Medical AI · Regulation, ethics & governance · Lesson 3 of 7

The EU AI Act and medical devices

Reviewed by Dr. Ram Kumar G, MBBS, MD (Internal Medicine), MPH (USA), on 2026-10-18 · Last updated 2026-10-18

Intermediate
Clinical focus
About 25 minutes
Includes exercise

Before this lesson: Software as a Medical Device (SaMD)

In short

In the European Union, medical AI software is regulated first as a medical device under the MDR (or IVDR for diagnostics on samples). Classification Rule 11 places most software that informs diagnosis or treatment in class IIa or higher, which requires a notified body. Those devices are also high-risk AI systems under the AI Act, whose additional requirements for them apply from 2 August 2028 after the 2026 Digital Omnibus. Both sets of requirements are assessed together by the notified body.

You will learn to

Apply MDR Rule 11 to classify medical device software
Explain when MDR/IVDR software is also a high-risk AI system
Describe how MDR and AI Act requirements are assessed together
Locate the key EU guidance documents for medical device software and AI

The MDR and IVDR

The Medical Devices Regulation (EU) 2017/745 and the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 cover medical device software in the EU. MDCG 2019-11, the main guidance on qualifying and classifying software, was revised in June 2025 to clarify intended purpose, modular software and interaction with electronic health records and the European Health Data Space.

Classification Rule 11

Rule 11 in Annex VIII of the MDR is written specifically for software. Its core logic can be sketched as follows; the real rule has more detail, and MDCG 2019-11 gives worked examples.

python

def mdr_rule_11(purpose, worst_consequence=None, monitors_vital_parameters_with_immediate_danger=False):
    """Simplified sketch of EU MDR Annex VIII Rule 11 for software. Learning aid only."""
    if purpose == "decision support (diagnosis or therapy)":
        if worst_consequence == "death or irreversible deterioration":
            return "III"
        if worst_consequence == "serious deterioration or surgical intervention":
            return "IIb"
        return "IIa"
    if purpose == "monitoring physiological processes":
        return "IIb" if monitors_vital_parameters_with_immediate_danger else "IIa"
    return "I"

cases = [
    ("Retinopathy screening that decides referral", "decision support (diagnosis or therapy)",
     "serious deterioration or surgical intervention", False),
    ("Insulin dosing advice software", "decision support (diagnosis or therapy)",
     "death or irreversible deterioration", False),
    ("Medication-interaction information for prescribers", "decision support (diagnosis or therapy)",
     None, False),
    ("ICU monitor alarm software for heart rhythm", "monitoring physiological processes", None, True),
    ("Medical device software with another medical purpose", "other", None, False),
]
for name, purpose, consequence, vital in cases:
    print(f"Class {mdr_rule_11(purpose, consequence, vital):<4} {name}")

# Class IIb  Retinopathy screening that decides referral
# Class III  Insulin dosing advice software
# Class IIa  Medication-interaction information for prescribers
# Class IIb  ICU monitor alarm software for heart rhythm
# Class I    Medical device software with another medical purpose

A simplified sketch of MDR Rule 11, applied to illustrative software. Learning aid only.

Most software that informs diagnosis or treatment lands in class IIa or above, which needs a notified body's conformity assessment. That is why so much medical AI ends up 'high-risk' under the AI Act.
The worst-case consequence assigned to each example is a teaching assumption; real classification depends on the intended purpose and the manufacturer's risk analysis.

Where the AI Act comes in

Under Article 6(1) of the AI Act, an AI system that is a medical device (or a safety component of one) needing third-party conformity assessment is a high-risk AI system. After the Digital Omnibus, Regulation (EU) 2026/1744, these obligations apply from 2 August 2028. Medical devices remain fully in scope, but the Commission may limit specific AI Act requirements by implementing act where the MDR or IVDR already give equivalent protection.

The detailed timeline, the provider and deployer duties, and what changed in 2026 are covered in the article linked below.

Requirement area	MDR / IVDR	AI Act adds
Risk management	Required	Includes risks to fundamental rights
Data	Clinical evaluation data	Data governance: relevance, representativeness, bias examination
Records	Technical documentation	Automatic event logging
People	Instructions for use	Design for effective human oversight; AI literacy for staff
Assessment	Notified body for class IIa and above	Assessed by the same notified body, if designated under the AI Act

Not legal or regulatory advice

This lesson explains regulation for learning purposes, as of October 2026. Rules and guidance change; whether a real product is a medical device, and how it is classified, depends on its intended purpose and needs qualified regulatory advice and the current official texts.

Exercise

Classify fictional medical AI products under MDR Rule 11 and identify their AI Act obligations.

Data: Fictional product descriptions written for the notebook (Created for this course)

Extend the Rule 11 sketch with the 'all other software is class I' and monitoring sub-rules, and test it on eight fictional products.
For each product of class IIa or above, list the AI Act requirements that would apply from 2 August 2028.
Find the example in MDCG 2019-11 closest to each product and compare your classification.
Write a short note on whether any product could fall under Annex III of the AI Act instead (for example emergency triage).

The runnable notebook and worked solution will be published soon. You can work through the steps with the code on this page in the meantime.

Key takeaways

EU medical AI software is regulated as a medical device under the MDR or IVDR first.
Rule 11 puts most diagnosis and treatment software in class IIa or higher.
Such devices are high-risk AI systems; AI Act duties for them apply from 2 August 2028.
One notified body assesses both sets of requirements.

Terms used: Intended purpose (intended use), SaMD (Software as a Medical Device)

FAQ

What is MDR Rule 11?

The MDR classification rule for software. Software providing information used for diagnosis or therapy is class IIa, rising to IIb or III where decisions could cause serious deterioration or death; monitoring software is IIa or IIb; other software is class I.

Is all medical AI high-risk under the EU AI Act?

Medical device AI that needs a notified body (class IIa and above under the MDR) is high-risk. Lower-risk devices and non-device tools generally are not, though transparency and AI literacy duties may still apply.

When do the AI Act's requirements apply to medical devices?

From 2 August 2028 for high-risk AI in medical devices, following the Digital Omnibus (Regulation (EU) 2026/1744).

Do manufacturers need two separate certifications?

No. The notified body assesses AI Act requirements as part of the MDR or IVDR conformity assessment, if it is designated for both.

Where is the official guidance on software classification?

MDCG 2019-11 (revised June 2025) on qualification and classification of software, and MDCG 2025-6 on the interplay between the MDR, IVDR and AI Act.

Sources

Educational content only. This material teaches methods; it is not clinical advice. Code, models and examples here are not validated medical devices and must not be used to make decisions about real patients without proper clinical validation, governance and any required regulatory approval. Examples use synthetic or openly licensed de-identified data only. Never paste identifiable patient information into public AI tools. Mentions of models, tools or vendors are for identification, not endorsement.