Updated 19 May 2026 · The Digital Omnibus AI Act trilogue agreement of 7 May 2026 postpones AI safety components covered by EU sectoral legislation (including AI-enabled medical devices) from 2 August 2027 to 2 August 2028. The agreement also clarifies the 'safety component' assessment (verbatim EP IPR42011): AI functions that only assist users or optimise performance no longer automatically face high-risk obligations, if their failure or malfunction does not create health or safety risks. Case-by-case qualification recommended. On 19 May 2026, the Commission published its Draft Guidelines on Article 6 (consultation open until 23 June 2026); the Annex I component clarifies the case-by-case test verbatim (§§32–49). Note: medical devices were excluded from the overlap removal that applies to machinery products. The MDR × AIA double-compliance burden remains for medical AI manufacturers (until adoption of COM(2025)1023 and/or delegated acts).
AI Act pre-conformity · MedDev sector (Article 6(1) + MDR)
Medical AI under the EU AI Act
The MDR + AI Act intersection, and what it means for your conformity pathway.
Most medical AI systems classified MDR Class IIa or higher are automatically high-risk under the AI Act (Art. 6(1)). The two regulations don’t replace each other; they layer. MDCG 2025-6 maps the interaction. This page summarises the rule, the four obligations that don’t derive from MDR, and the deadline that matters for your team.
- · Independent · Brussels-based · BCE BE 1034.962.482
- · Pre-conformity advisory firm · No commercial relationship
- · Methodology versioned · sources MDCG 2025-6 + AIA + MDR/IVDR
Definition
Article 6(1) of the EU AI Act classifies as high-risk AI systems used as safety components of products covered by Union harmonisation legislation listed in Annex I, including medical devices regulated under MDR (Reg. 2017/745) and IVDR (Reg. 2017/746). Two cumulative conditions apply: (1) the AI is a safety component (Article 3(14)) or the AI itself is the device; AND (2) the device requires third-party conformity assessment by a Notified Body. The safety component qualification is both intent-based and failure-based: a system intended only for efficiency optimisation may still qualify if its failure or malfunction could endanger health or safety (Draft Commission Guidelines on Article 6 · Annex I, §42, 19 May 2026). MDCG 2025-6 endorses a single QMS approach: 'economic operators can comply with the requirements of the AI Act and Union harmonisation legislation within a single compliance framework' (§62 Annex I). The binding deadline post-Digital Omnibus is 2 August 2028.
Classification Rule
When medical AI is automatically high-risk
Two cumulative conditions under Art. 6(1) AIA (MDCG 2025-6 Q2): (1) the medical AI is a safety component (Art. 3(14) AIA) OR the AI system is the medical device / IVD itself; AND (2) the medical AI is subject to third-party conformity assessment by a Notified Body under MDR (Reg. 2017/745) or IVDR (Reg. 2017/746). If both conditions are met, high-risk under Art. 6(1). If not, Art. 5 (prohibited practices) and Art. 50 (transparency) still apply independently.
Mnemonic: “Notified Body involved = high-risk AIA.”
| MDR/IVDR classification | Notified Body | High-risk AIA (Art. 6(1)) |
|---|---|---|
| MDR Class I · non-sterile, non-measuring, non-reusable surgical | No | No |
| MDR Class I · sterile / measuring / reusable surgical | Yes | Yes |
| MDR Class IIa, IIb, III | Yes | Yes |
| MDR Annex XVI | Yes | Yes (except non-invasive Class I) |
| IVDR Class A · non-sterile | No | No |
| IVDR Class A · sterile | Yes | Yes |
| IVDR Class B, C, D | Yes | Yes |
| In-house device · Art. 5(5) MDR/IVDR | No | No (but Art. 5 AIA still applies) |
Source: MDCG 2025-6 / AIB 2025-1 · Interplay between MDR & IVDR and AIA (June 2025), Table 1 page 6.
Timeline
The MedDev deadline is 2 August 2028, not 2 August 2026
Most companies in the AI ecosystem focus on 2 August 2026 (Art. 50 transparency). For medical AI under Art. 6(1), the binding deadline post-Digital Omnibus (trilogue agreement 7 May 2026) is 2 August 2028. High-risk obligations on AI used as safety components covered by EU sectoral legislation (including MDR/IVDR-regulated AI medical devices) are postponed by 12 months from the original Art. 113(c) date of 2 August 2027.
