ISO 13485 · Expert · 15 min lesson

AI in medical devices I: EU AI Act high-risk obligations and the Digital Omnibus timeline

Regulation (EU) 2024/1689 Articles 6(1), 9 to 15, 11(2), 17, 43 and Annex I; Regulation (EU) 2026/1744; MDCG 2025-6

What you will learn

Explain why a medical device AI is high-risk under Article 6(1) and Annex I of the AI Act.
Audit the evidence for Articles 9 to 15 together with the MDR technical documentation.
State the dates after Regulation (EU) 2026/1744: entry into force 27 July 2026, Annex III systems 2 December 2027, product-embedded systems such as medical devices 2 August 2028.

A device AI is high-risk when it is an Annex I product needing third-party assessment (Article 6(1)); MDR class IIa and above qualify.
Audit Articles 9 to 15 as seven questions: risk, data, documentation, logs, information, oversight, performance and security.
Article 11(2) gives one technical documentation set, so map AI evidence into the MDR file and ISO 13485 system.
After Regulation (EU) 2026/1744 the date for medical devices is 2 August 2028, but design evidence is built now.
Weak records assert; compliant records name sources, methods, results and approvers.

Halden's RetinaView is MDR class IIb software and a notified body issued the certificate. The regulatory manager asks whether the AI Act applies.

Which statement can the internal auditor accept as correct?

It is a high-risk AI system because the MDR is listed in Annex I and a notified body is involved, as Article 6(1) requires.

Correct. Article 6(1) joins Annex I coverage and third-party assessment, both met by an MDR class IIb device.

It is out of scope because the MDR already regulates the product completely.

Not quite. The MDR does not exempt the product; Article 6(1) of the AI Act captures Annex I products needing a notified body.

It is high-risk only if the manufacturer registers it in an AI database first.

Not quite. High-risk status under Article 6(1) follows from the legal test and does not depend on registration.

It is high-risk only if more than half of its code is machine learning.

Not quite. Article 6(1) sets no share-of-code rule; the test is Annex I coverage and third-party conformity assessment.

high-risk AI system: An AI system captured by Article 6 of the AI Act, including an Annex I product requiring third-party conformity assessment, such as an MDR class IIa or higher device.
Annex I: The AI Act annex listing Union harmonisation legislation, including the MDR and IVDR in section A, that brings product-embedded AI into the high-risk route.
data governance: Article 10 practices for training, validation and test data sets: origin, labelling, assumptions, suitability and bias examination.
human oversight: Article 14 design measures that let natural persons understand, interpret, disregard and stop a high-risk AI system.
Digital Omnibus on AI: Regulation (EU) 2026/1744, in force 27 July 2026, which postponed application of the high-risk rules to 2 December 2027 for Annex III and 2 August 2028 for Annex I products.
record-keeping: Article 12 capability of the system to record events automatically over its lifetime for traceability and monitoring.

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Illustrative example. Educational only, not legal advice.