EU AI Act for healthcare AI: medical devices, diagnostics, and clinical decision support

• Most clinical AI is Annex I embedded high-risk via MDR (medical devices) or IVDR (diagnostics)
• Some healthcare AI is Annex III(5)(a): public health benefits + emergency dispatch
• Dual conformity: AI Act assessment integrated with MDR/IVDR notified-body work to avoid duplication
• Article 4 literacy: live today for every clinician using AI tools
• Article 5 prohibitions: live since 2 Feb 2025 (real-time biometric ID, untargeted scraping)
• Article 14 human oversight: AI cannot fully replace qualified medical readers
• Research exception: pure R&D AI out of scope (Article 2(8) + Recital 25)
• Annex I embedded high-risk obligations apply from 2 August 2028 (post-Omnibus)
• Triple penalty exposure: EU AI Act + MDR + GDPR can stack on a single incident

AI diagnostic systems (radiology image reading, pathology slide analysis, ECG interpretation). Annex I embedded high-risk via MDR.

AI in laboratory analysers (genetic test result interpretation, blood-marker AI). Annex I embedded high-risk via IVDR.

AI in surgical robots, anaesthesia systems, infusion pumps. Annex I embedded high-risk via MDR.

AI in continuous patient monitoring (wearable arrhythmia detection, sepsis prediction). Annex I embedded high-risk via MDR.

AI clinical decision support that qualifies as a medical device under MDR. Annex I embedded high-risk. The MDR Article 2 definition of medical device is broad; many software-as-medical-device tools qualify.

Annex III(5)(a), Access to essential public services. AI used by public authorities (national health services, social-security funds) to determine eligibility for healthcare benefits, prioritisation of care, or access to public-sector medical services. Includes some triage AI in public hospitals.

Annex III(5)(c), Risk assessment + pricing in life and health insurance. AI used by insurers to assess risk for life or health insurance pricing. Standalone high-risk under Annex III, not via MDR. Requires Article 27 FRIA before deployment.

Annex III(5)(c), Emergency dispatch. AI used in ambulance call triage, priority emergency call assessment, dispatch prioritisation by public emergency services. Annex III high-risk standalone.

Annex I embedded high-risk applies from 2 August 2028 (delayed by Omnibus). Annex III standalone high-risk applies from 2 December 2027 (also delayed). Article 4 literacy + Article 5 prohibitions are live today regardless. If your healthcare AI hits both routes (a triage AI inside a medical device used by a public hospital), both timelines apply and the earlier one bites first.

One notified body, both regimes. For Annex I embedded high-risk AI in medical devices, the same notified body that handles MDR/IVDR conformity assessment should also assess the AI Act Article 8-15 requirements. This integrated assessment is the supposed cost-saver vs running two parallel assessments. In practice, the integration is still being operationalised; expect some friction in 2026-2027.

Technical documentation overlap. Article 11 + Annex IV technical documentation for AI Act high-risk overlaps significantly with MDR Annex II + III technical files. The same documentation pack typically satisfies both, provided you structure it to do so. Many medtech providers retroactively restructure their MDR technical file to map to Annex IV.

CE marking covers both. A single CE mark with two declarations of conformity (one MDR, one AI Act) is the expected pattern. The MDR CE mark is the existing one; the AI Act adds a declaration on top.

Post-market surveillance + vigilance. MDR Article 83-100 vigilance and AI Act Article 72 post-market monitoring both require ongoing post-market work. The Commission expects providers to integrate the two surveillance loops rather than run parallel ones.

2 days. Serious public-health threat (immediate or imminent risk of widespread harm).

10 days. Death or unanticipated serious deterioration in a person’s state of health.

15 days. Any other serious incident.

In scope of the exception. AI used in drug-discovery pipelines (predicting protein structures, identifying molecular candidates, analysing screening data). AI used in retrospective research on historical clinical data. AI used in pre-clinical research models.

Out of the exception. AI used in clinical trials where the AI directly participates in patient care (active arm of a trial, not just data analysis). AI deployed in production clinical settings, even if also generating research data. AI sold or deployed beyond pure R&D.

Clinicians + technicians using AI tools (Tier 1 staff literacy). Understand the AI’s clinical capabilities + limitations. Recognise hallucination, automation bias, and bias-by-training-data patterns. Know when to override. Know how to document oversight. Compatible with existing CME (continuing medical education) systems.

Department heads + medical directors (Tier 2 manager literacy). Article 14 oversight design, Article 26 deployer obligations, vendor evaluation, incident management. The clinical lead signing off on AI-supported pathways needs this depth.

CMO + CHRO + governance (Tier 3 director literacy). Article 4 personal liability, MDR vigilance + Article 73 incident reporting, governance design, board-pack risk reporting, AI Act fines (Article 99 + Article 101) + MDR Article 113 fines.