What the EU AI Act means for clinical AI tools (as of October 2026)

Reviewed by Dr. Ram Kumar G, MBBS, MD (Internal Medicine), MPH (USA), on 2026-10-18 · Last updated 2026-10-18

In short

Under the EU AI Act, AI software that is a medical device needing a notified-body assessment, which covers most diagnostic and treatment-support software, is a high-risk AI system. After the Digital Omnibus (Regulation (EU) 2026/1744), the high-risk duties for these devices apply from 2 August 2028, and for stand-alone high-risk uses such as emergency triage from 2 December 2027. Some rules already apply, including AI literacy, the bans on prohibited practices and, since 2 August 2026, telling people when they are talking to an AI system.

The AI Act in brief

The Artificial Intelligence Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024. It regulates AI systems by risk: some practices are banned, 'high-risk' systems face detailed requirements, some systems carry transparency duties, and providers of general-purpose AI models (such as large language models) have their own obligations.

It applies to providers who place AI systems on the EU market and to deployers who use them in the EU, wherever the provider is based. A developer in India, the US or the UK whose tool is used in EU hospitals is in scope.

When is a clinical AI tool high-risk?

There are two routes. The first, which covers most clinical AI, is Article 6(1): an AI system is high-risk if it is a product, or a safety component of a product, covered by the EU laws listed in Annex I, and that product must undergo a third-party conformity assessment. The Medical Devices Regulation (MDR, 2017/745) and the In Vitro Diagnostic Regulation (IVDR, 2017/746) are on that list.

Under the MDR, software that provides information used for diagnostic or therapeutic decisions is usually class IIa or higher (classification Rule 11), and those classes need a notified body. So most AI medical device software is high-risk under the AI Act. The second route is Annex III, which lists stand-alone high-risk uses; for healthcare it includes systems for emergency healthcare patient triage and for evaluating eligibility for essential public services, including healthcare.

Illustrative only. Classification depends on the manufacturer's stated intended purpose and needs regulatory advice for any real product.
Tool	Likely status	Why
AI that detects diabetic retinopathy on retinal photographs	High-risk (Annex I route)	Medical device for diagnosis; class IIa or above needs a notified body
Emergency department triage-priority model	High-risk (Annex III route), and possibly also a medical device	Annex III lists emergency healthcare patient triage
Ambient scribe that drafts notes for clinician review	Depends on intended purpose	If it only transcribes and drafts documentation, it may not be a medical device; claims about diagnosis or treatment change this
Patient-facing chatbot for appointment booking	Not high-risk; transparency duties apply	Users must be told they are interacting with an AI system
Bed-management or scheduling optimiser	Usually not high-risk	No medical purpose and not listed in Annex III

The timeline after the 2026 Digital Omnibus

In 2026 the EU amended the AI Act through the Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Its main effect was to postpone the high-risk obligations, because the harmonised standards and guidance needed to comply were not ready.

As of October 2026, after Regulation (EU) 2026/1744. Check the consolidated text on EUR-Lex for later changes.
Date	What applies
1 August 2024	AI Act enters into force
2 February 2025	Bans on prohibited practices; AI literacy duty for providers and deployers
2 August 2025	Obligations for providers of general-purpose AI models
2 August 2026	Most remaining provisions, including Article 50 transparency duties (such as telling people they are interacting with AI) and penalties
2 December 2026	New bans on generating non-consensual intimate imagery and child sexual abuse material; marking duty for generative systems already on the market
2 December 2027	High-risk obligations for Annex III systems, such as emergency triage (previously 2 August 2026)
2 August 2028	High-risk obligations for AI in Annex I products, including medical devices and IVDs (previously 2 August 2027)

Older guidance uses the old dates

Documents published before July 2026, including the MDCG 2025-6 FAQ on the interplay between the MDR, IVDR and AI Act, refer to the original August 2026 and August 2027 dates. Their explanations of how the laws fit together remain useful; their deadlines do not.

Medical devices stay in scope

In December 2025 the European Commission proposed a targeted revision of the MDR and IVDR (COM(2025) 1023). Among other things, it would have moved the MDR and IVDR to Section B of Annex I, which would largely have left AI medical devices to medical-device law alone. The Parliament and Council did not adopt that change in the Digital Omnibus: medical devices remain in Annex I Section A and fully subject to the AI Act's high-risk rules.

Instead, the omnibus empowers the Commission to limit the application of specific AI Act requirements, through implementing acts, where the MDR or IVDR already ensure an equivalent level of protection. As of October 2026 no such act had been adopted for medical devices, and the MDR/IVDR revision itself was still going through the legislative process.

What providers of high-risk systems must do

For a manufacturer of an AI medical device, the AI Act adds requirements on top of the MDR or IVDR. Most map onto existing medical-device processes, and the conformity assessment is meant to be carried out once, by the notified body, covering both laws.