Devices already placed on the market before the AIA binding date typically do not trigger new AIA obligations until the first significant design change on or after that date. MDCG 2025-6 (June 2025) was published before the Omnibus deal and references the original 2 August 2027 application date; the Commission has not yet republished the FAQ to reflect the revised 2 August 2028 backstop.
Digital Omnibus update: a provisional trilogue agreement was reached on 7 May 2026. Confirmed: Annex III standalone high-risk obligations (EP enumeration: biometrics, critical infrastructure, education, employment, law enforcement, border management; non-exhaustive) postpone to 2 December 2027. AI safety components covered by EU sectoral legislation (including AI-enabled medical devices) postpone to 2 August 2028. The agreement also clarifies the 'safety component' assessment: AI functions whose intended purpose is limited to efficiency optimisation, performance enhancement, or convenience do not fulfil a safety function as such (Art. 3(14) AI Act). However, such a system may nonetheless qualify as a safety component where the consequence of its failure or malfunctioning could endanger health and safety of persons or property (Draft Commission Guidelines on Article 6 · Annex I, §42, 19 May 2026). The qualification is therefore both intent-based and failure-based, applied case-by-case; the provider carries the burden of demonstrating non-qualification. Formal adoption intended before 2 August 2026.
Sources: Reg. 2024/1689 Art. 113 · MDCG 2025-6 Q31 · MDCG 2021-24 Rev.1 (April 2026) · Digital Omnibus on AI trilogue agreement (7 May 2026).
Four deltas
Four obligations that don’t derive from MDR
MDR is a strong foundation for medical AI conformity. But it does not cover four AI-specific obligations introduced by the AIA. These deltas need to be added to the existing technical file (single QMS approach, MDCG 2025-6 endorsed).
Delta 1 · Substantial modification (autonomous concept)
Art. 3(23) AIA defines “substantial modification” independently of MDR’s “significant change.” A change can be substantial under AIA without being significant under MDR, and vice versa. The two assessments must be done in parallel.
Delta 2 · Human oversight (architectural enforcement)
Art. 14 AIA requires that the design of the system supports meaningful human oversight, including the technical ability for human operators to intervene and override system behaviour. MDR’s safe-design principle covers operational safety and usability; AIA Art. 14 adds an explicit architectural-enforcement layer for AI-specific oversight.
Delta 3 · Automatic logging at runtime
Art. 12 AIA requires automatic event logs at runtime, for each prediction or inference, throughout the operational life of the system. MDR imposes device-level traceability; AIA adds behavioural logs at the inference level.
Delta 4 · AI literacy of deployers
Art. 4 AIA imposes a transverse permanent obligation on the manufacturer to ensure that downstream users (HCPs, institutions) have a sufficient level of AI literacy. This is not a CE-marking requirement; it is a structural deployer-side obligation that flows back to the manufacturer.
Sources: Reg. 2024/1689 Art. 3(23), 4, 12, 14 · MDCG 2025-6 Q14, Q19, Q20.
Report scope
What our assessment covers for medical AI
The Sprinkling Act report for a medical AI system covers the six gates of the standardised methodology, with the medical AI specificity layered in.
- •G1 · Art. 5 · Are any of the 8 prohibited practices triggered?
- •G2 · Art. 6(1) · Is the AI system a safety component of an EU-regulated product (MDR/IVDR pathway)? · core gate for medical AI
- •G3 · Art. 6(2) + Annex III · Does any high-risk domain apply in addition (e.g. employment, education, public services)?
- •G4 · Art. 50 · Does an end user interact with the AI without knowing?
- •G5 · Art. 51/53 · Does the system use or distribute a general-purpose AI model?
- •G6 · Art. 6(3) · Can the “no significant risk” exception apply?
