EU AI Act Compliance for Medical Devices: 10 Key Steps for MedTech Manufacturers

1. Perform an AI System Inventory & Risk Classification

Begin by auditing your entire product portfolio to identify embedded AI/ML algorithms or standalone SaMD features. Classify each system against the EU AI Act risk criteria. If your device requires Notified Body assessment under EU MDR/IVDR, register your high-risk AI system in the official EU database.

2. Integrate AI Obligations into Your Quality Management System (QMS)

Article 17 of the EU AI Act mandates a comprehensive AI Quality Management System. Rather than creating a standalone framework, adapt your existing ISO 13485 Quality Management System (QMS) to incorporate AI-specific requirements, including continuous data governance, algorithm change control, and lifecycle performance verification.

3. Build Comprehensive Annex IV Technical Documentation

Develop robust technical files satisfying Annex IV of the AI Act alongside your EU MDR/IVDR technical documentation. Documentation must thoroughly detail:

• System architecture, design choices, and algorithmic logic.

• Training, validation, and testing dataset provenance.

• Hardware resource requirements and energy efficiency metrics.

• Performance validation against clinical safety benchmarks.
  
  

4. Establish a Dynamic Risk Management System (ISO 14971)

Align your risk management processes with ISO 14971 while expanding them to address AI-specific hazards. Your risk matrix must systematically identify, evaluate, and mitigate risks relating to algorithmic bias, dataset drift, cybersecurity vulnerabilities, and potential threats to patient health, safety, and fundamental rights.

5. Enforce Strict Data Governance & Bias Mitigation

Under Article 10 of the AI Act, training, validation, and testing datasets must meet rigorous quality criteria. Medical device manufacturers must ensure:

• Datasets are relevant, representative, and free of systemic bias across demographic groups.

• Data collection accounts for geographic, clinical, and environmental variations.

• Strict data privacy policies comply with GDPR alongside device regulation.
  
  

6. Design for Transparency and Human Oversight

High-risk AI systems cannot function as unexplainable “black boxes.” Implement explainable AI (XAI) principles so clinical users understand how outputs are generated. Incorporate human oversight mechanisms (Human-in-the-Loop or Human-on-the-Loop) to enable clinicians to override, pause, or adjust AI outputs safely.

7. Establish AI Incident Reporting & Post-Market Surveillance (PMS)

Update your post-market surveillance (PMS) and vigilance procedures to detect algorithmic performance degradation, data drift, or security flaws post-launch. Serious AI incidents must be reported to competent authorities in accordance with both EU AI Act timelines and MDR vigilance requirements.

8. Conduct a Fundamental Rights Impact Assessment (FRIA)

Where required by deployer or provider obligations, evaluate how your medical AI impacts patient rights, non-discrimination, data privacy, and informed consent. Document potential societal or individual risks and establish verifiable mitigation strategies.

9. Appoint an EU Authorized Representative (EAR)

Non-EU medical device manufacturers must designate a legal EU Authorized Representative located within an EU member state. Your EAR represents your firm before national competent authorities and ensures full regulatory accountability under both the EU AI Act and EU MDR/IVDR.

10. Complete Integrated Conformity Assessment with Notified Bodies

Work with your designated Notified Body to conduct a unified conformity assessment covering both medical device requirements (MDR/IVDR) and high-risk AI criteria. Ensure your technical files, CE declaration of conformity, and CE marking reflect dual compliance before market placement.