UE NEWS

Simon Medtech Solutions

Navigating the EU AI Act

The EU AI Act (Regulation (EU) 2024/1689) marks a significant step in regulating Artificial Intelligence (AI) across the European Union. It aims to govern the placement on the market and use of AI systems, particularly those posing high risks to individuals.

AI is transforming healthcare by processing vast amounts of data. It supports diagnosis, assists in treatment, automates administrative tasks, and allows professionals to refocus on patient care. However, this promise comes with challenges. Unlike traditional software with established development methods, AI systems are often less transparent, requiring new validation approaches.

To address these challenges, the European legislator introduces specific AI requirements to ensure safety, performance, and risk management throughout the medical device lifecycle. Simon Medtech Solutions addresses key questions manufacturers have about AI Act compliance.

Answers to your Questions

Which devices must comply with the AI Act?

The AI Act is a horizontal regulation. Unlike the MDR (applying to all « medical devices ») or IVDR, it specifically targets AI technology across all sectors. Devices incorporating AI must comply with both sets of regulations.

To determine if an AI system falls under the AI Act, two key conditions must be verified:

Definition of an AI System: The core definition hinges on a system that can infer how to generate outputs (predictions, content, recommendations, decisions) from inputs, adjusting its own parameters through learning. This encompasses machine learning, deep learning, and related approaches, covering over 99% of current AI uses under the regulation.
Risk Classification: Most AI systems developed by device manufacturers will be classified as high-risk if two conditions are met:
- The AI system is the device itself or is a safety-critical component of a device.
- The device requires a conformity assessment by a Notified Body (i.e., is not Class I or A).

General-purpose AI models (like ChatGPT) are less relevant for dedicated medical devices due to reliability and specialization concerns and will be overseen directly by the European Commission.

Does this new regulation pose an additional challenge so soon after MDR/IVDR?

Many AI Act requirements align with existing practices under MDR/IVDR, allowing manufacturers to leverage current quality management systems and technical documentation. The conformity assessment will be conducted simultaneously by a Notified Body for both regulations, resulting in a single CE certificate.

The primary preparation effort will involve adapting AI systems to meet specific technical requirements of the AI Act and documenting evidence. Key areas include:

Cybersecurity (e.g., addressing data poisoning risks).
Transparency (ensuring users know they are interacting with AI and can interpret results safely).
Human oversight (ensuring healthcare professionals remain in control).
Documentation of training data.
Model testing and validation.

While established standards exist for MDR/IVDR, harmonized standards for the AI Act are still under development, meaning the normative state of the art is still being defined.

How are AI-based medical devices currently evaluated, and how to prepare for the AI Act?

Even without fully established AI Act standards, Notified Bodies have been certifying AI-based devices under MDR/IVDR for years, based on robust risk analysis and demonstrations of safety and performance. This foundational approach will remain relevant. Manufacturers and Notified Bodies must maintain active vigilance regarding evolving standards and guidelines to ensure a smooth, progressive integration of the new AI Act requirements.

What is the implementation timeline for the AI Act in the medical device sector?

The key date is August 2, 2027, when high-risk AI system requirements become applicable. From this date, significant changes to already certified AI devices or new high-risk AI devices placed on the market must comply with the AI Act. While discussions about potential timeline adjustments are ongoing due to pending guidance, manufacturers should continue compliance efforts to avoid market disruptions.

Can a certification for one AI device be reused for a second device with the same AI system?

Even with technically identical AI systems, conformity arguments cannot be automatically transferred. The intended purpose, clinical benefit, use environment, and target population may differ, directly impacting how AI Act requirements (like performance, data governance) are demonstrated and evaluated. Notified Bodies must assess each device independently. Manufacturers wishing to reuse elements must demonstrate the equivalence of the AI systems in their new context.

As the EU AI Act ushers in a new regulatory era, manufacturers of AI-driven medical technologies must adapt to stricter obligations while seizing new innovation opportunities. Early alignment with these requirements is essential to ensure safe, compliant, and market-ready products. At Simon MedTech Solutions, we provide end-to-end support — from regulatory strategy and compliance assessment to documentation, risk management, and implementation of AI governance. Our expertise helps companies navigate the EU AI Act with confidence and bring high-quality, compliant solutions to market faster.