A risk-management system covering risks to health, safety and fundamental rights across the life cycle (Article 9).
Data governance: training, validation and test data that are relevant, sufficiently representative and examined for possible biases (Article 10).
Technical documentation and automatic logging of events so the system's operation can be traced (Articles 11–12).
Instructions for use that let deployers understand the system's capabilities and limits (Article 13).
Design for effective human oversight (Article 14), and appropriate accuracy, robustness and cybersecurity (Article 15).
A quality-management system and post-market monitoring, which can be integrated with the MDR/IVDR quality system (Articles 17 and 72).

What hospitals and clinicians must do

Hospitals and clinics using a high-risk AI system are 'deployers'. When the high-risk rules apply, their main duties under Article 26 are to use the system according to its instructions, assign human oversight to staff with the necessary competence, training and authority, monitor its operation and report serious incidents, keep the logs it generates for at least six months, and inform staff when it is used in their work.

Some duties already apply. Since February 2025, providers and deployers must take measures to support AI literacy among staff who operate or use AI systems; the 2026 omnibus reworded this as a duty to take measures rather than to guarantee a particular level. Since August 2026, patients must be told when they are interacting directly with an AI system, such as a chatbot, unless it is obvious.

Which part of the AI Act is likely to apply to a clinical AI tool?

Is it intended for a medical purpose, such as diagnosis or treatment support?
- If Yes
  1. Does it need a notified-body assessment under the MDR or IVDR?
    If Yes
    High-risk: obligations apply from 2 August 2028
    If No
    Not high-risk via medical-device law; check Annex III and transparency duties
- If No
  1. Is it used for emergency triage or deciding eligibility for healthcare services?
    If Yes
    High-risk (Annex III): obligations apply from 2 December 2027
    If No
    Not high-risk: AI literacy and any transparency duties still apply

Simplified for learning, as of October 2026. Real classification depends on intended purpose and needs regulatory advice.

Large language models in clinical use

The companies that build general-purpose models have their own obligations, in force since August 2025, covering technical documentation, copyright policies and, for the largest models, systemic-risk assessment. A hospital or developer that builds a tool on top of such a model is the provider of that tool. If the tool is intended for a medical purpose, it can be a medical device and therefore high-risk, regardless of the model underneath.

Patient-facing assistants must disclose that they are AI. Whatever the legal status, identifiable patient information should only be processed in systems approved for clinical data under the GDPR and local rules.

What to do now

Developers: write down each product's intended purpose and likely MDR/IVDR class now, because it decides the AI Act route. Build data-governance, logging and human-oversight evidence into development rather than adding it in 2028.
Developers outside the EU: if the tool will be used in the EU, the Act applies to you; plan for an authorised representative and EU conformity assessment.
Hospitals: keep an inventory of AI systems in use, with their intended purpose, provider and risk category, and put an AI-literacy programme in place for staff, since that duty already applies.
Everyone: track the implementing acts on MDR/IVDR equivalence, the harmonised standards, and the progress of the MDR/IVDR revision. They could change what is required before 2028.

Not legal advice

This article explains the regulation for learning purposes, as of October 2026. Product classification and compliance decisions need qualified regulatory and legal advice and the current consolidated legal text.

FAQ

Is all medical AI high-risk under the EU AI Act?

No. AI medical devices that need a notified-body assessment under the MDR or IVDR, which covers most diagnostic and treatment-support software, are high-risk. Administrative tools, and devices in the lowest class that self-certify, are generally not high-risk through that route.

When do the high-risk rules apply to AI medical devices?

From 2 August 2028, after the Digital Omnibus (Regulation (EU) 2026/1744) postponed the original 2 August 2027 date. Stand-alone Annex III high-risk systems, such as emergency triage, follow from 2 December 2027.

Do medical devices need two separate conformity assessments?

No. The AI Act requirements are assessed as part of the existing MDR or IVDR conformity assessment by the notified body, provided that body is also designated under the AI Act.

Does the AI Act apply to companies outside the EU?

Yes, if they place an AI system on the EU market or its output is used in the EU. Non-EU providers of high-risk systems must appoint an authorised representative in the EU.

What does a hospital need to do today?

Take measures to support AI literacy among staff who use AI systems, and make sure patients are told when they interact directly with an AI system. Preparing an inventory of AI tools in use also makes the later high-risk duties easier to meet.

What happened to the proposal to take medical devices out of the AI Act?

The Commission's December 2025 MDR/IVDR revision proposed it, but the Digital Omnibus kept medical devices fully in scope. Instead, the Commission may limit specific requirements by implementing act where medical-device law already gives equivalent protection.

Sources

Educational content only. This material teaches methods; it is not clinical advice. Code, models and examples here are not validated medical devices and must not be used to make decisions about real patients without proper clinical validation, governance and any required regulatory approval. Examples use synthetic or openly licensed de-identified data only. Never paste identifiable patient information into public AI tools. Mentions of models, tools or vendors are for identification, not endorsement.