EU AI Act for healthcare AI

Healthcare AI sits at the intersection of the EU AI Act, the Medical Device Regulation (MDR), and a body of national healthcare law. The interaction is more complex than the single-regulation guides cover. This guide is the map for healthcare AI providers and healthcare deployers.

Two paths into “high-risk” for healthcare AI

The EU AI Act catches healthcare AI through two different mechanisms:

Path 1 — Annex II (regulated medical devices)

If the AI is a safety component of, or is itself, a medical device regulated under MDR or IVDR, the AI is high-risk by reference (Article 6(1)). This includes:

• AI for diagnostic imaging (radiology, pathology)
• AI for clinical decision support
• AI in software-as-a-medical-device (SaMD)
• AI in embedded device firmware

The Annex II tranche is expected to apply from 2 August 2028 (postponed under the Digital Omnibus, agreed May 2026 and pending formal adoption) — a year after the main 2 December 2027 date — to align with the MDR’s certification cycles.

Path 2 — Annex III point 5 (essential public services & benefits)

Annex III point 5 covers AI used by public authorities (or on their behalf) to evaluate eligibility for essential public assistance benefits and services — including healthcare — and to grant, reduce, revoke, or reclaim them. It also covers emergency dispatch and urgent-care triage (NHS-style “111” triage bots, ambulance dispatch optimisation), and access to public benefits, credit, and insurance.

It does not automatically catch all healthcare AI — only AI that determines access to healthcare or its allocation. A diagnostic AI used by a clinician doesn’t fall in point 5 unless it gates access to care. Most NHS-equivalent national systems are covered here when they use AI to decide entitlement. (Annex III point 6 is law enforcement, not benefits.)

The MDR overlap

Software as a Medical Device under MDR Class IIa, IIb, or III requires a notified-body conformity assessment regardless of the AI Act. From 2 August 2028, the AI Act adds AI-specific requirements on top of the MDR’s existing essential safety and performance requirements.

Practical implications:

• Your existing notified body for MDR is likely also designated for the AI Act (the lists overlap heavily)
• Your technical documentation for MDR Annex II already covers much of the AI Act’s Annex IV
• Your QMS under ISO 13485 already overlaps with the AI Act’s Article 17 requirements
• The risk-management process under ISO 14971 overlaps with the AI Act’s Article 9

The MDR and AI Act don’t replace each other. They overlap. Your conformity assessment from 2028 will address both regimes in one filing where possible.

What healthcare AI providers owe

For medical-device AI under Annex II:

1. MDR conformity assessment by notified body (already in force)
2. AI Act conformity assessment under Annex VII (third-party) from 2 August 2028
3. Technical documentation addressing both regimes
4. Risk management integrating ISO 14971 and Article 9 of the AI Act
5. Post-market surveillance under MDR Article 83 + AI Act Article 72
6. Vigilance reporting under MDR Article 87 + AI Act Article 73
7. CE marking carrying both regulatory bases

For non-device healthcare AI (Annex III point 5 — emergency dispatch, etc.):

1. Standard Annex III obligations apply — see the compliance checklist
2. National healthcare-specific authorisation may also apply
3. Coordination with the relevant supervisory authority — typically a competent ministry or health-tech regulator

What healthcare deployers owe

Hospitals, clinics, insurers, and other deployers of high-risk healthcare AI:

• Article 26 deployer obligations (instructions for use, human oversight, monitoring, logging, transparency)
• Article 27 FRIA mandatory for public-sector deployers and certain regulated private-sector deployers
• National healthcare data-protection law (typically a stricter overlay on top of GDPR)
• Clinical-governance frameworks (national clinical safety standards)

The clinical-decision-support boundary

A frequent question: when is AI a “decision support tool” that doesn’t count as a medical device vs. when does it become a regulated SaMD?

The MDCG 2019-11 guidance is the reference. In short:

• AI providing information without recommending an action — typically not a medical device
• AI providing information that supports a clinical decision — typically a medical device (Class IIa+)
• AI providing automated diagnosis — typically a medical device (Class IIb+)
• AI providing direct treatment without clinician review — typically a medical device (Class III)

For the AI Act, even a “non-device” decision-support tool may be Annex III point 5 if it gates access to care.

What to do this quarter

Healthcare AI vendor (MDR + AI Act):

1. Confirm device classification — Class I, IIa, IIb, or III — and the corresponding conformity-assessment route
2. Map existing MDR documentation onto Annex IV — most provider-side material already exists
3. Engage your notified body on the AI Act add-on — most are scoping out their AI Act capacity through 2026
4. Plan for 2 August 2028 — same notified body, expanded scope, longer assessment cycle

Healthcare deployer (hospital, insurer):

1. Inventory clinical AI — every model in radiology, pathology, decision support
2. Demand AI Act readiness commitments from each vendor — for systems coming due in 2028
3. Set up the FRIA for high-risk AI in care-allocation roles
4. Update patient-facing disclosures — “AI is part of your diagnostic workflow”

The 2028 date — backwards-plan now

The Annex II tranche of the AI Act is expected to apply from 2 August 2028. Medical-device certification cycles run 1–3 years. If you have an AI product hitting market in 2029 or refreshing its CE mark in 2028, you need to be in dialogue with your notified body by Q4 2027. Capacity is constrained.

Where Maditon fits

Healthcare-specific obligations are coming — the MedDev module is on our roadmap. In the meantime, Maditon’s core compliance dossier already captures the AI Act-specific layer. For MDR-side documentation, integrate with your existing QMS tooling and the AI Act dossier serves as a complement, not a replacement.