EU AI Act vs Medical Device Regulation (MDR): Double Compliance for AI-Enabled Devices

If you make AI-enabled medical devices for the European market, you answer to two regulations at once. The Medical Device Regulation (MDR) has governed device safety and performance since May 2021. The EU AI Act adds a second layer of requirements for AI systems, and most AI-enabled devices that need a notified body under the MDR automatically count as high-risk AI under Article 6(1).

2026 settled one big question and opened another. In May, EU lawmakers rejected industry calls to exempt medical devices from the AI Act's high-risk regime, but gave them until 2 August 2028 to comply. At the same time, the Commission's proposed MDR/IVDR revision still contains the same exemption the AI Omnibus rejected, and it is now being debated in Parliament and Council.

This guide explains how the two regulations fit together, where they overlap, what the AI Act adds on top of MDR compliance, and how to build one integrated system rather than two parallel ones.

MDR: Regulation (EU) 2017/745 on medical devices, applying since 26 May 2021 (IVDR, Regulation (EU) 2017/746, since 26 May 2022)
EU AI Act: Regulation (EU) 2024/1689, in force since 1 August 2024
When a device is high-risk AI: When the AI system is a device or a device's safety component and needs notified body assessment under the MDR or IVDR (Article 6(1))
High-risk AI deadline for devices: 2 August 2028, moved from 2 August 2027 by the Digital Omnibus on AI
Conformity route: One integrated MDR/IVDR assessment that includes the AI Act requirements (Article 43(3))
Key guidance: MDCG 2025-6 / AIB 2025-1 FAQ on the interplay between the MDR/IVDR and the AI Act (June 2025)
Open question: The MDR/IVDR revision proposal of 16 December 2025 would move devices to Annex I Section B, largely removing AI Act high-risk duties

The short answer

The MDR asks whether your device is safe and performs as intended for patients. The AI Act asks whether the AI inside it is trustworthy: built on governed data, transparent, overseen by humans, accurate, robust, secure and monitored over its life cycle. If your AI-enabled device needs a notified body under the MDR, you must meet both sets of requirements, but through one conformity assessment, one technical file, one quality management system and one CE mark.

The MDR covers

Clinical safety and performance, risk class, clinical evaluation, the quality management system, technical documentation, post-market surveillance, vigilance and the unique device identifier (UDI), for every medical device.

The AI Act adds

Data and data governance, record-keeping and logs, transparency to deployers, human oversight, accuracy, robustness and cybersecurity, bias controls, and AI-specific post-market monitoring, for AI systems.

When is an AI medical device "high-risk" under the AI Act?

Under Article 6(1), an AI system is high-risk if both conditions are met: it is a product, or a safety component of a product, covered by Annex I legislation (which includes the MDR and IVDR), and that product must undergo third-party conformity assessment. In practice, the notified body requirement decides it.

MDR / IVDR class	Notified body involved?	High-risk AI under Article 6(1)?
MDR Class I (not sterile, measuring or reusable surgical)	No	No
MDR Class Is, Im, Ir	Yes, for those aspects	Yes
MDR Class IIa, IIb, III	Yes	Yes
IVDR Class A (non-sterile)	No	No
IVDR Class A sterile, B, C, D	Yes	Yes
In-house devices (MDR/IVDR Article 5(5))	No	No

Based on MDCG 2025-6 / AIB 2025-1. Software is often Class IIa or higher under MDR Rule 11, so most diagnostic and therapeutic AI software falls into the high-risk category.

Two clarifications in the joint MDCG/AI Board guidance prevent common mistakes. First, AI Act high-risk status doesn't change your MDR risk class. The logic runs one way only. Second, a device that isn't high-risk AI is still within the AI Act: prohibited practices, AI literacy duties and Article 50 transparency rules for chatbots and generative features can still apply.

The 2026 decision: no carve-out, more time

Industry associations, including MedTech Europe, campaigned for AI-enabled devices to be regulated through the MDR alone. The Commission's MDR/IVDR revision proposal of 16 December 2025 went further, proposing to move the MDR and IVDR from Section A to Section B of Annex I. Under Article 2(2), that would largely switch off the AI Act's high-risk requirements for medical devices.

The Digital Omnibus on AI took the opposite view. In the political agreement of 7 May 2026, Parliament and Council kept the MDR and IVDR in Section A, so AI-enabled medical devices remain fully in scope. What they gained was time and a promise of relief:

A one-year delay: high-risk AI obligations for products covered by Annex I, including medical devices, now apply from 2 August 2028 instead of 2 August 2027.
Sectoral assessment first: the MDR/IVDR conformity assessment remains the route for AI Act compliance.
Future redundancy relief: the Commission can adopt delegated acts exempting specific AI Act high-risk requirements where the MDR or IVDR already demand equivalent ones. None has been adopted yet.

