AI-based medical devices and in vitro diagnostic medical devices (IVDs) in Europe are generally subject to the requirements of the Medical Device Regulation (MDR), formally Regulation (EU) 2017/745, and In Vitro Diagnostic Regulation (IVDR), formally Regulation (EU) 2017/746. Manufacturers must first determine whether their product qualifies as both a medical device/IVD and an AI system as defined by the AI Act. Depending on the intended purpose, risk class, and integration of the AI system, this may result in additional regulatory requirements.
The AI Act introduces additional obligations for many AI-based medical devices, provided they are classified as high-risk AI systems or trigger other AI Act obligations.
The term “approval” is often used. However, even for AI-based medical devices, neither the MDR/IVDR nor the AI Act refers to approval in the legal sense; rather, it involves demonstrating conformity with the applicable requirements, including the AI Act’s requirements for AI systems, as part of a conformity assessment procedure followed by CE marking.
Medical device manufacturers must therefore specifically expand existing MDR or IVDR processes to include AI-specific requirements. An AI Act compliance project initiated early on helps identify regulatory gaps, define responsibilities, and further develop the technical documentation and quality management system in a timely manner.
Regulatory background
Regulation (EU) 2024/1689 on artificial intelligence, the Artificial Intelligence Act (AI Act), entered into force in 2024 and will be phased in gradually. The relevant dates of application should be checked on a product-by-product basis and integrated into the MDR/IVDR roadmap. Medical device manufacturers must address the requirements of the AI Act if they intend to place an AI system, as defined in Article 3(1) of the AI Act, on the market or put it into service within the EU market.
If the AI system itself is a product or a safety component of an MDR/IVDR product and a third-party conformity assessment procedure is required for it, it is generally considered a high-risk AI system under Article 6(1) of the AI Act.
The essential obligations for providers of high-risk AI systems are summarized in Article 16 of the AI Act. In addition, the requirements of Articles 8 through 15, as well as obligations regarding QMS, documentation, logging, conformity assessment, registration, and post-market activities, must be reviewed. For high-risk AI systems as defined in Annex I of the AI Act, these obligations will be phased in gradually. Medical device manufacturers should therefore assess at an early stage which requirements are relevant to their products and how these can be integrated into existing regulatory processes.
A structured AI Act Compliance project helps ensure the systematic implementation of the new requirements.
Practical steps for a successful AI Act compliance project
Manufacturers of medical devices or IVDs can prepare for the implementation of the AI Act requirements by following these eight basic steps. Some of these steps can also be carried out in parallel.
1. Establish a cross-functional project team
At the outset, an interdisciplinary project team should be established. This team should include representatives from regulatory affairs, quality management, legal, development, clinical evaluation, IT/cybersecurity, data protection, post-market surveillance, and management.
The responsibilities and tasks of project members and external service providers should be clearly defined. The responsibilities of providers, operators, importers, distributors, authorized representatives, and AI/data providers should also be delineated. Additional activities such as time and milestone planning, resource planning, and risk management can be based on proven project management methods.
2. Understanding the AI Act
The next step is to identify and interpret the provisions, terms, and obligations of the AI Act that are relevant to medical devices and IVDs. These include the definition of AI systems, the roles of providers and operators, risk categories, high-risk requirements, General-Purpose AI (GPAI) dependencies, as well as interfaces with the MDR, IVDR, GDPR, cybersecurity law, and, where applicable, other areas of law.
The results should be summarized in an internal policy or guidance document. It is also advisable to create a product-specific decision tree for AI Act classification. This document serves as the basis for further implementation within the company.
3. Classify AI-based medical devices under the AI Act
Based on the intended purpose and technical functionality, the manufacturer should assess to determine whether the medical device contains an AI system or is itself an AI system. It must also be clarified whether the AI system itself is a product, a safety component, or another functional part of the product. The device is then assigned to a risk category under the AI Act. This classification should be documented in a transparent manner and, where necessary, discussed with the competent Notified Body.
Many AI-based medical devices that require the involvement of a Notified Body under the MDR or IVDR - such as MDR Classes IIa through III, and, where applicable, Class I s/m/r, as well as IVDR Classes B through D, and, where applicable, Class A (sterile) - are likely to be high-risk AI systems if they meet the requirements of Article 6(1) of the AI Act.
