Where an AI system is itself a medical device, or a safety component of a medical device, under Regulation (EU) 2017/745 or Regulation (EU) 2017/746, and third-party conformity assessment is required under that legislation, the system can be high-risk under Article 6(1) of the AI Act. The Chapter III requirements of the AI Act are then taken into account in the conformity assessment carried out under the medical device legislation, rather than through a separate AI Act conformity procedure. The Annex I high-risk rules apply from 2 August 2028 under the amended Article 113. This guide is educational only: it does not determine whether any product is a medical device, and it gives no date for medical device law itself.
When is an AI system a medical device question?
An AI system becomes a medical device question when its intended purpose brings it within the definition of a medical device or an in vitro diagnostic medical device under Regulation (EU) 2017/745 or Regulation (EU) 2017/746. The intended purpose is set by the manufacturer, and it is the purpose, together with the device's function, that determines whether the sector legislation applies, not the technology used or the label on the product. Software that analyses medical data for a diagnostic or therapeutic purpose, software that influences a clinical decision, and software that is a component of a device can all raise the question, while software used only for administration, scheduling or general record-keeping may not. A manufacturer should therefore record the intended purpose in the terms the sector legislation uses, test it against the sector definition with qualified regulatory advice, and keep that assessment with the AI Act classification record, so the two assessments describe the same product and the same purpose.
How does the Annex I route work for devices?
Under Article 6(1), an AI system is high-risk where it is intended to be used as a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I Section A, and that product is required to undergo third-party conformity assessment under that legislation. For medical devices, the relevant legislation is Regulation (EU) 2017/745 and Regulation (EU) 2017/746, listed in Annex I. The conformity assessment for the AI Act requirements is then carried out following the procedures in the sector legislation, with the Chapter III Section 2 requirements taken into account, and the notified body designated under the sector legislation carries out the assessment within its designation. A manufacturer should therefore confirm the notified body's designation covers both the sector legislation and the AI Act requirements, and should plan a single conformity file that addresses both regimes, rather than two files that describe the product differently.
For the broader regulatory framework, see healthcare and biometrics under the AI Act.
Which AI Act requirements are taken into account?
The requirements taken into account are the Chapter III Section 2 requirements for high-risk systems, covering risk management, data and data governance, technical documentation, record-keeping, transparency and information for deployers, human oversight, and accuracy, robustness and cybersecurity. Those requirements must be read together with the sector legislation's own requirements on safety, performance, clinical evaluation and post-market surveillance, and the manufacturer must show how each AI Act requirement is met within the sector conformity file. The quality management system under Article 17 of the AI Act and the quality management system under the medical device legislation should be coordinated, with shared processes where the requirements align and distinct records where they differ. A manufacturer that treats the AI Act requirements as an add-on, prepared after the sector file is complete, will find gaps in risk management, data governance and oversight design that are harder to fix late.
Who carries which duty in the device chain?
The manufacturer, as provider, carries the provider duties for the high-risk system, including the conformity, documentation, registration where applicable and post-market duties, while the healthcare institution or professional deploying the device carries the deployer duties, including use in accordance with instructions, human oversight and monitoring. A software supplier, an integrator and a distributor can occupy different roles, and Article 25 can make another actor a provider where it substantially modifies a high-risk system or changes its intended purpose. The chain should therefore be mapped by role, not by contract title alone, with each actor's duties recorded and the handover of information, instructions, logs and incident channels agreed in writing. A hospital that customises, retrains or repurposes a device should check whether it has assumed a provider role before making the change, since the change can alter the conformity and registration position for the whole chain.
How should the two regimes be evidenced together?
The two regimes should be evidenced in a single lifecycle file per device version, carrying the intended purpose, the sector classification, the AI Act route and reasoning, the conformity assessment and certificate information, the technical documentation, the clinical evaluation and performance evidence, the post-market surveillance and monitoring plans, and the incident and vigilance records. The file should show, for each AI Act requirement, where it is addressed in the sector file, and for each sector requirement, whether an AI Act requirement adds anything. Changes to the device, its software, its data or its intended purpose should trigger a joint review of both regimes, since a change that is minor under one regime can be significant under the other. The file should be kept up to date throughout the device's lifetime, and should be available to the notified body and to market surveillance authorities on request, in the form the applicable legislation requires.
Continue with clinical decision support AI.
What does this guide not decide?
This guide does not decide whether any product is a medical device or an in vitro diagnostic device, whether it is high-risk under Article 6(1), or what conformity route it must follow. Those questions require the sector definitions, the Annex I listing, the intended purpose and the conformity requirements to be applied to the specific product, with qualified regulatory advice. The guide also gives no clinical advice and does not assess safety or performance, which are sector questions for the manufacturer, the notified body and the competent authorities. Where a product's device status or conformity route is uncertain, confirm the position with a competent authority or legal adviser before the product is placed on the market, and keep the assessment with the product's regulatory file.
Frequently asked questions
Does a medical device need a separate AI Act conformity assessment?
No, as a general outline. For Annex I systems, the AI Act requirements are taken into account in the conformity assessment carried out under the sector legislation, by the notified body designated for that legislation. The exact route should be checked in the consolidated text for the product concerned.
When do Annex I high-risk rules apply?
From 2 August 2028, under the amended Article 113 following Regulation (EU) 2026/1744. Other AI Act duties, including prohibitions, literacy and transparency, can apply earlier.
Can a hospital become a provider by changing a device?
It can, in defined circumstances. Article 25 can make another actor a provider where it substantially modifies a high-risk system or changes its intended purpose. A change should be checked before it is made.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