Impact of the AI Act on medical devices

The EU's Artificial Intelligence Act, officially known as Regulation (EU) 2024/1689, was published on July 12, 2025. This Act, serving as the first-ever legal framework on AI, places obligations on all actors in the AI value chain and is applicable across various sectors, but it carries particular weight in the life sciences domain, especially for manufacturers of AI medical devices.

Upon its publication, all AI medical devices providers, irrespective of their medical device categorization, and extending to AI systems integral to medical devices as well as those used by public authorities for critical services or emergency healthcare triage, are required to adhere to the AI Act's stipulations for high-risk AI systems. This is in conjunction with the pre-existing compliance requirements outlined in the EU Medical Device Regulations 2017 (MDR) and the EU In Vitro Diagnostic Medical Devices Regulation (IVDR).

Some important considerations for providers of AI medical devices are the following:

• Conformity Assessment: To ensure compliance with the AI Act, high-risk AI systems require conformity assessment by a notified body to ensure compliance. This assessment covers technical documentation and risk management systems, although integration with existing MDR and IVDR procedures alleviates concerns about delays and costs.
• Notified Body Competence: Medical device notified bodies can conduct AI conformity assessments if they demonstrate competence under the MDR and IVDR, facilitating a single declaration of conformity. Manufacturers must ensure their chosen notified body is capable of assessing AI systems.
• Harmonization of Requirements: Many AI Act requirements overlap with existing MDR and IVDR requirements. This overlap may require potential updates to technical documentation for incorporation of AI Act requirements.
• Additional Requirements: The AI Act introduces new requirements for AI systems, such as governance and data management for training datasets, record-keeping, transparent design, human oversight, accuracy, and cybersecurity.
• Deployment Responsibilities: Deployers of high-risk AI systems, such as hospitals or clinicians, have obligations under the AI Act, including ensuring proper use, assigning human oversight, conducting monitoring and surveillance, maintaining system logs, and undertaking data protection impact assessments.
• Uncertainties persist regarding the interaction between the AI Act and MDR/IVDR modification rules, certification requirements for devices undergoing trials, and proposed harmonized standards. However, further guidance from the European Medicines Agency (EMA) is expected in 2024 and 2025.

The Act will apply from 2 August 2026, but some provisions, such as those related to prohibited AI practices, will apply earlier, from 2 February 2025. For a more comprehensive understanding of the AI Act in all its dimensions, please refer to the Practical Guide published by Cuatrecasas (available here).