The AI Act and Medical Devices

The AI Act and Medical Devices after the Digital Omnibus

10/19/20265 min read

The AI Act and Medical Devices after the Digital Omnibus

Manufacturers of AI-enabled medical devices have been given one more year. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026. It moves the AI Act's high-risk obligations for medical devices and IVDs from 2 August 2027 to 2 August 2028.

That is a reprieve, but not an exemption. The MDR and IVDR stay fully within the AI Act. Below is what changed, who it affects and how to use the extra time.

What changed

  • New dates. High-risk requirements for AI systems (Article 6(1) and Annex I), which covers medical devices and IVDs, now apply from 2 August 2028. AI systems classified as high-risk under Article 6(2) and Annex III follow from 2 December 2027.

  • MDR and IVDR stay in Annex I, Section A. The Omnibus did not move them. A move to Section B, largely outside the AI Act's high-risk requirements, is part of the separate MDR/IVDR revision proposal of December 2025, which is still under negotiation.

  • A clarified safety-component boundary. Article 3(14) covers both components with a safety function and components whose failure or malfunction could endanger the health and safety of people or property. AI used solely for non-safety aspects such as user assistance or performance optimisation is not a safety component. AI whose failure or malfunction would endanger health and safety is. This matters mainly for AI embedded in hardware, if the AI software is itself the medical device, the question does not arise.

  • An equivalence mechanism. By 2 August 2027, the Commission must adopt delegated acts that may limit specific AI Act requirements where Section A legislation already provides an equivalent or higher level of protection. Any limitation will depend on the delegated acts adopted under Article 2(13). Manufacturers should not assume that MDR/IVDR compliance automatically replaces the relevant AI Act requirements.

  • Notified bodies. Notified bodies assessing high-risk AI systems through the sectoral conformity-assessment route shall apply for AI Act designation by 28 January 2028. This is an application deadline.

  • SME measures. These are separate provisions. SMEs, including start-ups, and small mid-caps may provide technical documentation in a simplified manner. QMS obligations are proportionate to the size of the provider's organisation. SMEs without partner or linked enterprises may comply with certain QMS elements in a simplified manner.

Who it affects

A clarified safety-component boundary. An AI system may qualify as a safety component if it performs a safety function or if its failure or malfunction would endanger health and safety. AI used solely for non-safety functions is excluded from this category. This distinction applies to both hardware-based and software-based products. Where the AI system is itself a medical device, there is no need to establish separately that it is a safety component.

When is medical-device AI high-risk? Under Article 6(1), two conditions must both be met:

  1. Product condition: The AI system is itself a medical device or IVD or it is a safety component of a product covered by the legislation listed in Annex I.

  2. Conformity-assessment condition: That product is required to undergo third-party conformity assessment under the applicable product legislation, such as the MDR or IVDR.

Meeting both conditions makes the AI system high-risk. AI systems may also be classified as high-risk separately under Article 6(2) and Annex III.

Device class alone does not determine AI Act high-risk status. The AI Act does not change a device's MDR or IVDR class.

Whether a software is an AI system under Article 3(1) is a separate, case-by-case question. It should be assessed against the definition and record the reasoning in the existing QMS and technical documentation.

What has not changed

  • The MDR and IVDR apply in full today. The postponement concerns only the AI Act's high-risk requirements.

  • Some AI Act obligations already apply. Prohibited practices and AI literacy have applied since 2 February 2025. The Omnibus softened Article 4: providers and deployers must now "take measures to support the development of AI literacy", taking into account people's technical knowledge, experience, education and training and the context of use. It does not require any specific level of AI literacy or prescribe a particular form of training. The transparency obligations, for example telling patients they are interacting with a chatbot, have generally applied since 2 August 2026.

  • The MDR/IVDR revision is still a proposal. The proposed move to Section B is part of it. In the European Parliament, the lead committee's draft report is dated 30 June 2026 and committee amendments 28 July 2026. The MDR/IVDR requirements remain in effect until the proposal is adopted..

  • Guidance is not law. MDCG 2025-6 on the interplay between the MDR/IVDR and the AI Act is basically non-binding. It remains a useful reference and it confirms that AI Act QMS elements can be built into the existing QMS and that a single set of technical documentation is drawn up.

What to do now

  1. Make an inventory. List every product and feature that uses AI, including embedded functions and products still in development.

  2. Classify and document. For each one, record whether it is an AI system, whether it is a safety component under the new definition and whether a notified body is involved. Document the rationale in your existing QMS and technical documentation, even when the answer is "not high-risk".

  3. Check your roadmap. If a device contains a high-risk AI system under Article 6(1), the requirements apply from 2 August 2028. For devices in development now, design decisions made today will determine how hard compliance is.

  4. Run a gap assessment. Compare your QMS and technical documentation with the applicable requirements of Articles 9–15, covering risk management, data governance, technical documentation, logging, information to deployers, human oversight, accuracy, robustness and cybersecurity. Build these into the existing ISO 13485 QMS and MDR/IVDR technical documentation.

  5. Talk to your notified body. Ask whether it intends to apply for AI Act designation by the 28 January 2028 deadline, when it expects designation to be complete and what it will expect from you.

  6. Update your regulatory register. Add the AI Act, the delegated acts and the Commission's guidelines, when they are published (early August 2027). Reassess when they are published.

  7. Document AI literacy measures. Article 4 requires measures that support AI literacy, suited to people's knowledge and the context of use. It does not prescribe a specific form of training, so record what you do and why.

Need help assessing whether your device is high-risk AI, or building AI Act requirements into your QMS?

Reminder: EUDAMED deadline

For devices subject to EUDAMED registration that were placed on the market before 28 May 2026 and continue to be placed on the market thereafter, the transitional registration deadline is 28 November 2026, subject to applicable exceptions. This includes relevant MDR Class I and IVDR Class A devices.

New MDR/IVDR devices requiring registration must already be registered before the first unit is placed on the market.

If your registrations are not complete, start now.

Sources

Quality and Regulatory Consulting

Expert services in medical device regulation and quality compliance.

contact information

Karkinen Consulting Oy, Helsinki, Finland
Business ID: 3103786-9
info@karkinen.com

NATO NCAGE code A10CG

© 2026. All rights reserved.