Under Article 6(1) of the EU AI Act, an AI system is high-risk when it is a product, or a safety component of a product, covered by Annex I legislation that requires a third-party conformity assessment. EU MDR and EU IVDR are listed in Annex I, so AI in a device that needs a Notified Body is in scope.
AI in a device that does not need a Notified Body is not high-risk under this route. For these products, the high-risk requirements apply from 2 August 2028, after the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved the date from 2 August 2027. The classification rule is in AI Act Article 6.
Article 17 of the EU AI Act requires providers of high-risk AI systems to maintain a documented quality management system. Providers that already run a QMS under sector law, such as ISO 13485 for medical devices, can build the AI Act elements into that system instead of running a second one.
ISO 13485 does not address AI-specific risks on its own. EN 18286:2026 is the first harmonized standard cited under the AI Act, through Commission Implementing Decision (EU) 2026/2274 of October 2026, and applying it gives a presumption of conformity with the Article 17 requirements it covers. Our blog explains what EN 18286 means for your ISO 13485 system.
Article 10 of the EU AI Act sets requirements for the data used to train, validate and test high-risk AI systems. Data sets should be relevant to the intended purpose, sufficiently representative and, as far as possible, free of errors and complete. Providers must record where the data came from, how it was prepared, and examine it for bias.
In QMS terms, data management should run as a controlled process, and any change to data or to a model should go through change control. The requirement is in AI Act Article 10.
High-risk AI systems under the EU AI Act need technical documentation (Article 11, Annex IV), automatic logging of events (Article 12), instructions for use with clear information for users (Article 13), human oversight measures (Article 14), and an appropriate level of accuracy, robustness and cybersecurity (Article 15).
For devices under EU MDR or EU IVDR, one set of technical documentation can cover both the AI Act and the device regulation (AI Act Article 11(2)). Our AI regulatory support covers how to build it.
Providers of high-risk AI systems must run a post-market monitoring system for the AI system (Article 72 of the EU AI Act) and report serious incidents (Article 73). Where a post-market surveillance system already exists under EU MDR or EU IVDR, the provider can extend it instead of building a second one.
Define what triggers a review after release, for example performance drift, new data or retraining, and keep a record of each decision. For more on how auditors look at this, see our blog on AI audits for medical devices beyond ISO 13485.
Qserve helps medical device and IVD manufacturers close the gaps this quiz finds, from QMS gap assessments to technical documentation and Notified Body readiness.
Does the AI Act require a separate conformity assessment for my device?
No. For devices under EU MDR or EU IVDR, the AI Act requirements are assessed as part of the existing conformity assessment (AI Act Article 43(3)). You do not follow a separate route, but your technical documentation and QMS must show that the AI requirements are met.
Is EN 18286 mandatory?
No. EN 18286:2026 is a voluntary European standard developed by CEN and CENELEC. A provider can show compliance with the AI Act in other ways, but a QMS built on the standard benefits from a presumption of conformity with the Article 17 requirements it covers.
What is the Team-NB questionnaire on AI?
It is a questionnaire on AI in medical devices published jointly by Team-NB, the European association of Notified Bodies, and IG-NB, the German Notified Bodies alliance. It takes a process-oriented approach to AI-based devices under EU MDR and EU IVDR. The questionnaire states that the AI Act was not considered and is to be covered in a later revision.
Do EU MDR and EU IVDR already apply to AI software today?
Yes. Software that qualifies as a medical device, including AI software, has to meet the MDR or IVDR requirements now. The AI Act adds its high-risk requirements for these products from 2 August 2028.
Does a good score mean my QMS meets the AI Act?
No. The quiz is a short self-check that shows where to look first. It is not a conformity assessment and not an opinion of a Notified Body.
Check out all of our free self-assessment tools for medical device and IVD compliance
.png)
Know if your device needs a clinical investigation under MDR, and how ISO 14155:2026 shapes the study. Learn the exemptions, pitfalls and next steps.
.png)
Missing the 28 November EUDAMED deadline puts your devices at risk of non-compliance. Learn what’s at stake and how to get your data submitted in time.
.png)
Learn how to structure a PMCF plan under the EU MDR. Walk through sections A to G of MDCG 2020-7 and avoid four common pitfalls before your Notified Body does.