How the EU AI Act applies to medical devices in 2026

The EU AI Act's deadlines for medical AI just moved, and if your compliance plan still uses the old ones, it is out of date. In June 2026 the Digital Omnibus was formally adopted, pushing the two dates that matter most for clinical AI to 2 December 2027 and 2 August 2028. Same obligations, later clock. That is the good news and the trap at once, because a later deadline is easy to read as a reason to stop, when it is really a reason to plan properly.

This guide is for teams building clinical AI and software as a medical device (SaMD) for the EU market. It answers four questions. What did the Digital Omnibus actually change? Is your product high risk? Which deadline is yours? And what should you do before it arrives?

Key takeaways

• The Digital Omnibus was adopted by the Council on 29 June 2026, after clearing the European Parliament earlier that month. As of early July 2026 it is awaiting publication in the Official Journal, and the revised deadlines take legal effect once it publishes.

• Standalone high-risk AI (Annex III) moves from 2 August 2026 to 2 December 2027. AI that is, or is built into, a regulated medical device (Annex I, under the MDR or IVDR) moves from 2 August 2027 to 2 August 2028.

• Under Article 6(1), an AI medical device that needs a notified body (broadly MDR Class IIa and up, IVD Class B and up) is automatically a high-risk AI system.

• The AI Act folds into your existing MDR or IVDR conformity assessment (Article 43(3)). It is not a second, separate assessment, but it does add real obligations.

• Most SaMD sits on the 2 August 2028 track, not the December 2027 one. That distinction is widely gotten wrong.

What did the Digital Omnibus actually change?

It postponed the deadlines without softening the obligations. The Digital Omnibus was adopted by the Council on 29 June 2026, after the European Parliament approved it earlier that month, and it defers the AI Act's high-risk application dates (Council of the EU). The base law is unchanged: the AI Act is still Regulation (EU) 2024/1689, and high-risk medical AI still has to meet the full set of requirements. Only the timing moved.

One point on status, because it matters for how you cite this. As of early July 2026, the Omnibus has been adopted but not yet published in the Official Journal. It enters into force on the third day after publication, expected within weeks. Until then the new dates are legally settled in the adopted text and waiting on that final step. The practical takeaway: any article, alert, or checklist still listing 2 August 2026 or 2 August 2027 as your deadline is now behind events. So is any source still calling the Omnibus a "provisional agreement." Check the date on whatever you are reading.

Is your AI a high-risk system under the AI Act?

For medical AI, high-risk status is decided by Article 6(1) of the AI Act, and it turns largely on one question: does your device need a notified body? Article 6(1) sets two conditions that both have to be true. First, the AI is a safety component of, or is itself, a product covered by the EU harmonisation legislation in Annex I, which includes the Medical Device Regulation (2017/745) and the IVD Regulation (2017/746). Second, that product has to undergo a third-party conformity assessment under those rules.

In plain terms:

• Is your AI a medical device or IVD under the MDR or IVDR, or a safety component of one? If not, the medical-device route to high-risk does not apply, though a separate Annex III use case still might.

• Does that device require a notified body? This is broadly true for MDR Class IIa, IIb, and III, and for IVD Class B, C, and D.

• If both are yes, your AI is a high-risk system under the AI Act.

• MDR Class I and IVD Class A products that you self-certify without a notified body generally sit outside the Article 6(1) high-risk trigger.

Most medical AI is exactly the kind that gets caught. Of the AI and machine-learning devices the US FDA cleared in 2025, about 62% were software as a medical device, roughly 63% were diagnostic, and about 72% were radiology tools (Innolitics analysis of the FDA AI/ML-enabled device list, 2025). Those are US figures, but they describe the shape of the field everywhere, and diagnostic imaging software is typically Class IIa or higher. That is precisely the notified-body tier that makes an AI system high risk in the EU.

Which deadline applies to you, 2 December 2027 or 2 August 2028?

If your software carries a CE mark under the MDR or IVDR with a notified body involved, you are almost certainly on the 2 August 2028 track, not the December 2027 one. This is the single most common mistake in the current coverage, so it is worth spelling out.

The 2 December 2027 date attaches to Annex III: AI classified as high risk because of its use case (the areas the AI Act lists directly), when that use is not already covered by the product legislation in Annex I. The 2 August 2028 date attaches to Annex I: AI that is high risk because it is, or is embedded in, a product regulated under sectoral law like the MDR or IVDR.

