. Providers already in scope of MDR/IVDR do not go through a separate conformity pathway, instead, notified bodies will be designated to assess AI Act compliance together with the existing medical-device assessment. In practice this means MedTech quality management systems (ISO 13485, MDR Annex IX) must be extended rather than duplicated.
MDR + AI Act: What Actually Changes
For a Class IIa or higher medical device that incorporates AI, the relevant baseline is already strong: post-market surveillance, clinical evaluation, risk management under ISO 14971, and a quality management system under ISO 13485. The AI Act adds:
- AI-specific risk management (Article 9) that must interlock with ISO 14971 rather than replace it.
- Data governance (Article 10) with explicit requirements around training, validation and testing datasets, including representativeness and bias examination.
- Technical documentation (Article 11, Annex IV) mapped to the MDR Annex II technical documentation, overlap is substantial but not total.
- Human oversight (Article 14) designed into the interface, not bolted on at deployment.
- Accuracy, robustness and cybersecurity (Article 15) with specific attention to adversarial robustness and drift.
- Transparency (Article 13) with instructions for use that specify demographic performance variation where relevant.
IVDR for Diagnostic AI
In vitro diagnostic AI, image-analysis software for pathology, diagnostic-prediction models, companion-diagnostic software, follows the IVDR rather than MDR pathway. Risk-class structure is different (Class A to D under IVDR Annex VIII) but the interaction with the AI Act is analogous: notified-body conformity assessment unified with AI Act obligations, Annex I classification, August 2027 deadline.
The biggest operational difference is that many Class C and D IVDR devices are currently in a transition period running until 2027–2028, the AI Act and IVDR transition deadlines must be project-planned together.
The Article 6(2) Route, When Medical AI is Annex III, Not Annex I
A narrow but important carve-out: medical AI that serves an Annex III function (for example, AI used to evaluate worker performance in a hospital setting, or credit-scoring AI offered to patients) can be simultaneously in scope of Annex III with the earlier 2 December 2027 deadline (under the Digital Omnibus (adopted by Parliament 16 June 2026, Council adoption 29 June 2026; moved from 2 August 2026). Annex I embedded high-risk applies from 2 August 2028 (moved from 2 August 2027). The Annex I/Annex III classification is determined by function, not by the product family.
Care also applies to health-AI systems that are not themselves medical devices under MDR/IVDR, wellness apps, administrative triage tools, consumer diagnostics below the MDR qualification threshold. These may still fall under Annex III Point 5 (essential services, emergency dispatch) or other Annex III points.
What to Do Before 2 December 2027
Concrete actions for MedTech compliance teams under the post-Omnibus phased timeline.
Identify the AI Act classification
Annex I (embedded in MDR/IVDR device) vs Annex III (function-specific). Many MedTech SaaS vendors discover both apply.
Map AI Act obligations to existing QMS
Start from ISO 13485 / MDR Annex IX. Gap-analyse Articles 9, 10, 11, 13, 14, 15 against current procedures.
Engage notified body early
Notified bodies designated for AI Act conformity assessment under MDR/IVDR are limited. Slot scheduling is the binding constraint for 2027 readiness.
Extend risk management
ISO 14971 covers clinical risk. Extend explicitly to AI-specific failure modes: drift, distribution shift, adversarial inputs, algorithmic bias.
Build data governance documentation
Article 10 requires articulated data provenance, representativeness, and bias examination for training, validation, and test datasets.
Plan post-market monitoring
Article 72 post-market monitoring interlocks with MDR Article 83 post-market surveillance. Single workflow, dual documentation.
Register in the EU database
Annex I systems register under the conformity-assessment route, distinct from the Annex III public database but legally related.
Built for MedTech Compliance Teams
The Full Readiness Bundle gives you 11 documents covering the full Annex III obligation set, including the exact templates MedTech compliance teams need to operationalise the Regulation.
one-time · instant download
Get the Full Bundle →Also available: Checklist Pack $149 · White-Label $999/yr