AI in medical devices · Medium · 13 min lesson

EU AI Act structure: risk tiers, high-risk systems and the Digital Omnibus timelines

Regulation (EU) 2024/1689 Articles 4, 5, 6, 50 and 113, Annex I and Annex III, as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI)

What you will learn

Describe the four risk tiers of Regulation (EU) 2024/1689 and tell which obligations belong to each tier.
Decide whether a medical device software product is high-risk under Article 6(1) and Annex I, using the MDR or IVDR third-party assessment test.
Apply the application dates as amended by the Digital Omnibus on AI, and keep a regulatory plan that cites the current dates and fails no auditor test.

The AI Act sorts systems into four tiers; classify every AI feature separately and record the reason.
A medical device is high risk under Article 6(1) when it is covered by Annex I law and needs third-party conformity assessment.
Digital Omnibus (Regulation (EU) 2026/1744): Annex III from 2 December 2027, Annex I products from 2 August 2028.
Prohibitions, AI literacy, penalties and Article 50 transparency were not moved to 2028.
Auditors want a dated, sourced, owned register, not a remark that the Act is delayed.

At the Cardiovia review a manager says the AI Act has been delayed, so nothing is due. The regulatory lead wants an accurate answer for the minutes.

What should the team conclude about the AI Act dates?

Nothing applies until 2028, so planning can wait.

Not quite. Article 5 and Article 4 have applied since 2 February 2025, and Article 50 and penalties are not postponed to 2028.

High-risk product dates moved, but some duties already apply and the plan must separate them.

Correct. Regulation 2026/1744 moved the Annex I date to 2 August 2028 while Article 5 prohibitions already apply.

Everything moved to 2 December 2027.

Not quite. Only Annex III high-risk systems moved to 2 December 2027; Annex I products moved to 2 August 2028.

The AI Act was withdrawn by the Omnibus.

Not quite. The Omnibus amends Regulation 2024/1689 and does not repeal it, so the Act stays in force.

provider: The natural or legal person that develops an AI system, or has it developed, and places it on the market under its own name (Article 3). For a medical device this is normally the manufacturer.
deployer: A person or body using an AI system under its authority, for example a hospital (Article 3).
high-risk AI system: A system meeting Article 6(1) with Annex I, or Article 6(2) with Annex III, and therefore subject to Chapter III requirements.
Annex I Section A: List of Union harmonisation laws, including the MDR and IVDR, whose products can make an AI system high risk under Article 6(1).
Digital Omnibus on AI: Regulation (EU) 2026/1744, amending the AI Act, which moved the high-risk application dates and adjusted several provisions.
safety component: A component whose failure endangers health or safety; the Omnibus narrowed how this applies in Article 6(1).

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Illustrative example. Educational only, not legal advice.