Medical AI specificity:
- ·MDR/IVDR class verification against MDCG 2025-6 Table 1
- ·Article 6(1) determination with Notified Body status check
- ·Substantial modification vs significant change mapping (Delta 1)
- ·4 deltas applied to the candidate’s existing technical file
- ·Timeline orientation (2 August 2028 post-Digital Omnibus + significant change trigger)
Out of scope (explicit):
- ×Not a conformity assessment under Art. 43 AIA
- ×Not a CE-marking opinion under MDR/IVDR
- ×Not a Notified Body certification
- ×Not legal advice; consult qualified counsel for legal decisions
- ×Not a substitute for clinical evaluation under MDCG 2020-1
Integration
Single QMS, single technical file (MDCG 2025-6 §3)
MDCG 2025-6 explicitly endorses integration rather than duplication. The manufacturer maintains one QMS and one technical documentation (Art. 11(2) AIA + Art. 17(3) AIA + Recital 81). The Commission's own Draft Guidelines on Article 6 · Annex I (§62, 19 May 2026) confirm this principle verbatim: 'such mechanisms provided in the AI Act enable economic operators to comply with the requirements of the AI Act and Union harmonisation legislation within a single compliance framework, thereby avoiding any possible duplication of compliance efforts.' The Sprinkling Act assessment is structured to feed directly into your existing technical file, not to duplicate it.
What we add: the article-by-article AIA mapping that sits on top of your MDR work, identifying which AIA articles trigger and where they integrate into your existing controls (risk management Art. 9, data governance Art. 10, technical documentation Art. 11, logging Art. 12, transparency Art. 13, human oversight Art. 14, accuracy/robustness/cybersec Art. 15, deployer information Art. 26). For Breakthrough Devices (MDCG 2025-9) and Post-Market Surveillance (MDCG 2025-10), the same single-QMS principle applies: the AI Act layer integrates on top of the BtX expert panel scientific advice path or the PMS plan respectively, without duplication.
Sources: MDCG 2025-6 §3 · MDCG 2025-9 §10 (BtX expert panels) · MDCG 2025-10 §3-6 (PMS) · Art. 8(2), 17(3), Recital 81 AIA · Draft Commission Guidelines on Article 6 · Annex I (§62, 19 May 2026).
International alignment
Aligned with WHO guidance for medical AI
Our methodology is consistent with the World Health Organization’s Regulatory considerations on artificial intelligence for health (WHO, 19 October 2023, ISBN 9789240078871). The WHO identifies six topic areas for AI regulation in healthcare, mapped below to EU AI Act + MDR articles. The Sprinkling Act assessment is also informed by the WHO Generating evidence for AI-based medical devices framework (WHO, 17 November 2021, ISBN 9789240038462).
| WHO topic area (2023) | EU AI Act + MDR mapping (Sprinkling Act interpretation) |
|---|---|
| 1. Documentation and transparency | Art. 11 + Annex IV AIA · Annex II MDR |
| 2. Total product lifecycle approach and risk management | Art. 9 AIA · MDR Annex I §3 |
| 3. Intended use and analytical / clinical validation | MDCG 2020-1 · Art. 13 AIA |
| 4. Data quality, privacy and data protection | Art. 10 AIA · GDPR · MDR Annex II |
| 5. Engagement of stakeholders | Art. 26-27 AIA (deployer obligations) |
| 6. Collaboration across regulatory bodies | MDCG 2025-6 (issued by MDCG + AIB jointly) |
These WHO publications are advisory; they do not replace EU AI Act and MDR/IVDR legal obligations, but they provide an international reference layer that informs methodology choices for medical AI manufacturers operating across jurisdictions.
Sources: WHO 9789240078871 (2023) · WHO 9789240038462 (2021).
COM(2025)1023 mechanism
How COM(2025)1023 will reshape the AI Act for MedDev
On 16 December 2025 the Commission proposed COM(2025)1023 (the MDR/IVDR Simplification), which contains a structural amendment to the AI Act for medical devices. Verbatim mechanism (Gleiss Lutz analysis): "The MDR and the IVDR are to be removed from Annex I, Section A of the AIA and instead added to Section B of the AIA. With this amendment, Article 2(2) of the AIA would be applicable in future."
Effect: AI medical devices would still fall within the scope of the AI Act, but they would no longer be subject to the AI Act's high-risk substantive requirements (Chapter III). Only Articles 6(1), 102–109, and 112 would remain applicable. The Commission would retain power to adopt delegated acts to reinstate specific HRAIS requirements for medical AI later.
Two complementary tracks now run in parallel: (a) the Digital Omnibus (provisional trilogue agreement of 7 May 2026) postpones binding date to 2 August 2028 and narrows the safety-component definition; (b) COM(2025)1023 (proposal stage, MDR/IVDR Simplification trilogue expected mid-2026, adoption late 2026/early 2027, entry into force 2027–2028) structurally relocates MedDev/IVDR within the AI Act's Annex I.