4. Conduct a gap analysis for technical documentation and the quality management system
The existing technical documentation and the established quality management system should be reviewed against the relevant AI Act requirements. The objective is to identify gaps between the existing regulatory system and the additional requirements of the AI Act.
The obligations for providers of high-risk AI systems include both new requirements and requirements already familiar from the MDR and IVDR. Requirements that are new or AI-specific include those related to data governance, technical documentation, transparency, human oversight, accuracy, robustness, cybersecurity, and logging.
For practical implementation, it is crucial to identify appropriate AI-specific standards, guidelines, and best practices and involve them in your own gap analysis. In doing so, harmonized standards, common specifications, and Commission guidelines should also be monitored on an ongoing basis.
5. Further develop technical documentation and the quality management system
The results of the gap analysis should be translated into concrete measures. This may involve both new processes and the adaptation of existing ones.
The quality management system can be integrated into the already established MDR- or IVDR-compliant system. Additionally, it may be advisable to consider ISO/IEC 42001 as a management system reference in addition to ISO 13485 and ISO 14971.
Technical documentation must also be expanded to include AI-specific content. This includes intended purpose, data governance, training/validation/test data, model development, clinical or performance evaluation, risk management, human oversight, cybersecurity, logging, and post-market monitoring.
The AI Act pursues a “compliance-by-design” approach in several areas. This is particularly important for adaptive models, model updates, and significant product changes. Regulatory requirements should therefore not be tested only at the end of design and development but should be integrated early in the AI system’s design and development process.
6. Conduct internal training
The new or updated processes of the quality management system, as well as the AI-specific content of the technical documentation, must be communicated internally.
In addition, it should be ensured that employees and relevant designated representatives possess sufficient AI competence as defined by the AI Act. This applies to individuals involved in design and development, review, risk management, quality assurance, regulatory affairs, market surveillance, or decision-making processes related to AI systems.
Training programs should be planned, documented, and regularly updated to suit specific target groups.
7. Prepare for and conduct AI Act conformity assessment
For AI-based medical devices and IVDs, the Conformity assessment pursuant to Art. 43(3) of the AI Act is generally conducted as part of the corresponding MDR or IVDR conformity assessment procedures with the involvement of a Notified Body.
It is therefore advisable to engage in a structured dialogue with the Notified Body at an early stage. This dialogue can address the AI-specific further development of the quality management system, additions to the technical documentation, and the planned evidence management. It should be clarified in advance whether the Notified Body’s mandate, competence, and capacity cover the AI Act assessment.
The objective is to integrate the AI Act requirements into the existing conformity assessment in such a way that duplication of effort is avoided and regulatory uncertainties are addressed at an early stage. A consistent EU declaration of conformity, CE marking, and registrations are also required.
8. Monitor regulatory developments concerning the AI Act
The practical implementation of the AI Act is continually taking shape through guidelines, standardization, common specifications, supervisory practices, and sector-specific interpretations. The European Commission may publish guidelines, establish common specifications, and provide additional implementing or interpretive documents.
In addition, European standardization organizations are working on standards designed to support specific requirements of the AI Act. Changes or clarifications to the legal framework are also possible. Monitoring should therefore also cover transition periods, Digital Omnibus amendments, and national jurisdiction regulations.
Medical device manufacturers should therefore establish a continuous regulatory intelligence procedure with documented review and integration with CAPA and change management. New requirements, guidelines, and standards must be reviewed and, if necessary, promptly integrated into the quality management system, technical documentation, and product development.
Our support
The implementation of the AI Act presents medical device manufacturers with complex regulatory and organizational challenges. A structured AI Act compliance project helps to understand the requirements early on, identify gaps, and specifically expand existing MDR or IVDR processes to include AI-specific content. For new (legal) manufacturers or startups, the project should begin before the design freeze and before the Notified Body is involved.
If you need support with classification, gap analysis, QMS/TD expansion, or preparation for the Notified Body, please feel free to contact us. In an initial, no-obligation consultation, we will discuss the scope of a potential project.
