EU AI Act for Healthcare AI
Annex I + MDR stack. Notified Body required. We ship the technical file.
Medical-device AI is Annex I high-risk — strictest tier of the EU AI Act. Conformity assessment goes through a Notified Body via Annex VII. MDR (EU) 2017/745 still applies. ISO 13485 quality system is the floor. Plan for 4-12 month NB review cycles.
The healthcare AI compliance stack
- MDR / IVDR — base medical device regulation. Already in force.
- ISO 13485 — quality management system. Mandatory for NB certification.
- EN ISO 14971 — risk management for medical devices. Stacks with Article 9 RMS.
- EN IEC 62304 — medical-device software lifecycle. Maps to Annex IV technical documentation.
- EU AI Act Annex I + Annex VII — AI-specific conformity overlay via NB.
- EU MDR Annex II/III — clinical evaluation + post-market surveillance + vigilance.
- GDPR Article 9 — special categories of personal data (health). Always engaged.
Frequently asked
Is healthcare AI high-risk?
Annex I high-risk: AI systems that are themselves medical devices or that are safety components of medical devices regulated under MDR (EU) 2017/745 or IVDR (EU) 2017/746. This includes diagnostic-imaging AI, decision-support AI, AI-powered surgical robotics, AI in medical software-as-a-medical-device (SaMD), and AI components in IVD analyzers. Annex I means the strictest assessment route.
Self-assessment or Notified Body?
Annex I generally requires Notified Body conformity assessment per Annex VII — third-party audit by an accredited Notified Body. The MDR/IVDR Notified Body designation already covers most cases; the EU AI Act adds an AI-specific layer. You should expect 4-12 month NB review cycles.
How does this stack on MDR?
MDR (in force since 26 May 2021) already covers safety, quality system (ISO 13485), clinical evaluation, post-market surveillance, vigilance reporting. The EU AI Act adds: Article 9 RMS specifically for AI failure modes, Article 10 data governance for training/validation/test sets, Article 14 human oversight in clinical workflow, Article 15 accuracy + cybersecurity + robustness, Article 72 post-market AI-monitoring distinct from MDR PMS.
When does this take effect?
Annex I obligations are now 2 August 2028 after Digital Omnibus delay. BUT: MDR is fully applicable now. GDPR special-categories of personal data (Art. 9) is fully applicable. Article 4 (literacy) is binding since 2 Feb 2025. Article 50 (watermarking) — if you ship generative outputs in clinical context — binds 2 Aug 2026.
What does MEOK ship for healthcare?
meok-cra-annex-iv-classifier-mcp generates the Annex IV technical documentation in NB-ready format. /audit-prep-bundle £4,950 wraps Annex IV + Articles 9-15 + 17-22 in a 14-day signed evidence pack. /consulting £950/day for NB engagement support if you need Annex VII third-party audit prep.
Get NB-ready documentation in 14 days
Full Annex IV technical file + Article 9 RMS + Article 10 data governance + signed evidence. 14-day delivery.
MEOK AI Labs · CSOAI LTD · UK Companies House 16939677