AI in medical devices · Medium · 14 min lesson

AI Act obligations for providers of medical device AI and the interaction with MDR notified bodies

Regulation (EU) 2024/1689 Articles 8 to 17, 43, 47, 72 and 73 with Regulation (EU) 2017/745 and MDCG 2025-6

What you will learn

List the main provider obligations of Articles 9 to 15, 17 and 43 for a high-risk medical device AI system and where each lives in the MDR system.
Explain how a notified body assesses AI Act requirements within the MDR procedure, and when a model change needs a new assessment.
Build one integrated technical file and quality system, and recognise records that would fail a notified body review.

The device manufacturer is normally the AI Act provider and carries the Article 16 duties.
Integrate Articles 9 to 15 and 17 into the existing risk file, single technical file (Article 11(2)) and ISO 13485 system.
Conformity assessment of Annex I Section A devices follows the MDR route; the notified body checks Section 2 (Article 43(3)).
Retraining needs a pre-determined change plan in the technical documentation, or it may be a substantial modification (Article 43(4)).
Evidence beats assertion: data governance reports, declared metrics, logs and approvals are what reviewers ask for.

Cardiovia wants to retrain Rhythm-Scan every quarter with new ECG data. The change was not described in the initial MDR assessment.

What should the team do about the retraining plan?

Retrain freely; the MDR certificate covers every future model.

Not quite. Article 43(4) can require new assessment for substantial modifications, so unlimited retraining is not covered by the certificate.

Define a pre-determined change plan in the technical documentation and agree it with the notified body.

Correct. Article 43(4) and Annex IV point 2(f) treat documented pre-determined changes as not substantial modifications.

Stop retraining for good.

Not quite. Nothing in the AI Act forbids retraining; it requires planned, documented control under Article 43(4).

Notify the deployer hospitals only.

Not quite. Deployer notice does not replace the provider's conformity assessment duties under Article 43(4).

data governance: Documented practices for training, validation and testing data: origin, collection, preparation, bias examination and suitability (Article 10).
human oversight: Measures that let natural persons understand, monitor, override or stop a high-risk AI system (Article 14).
substantial modification: A change after placing on the market not foreseen in the initial conformity assessment that affects Section 2 compliance or intended purpose (Article 43(4)).
pre-determined change: A change planned and documented in the technical documentation at initial assessment, so it is not a substantial modification (Annex IV point 2(f)).
post-market monitoring: Active, systematic collection of performance data over the lifetime of a high-risk AI system (Article 72).
notified body: A conformity assessment body designated under the MDR; may assess AI Act Section 2 requirements if checked against Article 31 criteria (Article 43(3)).

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Illustrative example. Educational only, not legal advice.