4 Things You Should Know about the AI Act as a Medical Device Manufacturer

Many of us remember the early-2000’s comedy Not Another Teen Movie. When medical device manufacturers first hear about the EU AI Act, a similar thought often comes to mind: Not yet another regulation.

The reaction is understandable. Medical devices are already among the most highly regulated products on the market. Manufacturers must comply with the Medical Device Regulation (MDR) or In Vitro Diagnostic Regulation (IVDR), numerous harmonised standards, guidance documents, and country-specific requirements. Although regulatory frameworks across global markets share many similarities, each comes with its own nuances that require careful attention.

Introducing another regulation can feel like yet another compliance burden: analysing new requirements, updating procedures, creating additional documentation, expanding risk management activities, potentially involving Notified Bodies in new ways, and extending the scope of internal and external audits.

Before dismissing the AI Act as “just another regulation,” however, it is worth taking a closer look. Many of its requirements will already be familiar to medical device manufacturers. In many cases, the AI Act builds on existing principles rather than introducing entirely new ones.

That does not mean there is nothing new to learn. The AI Act introduces additional expectations, particularly around data governance, transparency, algorithm performance, bias management, and ongoing monitoring of AI systems. Understanding where these new requirements complement existing MDR obligations – and where they go beyond them – is key to achieving efficient compliance.

This blog explores four things medical device manufacturer should know about the EU AI Act, highlighting the familiar concepts.

1. You already know how to work with regulations

The great advantage that medical device manufacturers already have is that they are used to work with regulations. Many requirements are already partially fulfilled with the documentation and process required by MDR and IVDR. Most manufacturers have a working quality management system in place and have established processes. Every decision with a medical devices is risk-based following a risk management process and documented in a risk management file. The technical documentation required by MDR and IVDR provides a solid basis to integrate the additional documentation requirements of the AI act.

IEC 62304 gives a practical framework on how to develop medical device software. This framework can be adopted to AI when it comes to design controls and traceability. Guidance on how to apply the risk management process can be found in the ISO/TS 24971-2 and AAMI TIR 34971. There is already guidance available and there is no need to reinvent the wheel.

ISO/IEC 42001:2023 Information technology — Artificial intelligence — Management system provides a framework for establishing a QMS for AI systems manufacturer.The requirements are similar to the requirements of ISO 13485.

So instead of dealing with a completely new topic medical device manufacturers have to perform a gap assessment rather than introducing new processes and deliverables. Quality managers could use the AI act ​​gap analysis as an opportunity to conduct a review of the existing process with the respective process owners. In the process, not only are gaps identified, but potentially also the occasional imprecise or outdated process descriptions eliminated. The primary frustration among medical device manufacturers regarding the AI ​​Act stems largely from the fact that there is yet another new regulation that must be considered and evaluated, and then integrated into the Quality Management System and technical documentation.

2. Another classification scheme

Another topic that medical device manufacturers are already familiar with is classification. There are various classifications like EU, US, Canadian, Australian classification, software safety classification, documentation level classification that medical device manufacturers already know, so another classification is nothing to worry about. The AI Act defines two classes of devices: low risk and high risk devices. The classification rules are defined in article 6 of the AI act.

From a medical device point of view the AI act defines that medical devices and in-vitro medical devices that may impact patient safety are considered high risk AI systems. An additional criteria defines that devices that require a conformity assessment by a notified body are also considered high risk. The decision tree is quite clear and medical device manufacturers need to focus on the intended use of their AI and its relevance for safety. Annex III of the AI act defines some exceptions of AI systems that are also considered high risk, but medical devices are not mentioned there. Therefore, medical device manufacturers can ignore Annex III for now.

Even relatively simple AI functionality embedded in a medical device can trigger the full set of High-Risk AI requirements. This feels a bit off in medical device sector, to treat devices with great impact on safety the same as devices with low impact. Especially when the issue with rule 11 of the MDR classification is considered. As rule 11 makes it very hard for standalone software medical devices to be classified as class I as the rule basically requires a software that fulfills the medical device definition to be classified as clas IIa or higher.

3. The AI Act doesn’t replace MDR documentation – it builds on it

Annex II and Annex III of MDR and Annex VI of the AI act describe the required contents of the technical documentation for the respective regulation. The AI act has less requirements on the technical file and mostly requires the same contents and documents/ records as the EU MDR does.

The AI Act requirements towards technical documentation

Going through the requirements on the technical documentation of the AI, the first required documentation is about general description of the AI system, including its intended purpose, provider, version, deployment format, hardware and software requirements, interfaces with other systems, product integration where applicable, and the information necessary for users to install, operate, and interact with the system safely and as intended.

The technical documentation should describe the development and design of the AI system, including the methods used, system architecture, algorithms, design choices, optimization objectives, and any third-party components or pre-trained models involved. It should provide information on training, validation, and testing data, including data sources, selection, preparation, and quality measures, as well as details on human oversight, system changes, performance monitoring, validation procedures, accuracy, robustness, potential bias, and cybersecurity measures implemented to ensure compliance and safe operation.

Additionally a description of the risk management process, the appropriateness of performance metrics for the AI system, a description of relevant changes made by the provider to the AI system through its lifetime and a post-market surveillance process is required. Last but not least, a declaration of conformity to the AI act needs to be added in the technical documentation.