Here is where teams trip. Software as a medical device is itself a medical device under the MDR or IVDR, which is Annex I legislation. So most standalone SaMD routes through Article 6(1) and Annex I, which puts it on the 2 August 2028 clock, even though it is "standalone" software. A lot of secondary sources loosely equate "standalone SaMD" with "Annex III" and hand you the December 2027 date. If you carry a notified-body CE mark, work to 2 August 2028 and confirm the classification with your regulatory lead rather than trusting the shortcut.

How do the MDR and the AI Act fit together?

They fit together as one assessment, not two. Article 43(3) of the AI Act states that for high-risk AI in an Annex I product, the provider follows the conformity assessment already required under the MDR or IVDR, and the AI Act's requirements "shall be part of that assessment." You are not running a separate AI Act conformity procedure alongside your device one. The AI Act requirements are folded into the procedure you already know.

Notified bodies can carry both, in principle. Article 43(3) lets a body already notified under the MDR or IVDR check conformity with the AI Act's high-risk requirements, as long as it meets the AI Act's own competence and independence criteria. The official guidance backs the integrated approach: MDCG 2025-6, published on 19 June 2025, confirms that high-risk classification under the AI Act does not change your device's MDR or IVDR risk class, that it adds obligations rather than replacing them, and that manufacturers should integrate the AI-specific requirements into existing technical documentation instead of duplicating them (European Commission, MDCG 2025-6).

The catch is capacity, not law. Very few notified bodies hold designation for both the MDR or IVDR and the AI Act yet. Anyone who lived through the MDR transition knows how that story goes: when notified-body capacity is the bottleneck, the queue, not the deadline, sets your real timeline. Talk to your notified body about its AI Act designation and slot availability early, and treat that conversation as a dependency rather than a formality.

For a connected medical device, the regulatory stack now runs three deep: the MDR or IVDR for the device, the AI Act for the model, and, once its rules bite, the European Health Data Space for interoperability and logging when you exchange data with EHR systems. We cover that data layer in our guide to EHDS compliance for health-tech vendors.

What does the AI Act require beyond the MDR?

The AI Act adds a defined set of obligations on top of your MDR work, and they sit mostly in Articles 9 to 15, with the quality management system in Article 17 and post-market monitoring in Article 72. Some overlap what you already do under the MDR. A few are genuinely new.

If you already run a mature MDR quality system, the heaviest new lifting tends to land in three places: the data governance in Article 10, the automatic logging in Article 12, and the explicit human-oversight design in Article 14. Those are the ones worth scoping first, because they touch how the model is built and run, not just how it is documented.

What about foundation models and GPAI?

If you build on top of a general-purpose AI model, you are usually a downstream provider, and your device-level obligations are still the high-risk set above. The AI Act's rules for general-purpose AI (GPAI) providers, in Articles 51 to 55, have applied since 2 August 2025 for models placed on the market after that date, with older models given until 2 August 2027. Those duties fall on whoever provides the model, not on you as the party integrating it into a medical device.

What that means in practice: get the GPAI provider's documentation and transparency information up your supply chain, because you will need it to satisfy your own technical file, but do not expect the GPAI timeline to change your device deadline. The Digital Omnibus centered on the high-risk dates rather than the GPAI ones, so treat the GPAI dates as unchanged unless the final Official Journal text says otherwise.

How does this compare to the United States?

The timing is a study in opposites. As the EU postponed its high-risk deadlines while keeping the regime intact, the FDA moved on 6 January 2026 to lighten oversight of some clinical software. It issued two updated guidance documents, one on clinical decision support (CDS) software and one on general wellness products (FDA, January 2026).

Worth being precise about what the FDA did, because it is often summarized too loosely. It is a mix of two things: clarifying and expanding what falls outside the statutory definition of a device, and applying enforcement discretion to certain single-recommendation CDS tools that would previously have been regulated. It is a loosening within the existing statute, not a wholesale redefinition. The direction still contrasts sharply with the EU.

For a team building one product for both markets, the design rule follows from the gap. You build to the stricter EU bar and relax for the US, not the other way around, because retrofitting Article 10 data governance and Article 14 human oversight into a product designed only for a lighter US regime is far more expensive than carrying them from the start. We plan to cover the US side in its own guide; for now, the EU requirements are the ones that set your engineering baseline.

What should a medical-AI team do now?

Start by fixing your dates, then work down to your product. The deadline moved, so the plan should too.

1. Replace the old deadlines in your compliance plan. Your dates are 2 December 2027 (Annex III) or 2 August 2028 (Annex I). Delete the August 2026 and August 2027 dates wherever they appear.