The Section B debate isn't over

The Omnibus rejected the Section B move, but the separate MDR/IVDR revision still proposes it. Parliament's SANT committee published its draft report in July 2026, nearly 800 amendments were tabled, and the Council aims for a general approach by the end of 2026. Until that revision is adopted, plan for full dual compliance by 2 August 2028.

Where the MDR and the AI Act overlap, and where the AI Act adds more

The two regulations share the same New Legislative Framework logic: a manufacturer (called the "provider" in AI Act language), a quality management system, technical documentation, conformity assessment, CE marking and post-market obligations. The AI Act explicitly allows them to be integrated.

Area	MDR / IVDR	AI Act (high-risk)	How to integrate
Quality management	QMS under Article 10(9), typically ISO 13485	QMS under Article 17	Add AI Act elements to the existing MDR QMS (Article 17(3))
Risk management	Safety and performance risks, typically ISO 14971	Risks to health, safety and fundamental rights (Article 9)	One risk process, extended to bias, data and fundamental-rights risks
Data	Implicit in clinical evaluation and verification	Explicit data governance: relevance, representativeness, errors, bias (Article 10)	New data governance procedures for training, validation and test data
Technical documentation	Annexes II and III	Annex IV	A single technical file covering both (Article 11(2))
Logging	Not specifically required	Automatic event logs (Article 12)	Design logging into the device software
Transparency	Instructions for use and labelling	Instructions for deployers on capabilities, limitations and accuracy (Article 13)	Extend the instructions for use
Human oversight	Usability and use-error risks, IEC 62366-1	Designed-in human oversight (Article 14)	Link oversight measures to usability engineering
Accuracy, robustness, cybersecurity	General safety and performance requirements, including cybersecurity	Article 15, including adversarial attacks and data poisoning	Add AI-specific robustness and security testing
Conformity assessment	Notified body under the MDR/IVDR	Part of the MDR/IVDR assessment (Article 43(3))	One notified body competent for both
Post-market	PMS, PSUR, vigilance	Post-market monitoring (Article 72), serious incidents (Article 73)	One PMS system with AI performance and drift monitoring

The MDCG guidance adds a useful efficiency point: a clinical investigation under the MDR, or a performance study under the IVDR, also counts as real-world testing under the AI Act. You don't need to run separate studies.

Data governance is the biggest new workload

Most MDR-mature manufacturers already have strong QMS, risk and PMS processes. The real gap is usually Article 10: documented data provenance, representativeness across patient populations, bias examination and data-quality controls for training, validation and test sets.

If you are planning AI Act compliance for a device portfolio, I post practical breakdowns of the AI Act, MDR, ISO 42001 and EN 18286 regularly on LinkedIn. Feel free to connect with me there and share where your team is finding the biggest overlap or gap.

The market reality: AI devices are surging

The EU has no public register of AI-enabled devices, but the US Food and Drug Administration's list shows the scale and pace of the market these rules govern. As of 29 June 2026, the FDA's AI-Enabled Medical Device List named 1,614 authorised devices, and radiology accounts for roughly three in four.

1,614AI-enabled devices on the FDA's list as of 29 June 2026

~76%of FDA-authorised AI devices are in radiology

~50notified bodies designated under the MDR, against roughly 80 under the old directives

FDA figures from analyses of the FDA AI-Enabled Medical Device List, which the FDA notes is not comprehensive. Notified body figures are approximate and change as designations are added in NANDO.

FDA AI-enabled device authorisations per year

2025 (full year) ~335

2026 (first six months) ~181

For EU manufacturers, notified body capacity is the practical constraint. Under Article 43(3), the AI Act assessment runs through your MDR notified body, but that body must also meet the AI Act's competence requirements for notified bodies. Ask early whether yours will be ready to assess AI Act requirements before your next certificate cycle.

How the two timelines fit together

26 May 2021
MDR applies.
26 May 2022
IVDR applies.
1 Aug 2024
AI Act enters into force.
2 Feb 2025
AI Act prohibitions and AI literacy duties apply to everyone, including device manufacturers.
19 Jun 2025
MDCG 2025-6 / AIB 2025-1 FAQ on the MDR/IVDR and AI Act interplay published.
16 Dec 2025
Commission proposes the targeted MDR/IVDR revision, including the Section B move.
7 May 2026
AI Omnibus agreement keeps devices in Section A and delays the deadline to 2028.
2 Aug 2026
Article 50 transparency duties apply, including for chatbots and generative features in devices.
14 Oct 2026
EN 18286, the harmonised QMS standard for the AI Act, is cited in the Official Journal.
31 Dec 2027
MDR transition deadline for legacy Class III and implantable Class IIb devices.
2 Aug 2028
AI Act high-risk obligations apply to AI-enabled medical devices and IVDs.
31 Dec 2028
MDR transition deadline for other legacy devices.

Two deadlines in the same window

Manufacturers still moving legacy devices to MDR certificates face MDR transition deadlines at the end of 2027 and 2028, right next to the AI Act's 2 August 2028 date. Plan one certification project that covers both, or you may pay for two notified body cycles.

