Where the AI Act meets the Medical Device Regulation — and both apply.
Clinical decision support is usually a medical device under the MDR as well as high-risk under Annex I of the AI Act. Two conformity regimes, one product, and the evidence overlays rather than duplicates.
- Annex
- Annex I — safety components of products under Union harmonisation legislation (MDR)
- Provisions
- Annex I · Art. 26 · MDR 2017/745 · GDPR Art. 9
- Pack
- €249/month add-on · 4 duties · 1 notice templates
Why this sector is different
Healthcare organisations are usually deployers of regulated devices, so the provider's conformity work is done. What remains is the deployer layer: oversight by qualified clinicians, logging that can be retrieved, special-category data governance, and an incident route that satisfies both the MDR and Article 26(5).
Confirm the MDR classification and CE status of every clinical AI system
If it is a medical device, the provider's conformity assessment is your baseline and your duty is to use it per its instructions.
Annex I · MDR Art. 51 · due within 30 days of activation
Assign oversight to qualified clinicians with override authority
Competence is part of the duty. A reviewer without the clinical qualification to disagree with the system is not an overseer.
Art. 14 · Art. 26(2) · due within 21 days of activation
Reconcile the MDR vigilance route with the AI Act incident duty
One serious incident can trigger two reporting regimes with different clocks. Write the route once.
Art. 26(5) · MDR Art. 87 · due within 45 days of activation
Document the Art. 9 condition and retention for clinical inputs
Clinical data is special-category by default; retention must satisfy both medical-records law and data minimisation.
Art. 10 · GDPR Art. 9 · due within 45 days of activation
The notices you owe
Unlocked with the pack, rendered with your own facts, blanks kept where you must decide.
Patients, in the care pathway
Patient notice — AI-assisted clinical support
An AI system is used to support {purpose} in your care. It provides information to a qualified clinician, who makes the decision and can disregard the recommendation. You may ask your clinician how the …
What your buyers will ask
The questions that stall a deal or trigger an audit. Each one is a control in the matrix.
- ?Is the system CE-marked, and what is its MDR class?
- ?Which clinicians oversee it, and can they override it?
- ?How do you retrieve logs for a specific patient episode?
Straight answers
Is clinical AI covered by the AI Act if it is already a medical device?
Yes. A product can be both. Annex I of the AI Act captures AI that is a safety component of a product covered by Union harmonisation legislation such as the MDR, and the high-risk duties apply alongside the device regime. The evidence largely overlays, which is why the two should be managed in one register.
Does a hospital owe a FRIA?
A public hospital does, as a public body. A private hospital generally does not, unless it provides a public service. What every healthcare deployer owes is Article 26: oversight by qualified people, retrievable logs, relevant input data and incident reporting.
Know where you stand before the questions arrive.
Four minutes, no card. You get your exposure score and the exact articles that apply to a healthcare & life sciences organisation.