EU AI Act Compliance for Healthcare AI
EU AI Act compliance guide for healthcare and medical device AI systems, covering high-risk classification and MDR interplay.
Healthcare AI systems face dual compliance frameworks: the EU AI Act and Medical Device Regulation (MDR) or In Vitro Diagnostic Regulation (IVDR).
If your AI system is a safety component of, or classifies as, a medical device under MDR/IVDR, it automatically qualifies as high-risk under the EU AI Act. This means combined conformity assessment, integrated risk management, and notified body involvement.
How Healthcare AI Gets Classified
Most diagnostic and clinical decision support AI systems fall under Annex I of the EU AI Act by virtue of MDR/IVDR classification. Class IIa devices and above typically require notified body conformity assessment, triggering automatic high-risk status.
Risk Management is Non-Negotiable
Healthcare AI risk management must be integrated with ISO 14971 (MDR standard). Article 9 of the EU AI Act requires documented risk identification, mitigation, and residual risk acceptance by qualified personnel.
Human Oversight Prevents Automation Bias
Article 14 mandates meaningful human oversight for high-risk AI. In healthcare, clinicians must understand AI recommendations, be trained to override them, and have authority to do so—especially for life-critical decisions.
Healthcare AI Categories
Diagnostic Imaging AI
Radiology, pathology, and medical imaging analysis. These are almost always Class IIa or higher under MDR, requiring notified body involvement and full EU AI Act high-risk compliance.
Clinical Decision Support Systems
AI that assists clinicians in diagnosis or treatment recommendations. Classification depends on intended use; many qualify as Class IIb or IIa under MDR, triggering high-risk EU AI Act obligations.
AI-Based Triage and Early Warning Systems
Predictive AI for patient prioritization or deterioration alerts. Often Class IIa under MDR if they influence clinical decisions; subject to high-risk conformity assessment under the EU AI Act.
EU AI Act × MDR/IVDR Overlap
Healthcare AI conformity assessment can be streamlined by combining EU AI Act and MDR/IVDR procedures with a single notified body, provided the body is qualified for both regimes.
A single notified body can assess both MDR and EU AI Act requirements simultaneously. This reduces duplication and timelines when your AI system qualifies as high-risk under both.
EU AI Act risk management (Article 9) must align with MDR risk management (ISO 14971). Many organizations integrate both frameworks into a single risk analysis and mitigation plan.
MDR technical documentation requirements substantially overlap with EU AI Act technical file requirements (Article 11). Single documentation can satisfy both.
In Vitro Diagnostic devices under IVDR 2017/746 follow the same high-risk classification logic as MDR. AI-based pathology or laboratory analysis systems must comply with both IVDR and the EU AI Act.
Real-World Healthcare AI Examples
AI Radiology Diagnostic Tool
A deep learning system that analyzes X-rays and CT scans to detect fractures, lesions, or abnormalities.
MDR classification: typically Class IIa (if notified body involvement); EU AI Act: high-risk. Requires risk management per ISO 14971, clinical validation data, human-in-the-loop oversight protocols, and cybersecurity documentation.
AI-Based Sepsis Prediction System
An algorithm that predicts sepsis risk based on vital signs, lab values, and patient history to trigger early intervention.
MDR: Class IIa for decision support; EU AI Act: high-risk. Requires clinical accuracy validation, human oversight by trained clinicians, risk management for automation bias, and audit logging.
AI Pathology Slide Analysis
Digital pathology system using AI to analyze microscopy images for cancer, infection, or tissue classification.
IVDR classification: typically Class D (in vitro diagnostic); EU AI Act: high-risk. Requires analytical and clinical validation, integration with pathologist workflows, and traceability documentation.
AI Triage and Prioritization Tool
An AI system that prioritizes emergency department patients based on acuity and predicted outcomes.
MDR: Class IIa as clinical decision support; EU AI Act: high-risk. Requires fairness and bias testing, documented thresholds for clinician override, and performance monitoring across patient populations.
Healthcare AI Compliance Checklist
euAiAct.industryHealthcare.checklist1Desc
euAiAct.industryHealthcare.checklist2Desc
euAiAct.industryHealthcare.checklist3Desc
euAiAct.industryHealthcare.checklist4Desc
euAiAct.industryHealthcare.checklist5Desc
euAiAct.industryHealthcare.checklist6Desc
euAiAct.industryHealthcare.checklist7Desc
euAiAct.industryHealthcare.checklist8Desc
Key Compliance Deadlines
MDR already in force. Devices placed on market today must comply. EU AI Act enforcement for high-risk healthcare AI begins 2 December 2027 for Annex III systems, or 2 August 2028 for AI that is a safety component of a medical device regulated under MDR/IVDR (the Annex I route).
Deadline for EU AI Act compliance for existing high-risk systems. Healthcare AI systems with MDR classification as Class IIa or above must be compliant by this date.
Post-enforcement, expect notified body audits, market surveillance, and periodic technical file updates as clinical evidence and regulations evolve.
Enforcement and Penalties
Non-compliance carries fines up to €15 million or 3% of global annual turnover (whichever is higher). Healthcare regulators (notified bodies, competent authorities) conduct ongoing surveillance. Breaches can result in market withdrawal, recalls, or suspension of CE marking.
Frequently Asked Questions
Related Requirements and Articles
Article 9: Risk Management
Healthcare AI risk management must follow ISO 14971 (MDR standard) and be documented in a formal risk management report. Residual risks must be evaluated and mitigated.
Article 14: Human Oversight
Clinicians must receive training on AI limitations, have clear procedures to override AI recommendations, and retain decision-making authority. AI-assisted workflows must not create automation bias or deskilling.
Article 11: Technical Documentation
Healthcare AI requires detailed technical documentation covering model architecture, training data, validation results, performance on different patient populations, and cybersecurity measures.
Compliance Checklist
Verify MDR/IVDR classification, integrate ISO 14971 risk management, document data governance and bias testing, define human oversight workflows, and begin notified body engagement for conformity assessment.
How Scanara Helps
Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.