When does the AI Act apply to medical device software?
Written by: Manuel Mateos CEO and Regulatory Affairs Director, CMC Medical Devices & Drugs S.L.
The AI Act applies to software intended to fulfil a medical purpose, when it qualifies as an AI system and is part of a medical device or IVD subject to MDR or IVDR. Only those requiring a conformity assessment involving a notified body are considered high-risk systems under the AI Act.
For full details, you can consult the official MDCG 2025-6 guidance on the interplay between MDR/IVDR and the AI Act.
Understanding what counts as MDAI
Medical Device Artificial Intelligence (MDAI) refers to AI systems used in medical devices or IVDs. To fall under the AI Act, a software must meet two conditions: it must qualify as a medical device (under MDR or IVDR) and as an AI system (as defined by Article 3 of the AI Act).
AI systems are machine-based and designed to operate with varying levels of autonomy. They use input data to generate outputs (such as predictions, recommendations or decisions) that influence physical or digital environments. This includes diagnostic tools, imaging software, or decision-support systems.
When is an MDAI considered high-risk?
Not all MDAI are classified as high-risk under the AI Act.
Only those that are part of medical devices or IVDs requiring a conformity assessment with the involvement of a notified body are considered high-risk systems. This includes:
- MDR class IIa, IIb, and III devices
- IVDR class B, C, and D devices
MDR class I and IVDR class A devices, which follow self-declaration procedures, are not considered high-risk under the AI Act, unless they are included under other high-risk categories listed in Annex III.
Do MDR/IVDR classifications change under the AI Act?
No. The AI Act does not affect how a product is classified under MDR or IVDR. Instead, it introduces a new layer of classification for AI systems. Manufacturers must evaluate both regulatory frameworks and align their documentation accordingly.
How do the MDR, IVDR and AI Act interact?
The AI Act does not replace the MDR or IVDR, but complements them.
It adds specific requirements for high-risk AI systems, with the goal of improving their safety, reliability and transparency throughout the entire lifecycle. In particular, the AI Act introduces additional obligations in areas already covered by MDR and IVDR, such as:
- Lifecycle management, with an emphasis on performance after placing on the market
- Quality management systems that incorporate both MDR/IVDR and AI Act requirements
- Risk analysis tailored to AI-specific risks, such as data bias or unexpected software behaviour
- Transparency and human oversight, ensuring operators can understand and manage the system’s outputs
- Accuracy, robustness and cybersecurity, especially in real-world conditions and over time
These obligations must be incorporated into the existing compliance framework through targeted updates to the technical documentation, risk files and quality systems. The objective is to build a harmonised and consistent approach to regulatory compliance under both MDR/IVDR and the AI Act.
What happens after 2 August 2027?
This date marks the full application of the AI Act. If a medical device or IVD is placed on the market or put into service on or after 2 August 2027, the AI Act applies fully, including its requirements for high-risk systems.
If the device was placed on the market before that date, the AI Act only applies in case of significant changes to the AI system’s design made after 2 August 2027. Changes made before that date do not trigger AI Act obligations.
What should manufacturers do now?
Although some obligations apply later, the transition period is already underway.
Manufacturers should begin evaluating their portfolios, identifying which products include AI systems and whether those qualify as high-risk. A practical next step is to carry out a gap analysis to map current MDR or IVDR documentation against the new requirements introduced by the AI Act.
Areas that deserve particular attention include:
- Quality management and risk procedures
- Bias detection and mitigation strategies
- Transparency and human oversight controls
- Validation and performance testing documentation
- Post-market monitoring and traceability
Integrating these elements early will reduce regulatory friction later and help manufacturers maintain market access in the long term.
In summary
The AI Act applies from 2 August 2027 to medical devices and IVDs with high-risk AI systems. Only devices involving notified body assessments fall under this category.
The AI Act does not affect MDR or IVDR classifications, but it adds new obligations. Early planning is key to ensure a smooth transition and avoid compliance delays.
Need support?
The European regulatory landscape is constantly evolving. If you manufacture medical devices or IVDs and want to stay aligned with the latest requirements, get in touch. Our team constantly monitors updates and helps you navigate both obligations and opportunities.