Industry positioning is active. DIGITALEUROPE (Cecilia Bonefeld-Dahl, 7 May 2026): "co-legislators dropped the ball for our medtech innovators and connectivity champions." MedTech Europe (Oliver Bisazza, 16 December 2025): "This revision is a long-awaited and necessary step to fix parts of the EU regulatory system that are clearly not working for patients, innovators and healthcare providers." 44 industry associations signed the Eurochambres joint letter on the AI omnibus (12 March 2026).
Sub-segments potentially exiting high-risk under safety-component narrowing:
- ·AI medical scribes (transcription-only, no diagnosis/treatment suggestion)
- ·Clinical decision support (CDS) tools that only present information without replacing clinician judgment
- ·Workflow / triage / monitoring-only AI that flags but does not act
- ·Imaging optimisation / image quality enhancement (non-diagnostic)
Functions remaining high-risk regardless: diagnostic algorithms, autonomous treatment decisions, life-sustaining monitoring with intervention loop, IVDR Class C/D companion diagnostics.
Sources: COM(2025)1023 final (16 December 2025) · Gleiss Lutz analysis · Petrie-Flom (Sofia Palmieri, 5 March 2026) · DIGITALEUROPE press release (7 May 2026) · MedTech Europe Bisazza statement (16 December 2025) · Eurochambres Joint Industry Letter (12 March 2026).
FAQ
About Medical AI under the EU AI Act
What makes a medical AI system high-risk under the EU AI Act?
Two cumulative conditions under Article 6(1) (MDCG 2025-6 Q2): (1) the medical AI is a safety component (Article 3(14)) or the AI system is the medical device/IVD itself; AND (2) the device is subject to third-party conformity assessment by a Notified Body under MDR (Reg. 2017/745) or IVDR (Reg. 2017/746). If both conditions are met, high-risk under Article 6(1).
How do MDR and AI Act interact for medical devices?
MDR and AI Act layer rather than replace each other. The manufacturer maintains one QMS and one technical documentation (Article 11(2) + Article 17(3) + Recital 81 AIA). The Draft Commission Guidelines on Article 6 · Annex I (§62, 19 May 2026) confirm this: 'economic operators can comply with the requirements of the AI Act and Union harmonisation legislation within a single compliance framework, thereby avoiding any possible duplication of compliance efforts'.
When does the safety component qualification apply?
The qualification has two alternative scenarios (Draft Guidelines §§32–49, 19 May 2026): (i) intent-based, where the system is intended to fulfil a safety function; or (ii) failure-based, where the system's failure or malfunction could endanger health or safety. A system intended only for efficiency optimisation may still qualify under (ii). The provider carries the burden of demonstrating non-qualification.
What is the AI Act deadline for medical devices?
The binding deadline post-Digital Omnibus (trilogue agreement 7 May 2026) is 2 August 2028. High-risk obligations on AI used as safety components covered by EU sectoral legislation (including MDR/IVDR-regulated AI medical devices) are postponed by 12 months from the original Article 113(c) date of 2 August 2027. Devices already on the market before that date trigger new obligations only upon a significant design change.
Document your AI Act position before your next significant design change
Independent · article-mapped · verifiable hash-stamped report · delivered by email.
Sprinkling Act is an independent pre-conformity advisory firm. It is not a law firm, not a Notified Body, not a certification body, and not affiliated with the European Commission, the European Parliament, or any national supervisory authority. Reports are an informative indication, not legal advice. Companies should consult qualified legal counsel and a Notified Body for compliance and certification decisions. Based on EU AI Act · Regulation 2024/1689 + Medical Devices Regulation (Reg. 2017/745) + IVDR (Reg. 2017/746) + MDCG 2025-6 / AIB 2025-1.
SEE ALSO
Annex A · Healthcare deployers (Article 6(1) MDR/IVDR)
Annex §5: profile, path-to-discovery, active Article 26 paragraph subset, FRIA inapplicability, Article 25 reverse-bascule worked example.
Free Diagnostic
9 questions, instant result.
Methodology
6-Gate Framework + 7-Step Deployer Cascade.
Healthtech Valuations & AI Act
How AI Act classification moves cap-table valuations.