A 6-step dual-compliance plan

Inventory and classify every AI function
For each device, decide whether it contains an AI system as defined by the AI Act, its MDR or IVDR class, and whether it is high-risk under Article 6(1). Flag generative or chatbot features for Article 50.
Extend your QMS, don't duplicate it
Add AI Act Article 17 elements to your ISO 13485 QMS: data management, AI life-cycle controls, logging, human oversight and AI post-market monitoring. EN 18286 and ISO/IEC 42001 can structure the additions.
Build data governance from the ground up
Document data sources, collection, labelling, cleaning and representativeness across age, sex, ethnicity and clinical settings. Run bias examinations and record how you mitigate them.
Merge the technical documentation
Map MDR Annexes II and III against AI Act Annex IV, fill the gaps, and keep one technical file that a single notified body can review.
Plan for change and learning
Define in advance which model updates are pre-determined and documented, so they don't count as substantial modifications. Align that plan with MDR significant-change rules and your notified body's expectations.
Engage your notified body early
Confirm its AI Act competence, agree the evidence it expects, and schedule AI Act requirements into your next surveillance or recertification audit before 2 August 2028.

Common mistakes to avoid

Assuming the AI Act has been dropped for medical devices
Treating the 2028 deadline as a reason to wait, when data governance work takes years
Building a separate AI Act QMS and technical file alongside the MDR ones
Assuming AI Act high-risk status raises your MDR class
Forgetting that AI literacy and Article 50 transparency already apply today

A prompt to run your MDR + AI Act gap analysis

Paste in your device details to get a first-draft gap analysis. Your regulatory affairs lead and notified body should validate it.

MDR/IVDR + EU AI Act dual-compliance gap analysis prompt

You are a medical device regulatory specialist with deep
knowledge of the EU MDR (2017/745), IVDR (2017/746), the EU AI
Act (2024/1689) as amended by the Digital Omnibus on AI, and
MDCG 2025-6 / AIB 2025-1.

Our device:
[intended purpose; MDR or IVDR class and classification rule;
conformity assessment route and notified body; AI functions and
model type; whether the model learns after deployment; training,
validation and test data sources; existing QMS (ISO 13485),
risk management (ISO 14971) and PMS processes; any chatbot or
generative features]

Produce:
1. Whether the device is high-risk AI under AI Act Article 6(1),
   with reasons, and whether Article 50 applies.
2. A gap table mapping AI Act Articles 9-17 and 72-73 to our
   existing MDR/IVDR processes: covered, partly covered, gap.
3. The data governance (Article 10) evidence we must create.
4. How to merge MDR Annexes II and III with AI Act Annex IV
   into a single technical file.
5. A change-control approach for model updates that fits both
   regimes.
6. A plan to 2 August 2028, including questions for our
   notified body.

Use only what I provide and mark uncertain points UNKNOWN.

The MDR proves the device is safe for the patient. The AI Act proves the algorithm inside it deserves the patient's trust. Build one system that proves both. — Kumail Mehdi

Frequently asked questions

Does the EU AI Act apply to medical devices?

Yes. An AI-enabled medical device or IVD that needs notified body assessment under the MDR or IVDR is a high-risk AI system under Article 6(1). The Digital Omnibus on AI confirmed this in 2026 and set the application date at 2 August 2028.

Do I need two conformity assessments and two CE marks?

No. Under Article 43(3), the AI Act requirements become part of the MDR or IVDR conformity assessment carried out by your notified body, provided it meets the AI Act's competence requirements. The result is one CE mark.

Does high-risk AI status change my MDR class?

No. MDCG 2025-6 confirms that AI Act high-risk classification doesn't move a device into a higher MDR or IVDR class. Your MDR class helps determine AI Act status, not the other way round.

Is a Class I AI device covered by the AI Act?

A Class I device with no notified body involvement isn't high-risk under Article 6(1). But the AI Act still applies in other ways: prohibited practices, AI literacy duties and, for chatbots or generative features, Article 50 transparency rules.

Will the MDR revision remove the AI Act for devices?

It might, but it isn't law. The Commission's December 2025 proposal would move the MDR and IVDR to Annex I Section B, largely switching off AI Act high-risk duties. The AI Omnibus rejected that change in May 2026, and the revision is still being negotiated.

Can my clinical investigation count for AI Act testing?

Yes. According to MDCG 2025-6, a clinical investigation under the MDR or a performance study under the IVDR also qualifies as real-world testing under the AI Act, so separate studies aren't needed.

Master AI governance in 6 months, 15 minutes a week

AI Governance – Decoded is my weekly newsletter that explains the EU AI Act, sector regulations like the MDR, ISO 42001 and the standards around them in plain language. One short, practical read every week.

Join the newsletter

Working through AI Act compliance for medical devices? Let's connect on LinkedIn. I'm always glad to compare notes on dual compliance.

EU AI Act vs Medical Device Regulation (MDR): Double Compliance for AI-Enabled Devices