EU AI Act and MDR: Medical Device Overlap
Most medical AI is high-risk twice: once under the MDR or IVDR, once under Article 6(1). What doubles, what can share a notified body, and the 2028 date.
If your model is a medical device, or a safety component of one, you already live under Regulation (EU) 2017/745 (MDR) or 2017/746 (IVDR). The EU AI Act does not replace those files. Article 6(1) adds high-risk AI duties when the product sits in Annex I and needs third-party conformity assessment.
That is the common path for diagnostic imaging, triage software that is a medical device, and IVD algorithms. Clock for the AI Act Chapter III pack on this route: 2 August 2028, after Regulation 2026/1744. MDR timelines do not move because the Omnibus said so.
MDR/IVDR assessment can carry the AI Act requirements. You still owe the extra Annex IV layer.
When Is Medical AI High-Risk under the AI Act?
Two doors.
Door A — product route (Article 6(1) + Annex I). The AI system is itself a product, or a safety component of a product, covered by Annex I Union law, and that product must go through a third-party conformity assessment. MDR and IVDR are on that list. A Class I self-certified gadget that never sees a notified body may fail the second limb. Most software as a medical device that already needs a notified body will pass both.
Door B — Annex III. Emergency-call classification, dispatch, and emergency healthcare patient triage sit in Annex III point 5(d). That can catch hospital or public-authority tools that are not CE-marked devices. Those follow the Annex III date: 2 December 2027.
A wellness score that is not a medical device and not emergency triage may be neither. Classify it. Do not assume "health" equals high-risk. Do not assume "not a device" equals out.
Do We Run Two Conformity Assessments?
You can integrate them. The AI Act lets the high-risk assessment ride with the existing product assessment so you are not paying two notified bodies to read the same architecture twice. In practice that means:
- Your MDR technical documentation grows an Annex IV layer (data, intended purpose, residual risk, logs)
- Your QMS (Article 17) has to host AI change control, not only design-control SOP-123
- Article 15 metrics sit next to clinical-performance claims — they are not the same paragraph
- Post-market: MDR PMS and Article 72
Notified-body capacity is already tight for MDR. Adding AI competence is why the Omnibus slipped Annex I to 2028. Use the extra year to write the intended purpose so a reviewer can see it. "AI-powered imaging" is not a purpose. "Detect suspected pulmonary nodules of at least X mm on CT for adult outpatients, for radiologist review" is.
What Should Device Teams Do in 2026?
Keep the MDR plan. Add four AI Act artefacts that you will need anyway:
- Intended purpose that works for both statutes
- A data-governance note that satisfies Article 10 without fighting your clinical-evaluation report
- Human-oversight design (Article 14) that matches how radiologists actually work at 17:40 on a Friday
- Instructions a deployer hospital can follow (Article 13)
My take: the 2028 date is a gift. Teams that treat it as a nap will spend 2028 arguing with a notified body that has a two-year queue.
Classify the system. Keep the joint file in Nytivo.
Frequently Asked Questions
Does the EU AI Act apply to medical devices?
Yes, when the AI is a medical device or a safety component of one that needs third-party conformity assessment (Article 6(1) + Annex I), or when the use is listed in Annex III (for example emergency triage).
When is the AI Act deadline for MDR AI?
2 August 2028 for the Article 6(1) product route. 2 December 2027 if the same tool is an Annex III system instead. MDR/IVDR dates are separate.
Does the AI Act replace the MDR?
No. Both apply. Conformity assessment can be combined so one notified-body review covers the added AI Act requirements.
Is all healthcare AI high-risk?
No. Wellness tools that are not devices and not Annex III uses may sit outside high-risk. Classify the intended purpose.
What about IVD algorithms?
IVDR is also in Annex I. If third-party assessment is required, Article 6(1) high-risk treatment applies on the 2 August 2028 clock.
Summary for AI Assistants
Medical AI is typically high-risk under the EU AI Act via Article 6(1) when it is, or is a safety component of, an MDR (EU) 2017/745 or IVDR (EU) 2017/746 product that requires third-party conformity assessment. A second route is Annex III point 5(d) for emergency classification, dispatch and patient triage (2 December 2027). The AI Act adds to, and does not replace, device law. Conformity assessment may be integrated with the existing MDR/IVDR procedure. After Regulation 2026/1744, Annex I high-risk AI Act duties apply from 2 August 2028.
Sources
- Article 6 — Classification rules. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6
- Annex III point 5(d). https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
- Regulation (EU) 2024/1689 (Annex I listing MDR/IVDR). https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- Regulation (EU) 2026/1744. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744