2. Confirm your classification. If your device needs a notified body under the MDR or IVDR, you are a high-risk AI system under Article 6(1).

3. Confirm which track you are on. Notified-body CE mark almost always means the 2 August 2028 Annex I clock.

4. Run a gap analysis against Articles 9 to 15, plus 17 and 72. Expect the real gaps in data governance, logging, and human oversight.

5. Integrate, do not duplicate. Fold the AI-specific requirements into your existing MDR or IVDR technical file and QMS, following MDCG 2025-6.

6. Book time with your notified body early, and ask specifically about its AI Act designation and capacity.

7. If you build on a foundation model, secure the GPAI provider's documentation up your chain now.

This is the kind of work KDL takes on. We build the engineering side of high-risk AI compliance: the logging and record-keeping the AI Act requires, the data-governance and human-oversight controls, and the technical documentation that goes into your conformity file. We scope the regulatory line up front so it does not stall a release, and the legal sign-off stays with your regulatory and legal advisors, where it belongs. If that matches your next 18 months, tell us about the project.

Frequently asked questions

When does the EU AI Act apply to medical devices now?

For AI that is or sits inside an MDR- or IVDR-regulated device (the common case for medical AI), the deadline is 2 August 2028. For standalone high-risk AI classified under Annex III, it is 2 December 2027. Both dates come from the Digital Omnibus, adopted in June 2026 and awaiting Official Journal publication as of early July 2026.

Is my software as a medical device automatically high risk?

If it requires a notified body under the MDR or IVDR, then yes, it is a high-risk AI system under Article 6(1). That covers broadly MDR Class IIa and above and IVD Class B and above. Class I devices you self-certify without a notified body generally fall outside that trigger.

Do I need a separate AI Act conformity assessment?

No. Article 43(3) folds the AI Act's high-risk requirements into the conformity assessment you already run under the MDR or IVDR. It is one integrated assessment, and a suitably designated notified body can cover both regimes.

What does the AI Act require that the MDR does not?

The clearest additions are explicit data and data governance rules (Article 10), automatic record-keeping and logging (Article 12), and human oversight as a design requirement (Article 14). Others, like the risk management and quality systems, overlap your MDR obligations and can be integrated rather than rebuilt.

Did the Digital Omnibus cancel the AI Act for medical devices?

No. It postponed the high-risk deadlines and simplified some rules. It did not remove the obligations. High-risk medical AI still has to meet the full Article 9 to 15 requirements by the revised dates.

The short version

The deadline moved, the rules did not. If you build medical AI for the EU, confirm whether your device needs a notified body, because that answer decides whether the AI Act treats you as high risk. If it does, your date is most likely 2 August 2028, and the new work is usually data governance, logging, and human oversight, folded into the MDR file you already keep. The extra time is real. So is the notified-body queue waiting at the end of it.

If you want a partner for the build side, KDL builds compliance-aware healthcare software. For the rest of the stack, read our companion guides on EHDS compliance and FHIR and EHR interoperability.

This article is for general informational purposes only. It is not legal or regulatory advice, and it does not replace review of the regulations themselves or consultation with qualified regulatory and legal counsel. At the time of writing, the Digital Omnibus had been adopted but not yet published in the Official Journal, and some details become final only on publication. Confirm current dates and requirements against the primary sources before making compliance decisions.

Sources

• Council of the EU (Consilium). Artificial Intelligence: Council gives final green light to simplify and streamline rules (29 June 2026). https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/ (retrieved 2026-07-06)

• Council of the EU (Consilium). Artificial Intelligence: Council and Parliament agree to simplify and streamline rules (7 May 2026). https://www.consilium.europa.eu/en/press/press-releases/2026/05/07/artificial-intelligence-council-and-parliament-agree-to-simplify-and-streamline-rules/ (retrieved 2026-07-06)

• European Union (EUR-Lex). Regulation (EU) 2024/1689 (Artificial Intelligence Act), incl. Articles 6, 8-15, 17, 43, 72. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689 (retrieved 2026-07-06)

• European Commission (DG SANTE). MDCG 2025-6: FAQ on the interplay between the MDR/IVDR and the AI Act (19 June 2025). https://health.ec.europa.eu/latest-updates/mdcg-2025-6-faq-interplay-between-medical-devices-regulation-vitro-diagnostic-medical-devices-2025-06-19_en (retrieved 2026-07-06)