Software that supports doctors in making diagnoses can save lives – or cause harm if it makes mistakes. This is why medical AI in Europe is regulated twice over: by the Medical Device Regulation (MDR) and by the Artificial Intelligence Regulation, known as the AI Act. An overview of the situation in autumn 2026.
Basis 1: the Medical Device Regulation
Software intended for medical purposes such as diagnosis, monitoring or treatment decisions is generally considered a medical device in the EU. Since the MDR became applicable in May 2021, such programs have usually been classified at least in risk class IIa. This means that an independent notified body must check whether the software is safe, works as intended and has a clinical benefit before it may bear the CE mark. Manufacturers must also monitor their products after they have been placed on the market.
Basis 2: the AI Act
Regulation (EU) 2024/1689 entered into force on 1 August 2024. It classifies AI systems according to their risk:
- Prohibited practices (since February 2025), such as manipulative systems that exploit people’s vulnerabilities.
- High-risk AI: this includes AI systems that are themselves medical devices or safety components of such products and require assessment by a notified body. This covers most diagnostic medical AI. Certain healthcare systems outside the MDR, for example for triaging emergency calls, may also be considered high-risk.
- Transparency obligations for systems that interact with people or generate content, such as chatbots: users must be able to recognise that they are communicating with an AI.
- General-purpose AI models such as large language models have their own obligations, including on documentation and copyright.
What high-risk AI must fulfil
- risk management throughout the entire life cycle,
- high-quality, representative training data to avoid bias,
- technical documentation and automatic logging,
- clear information for users,
- effective human oversight,
- appropriate accuracy, robustness and cybersecurity.
For medical devices, these requirements are to be assessed as far as possible within the existing MDR procedure, so that manufacturers do not have to go through two separate approvals.
New deadlines through the Digital Omnibus
Originally, the high-risk obligations for AI in medical devices were to apply from August 2027. With the so-called Digital Omnibus, the EU postponed the deadlines in 2026, partly because standards and assessment structures were not yet ready. Under Regulation (EU) 2026/1744, which entered into force on 27 July 2026, the obligations for stand-alone high-risk systems apply from 2 December 2027 and for AI in products such as medical devices from 2 August 2028. The general transparency obligations have applied since August 2026. The obligations under the MDR remain unaffected.
Obligations for practices and hospitals
Even those who merely use AI have obligations. An AI literacy obligation has applied since February 2025: following the amendment by the Digital Omnibus in July 2026, organisations that use AI must take measures to promote the AI literacy of their staff. Deployers of high-risk AI must use the systems in accordance with the instructions for use, ensure human oversight and report any anomalies. In addition, there are data protection obligations under the GDPR and the doctor’s duty of care: responsibility for a diagnosis cannot be handed over to software.
What this means for patients
A CE-marked medical device with AI has undergone an assessment. Freely available chatbots or wellness apps, by contrast, are generally not medical devices and have not been tested for diagnosis – even if they give answers that sound medical.
Conclusion
Europe is relying on strict rules for medical AI. Critics fear that this will slow down the arrival of innovations in healthcare; supporters see it as the basis for trust. What will be decisive in practice is whether assessment procedures work swiftly and without duplicate bureaucracy.
More on this topic: AI in Medicine 2026 – an overview and Health data for AI.
Note: This article provides general information and does not constitute legal advice. As of: October 2026.
Leave a Reply