Expert discusses implications of EU AI Act ‘high risk’ provisions on medical devices

BARCELONA – Manufacturers of medical devices with artificial intelligence (AI) capabilities should be aware that they may be subject to additional requirements governing quality management systems and technical documentation under the recently adopted Artificial Intelligence Act if the devices are considered high-risk under the act.

Leon Doorn, founder of MedQAIR Services B.V in Amsterdam, discussed the implications of the Act on medical device makers at the RAPS European Clinical, Risk, and Postmarket Surveillance Conference on 23 October.

The act’s requirements would be layered on top of those set by other EU regulations, such as the Medical Device Regulation (MDR) and the In Vitro Diagnostic Devices Regulation (IVDR).

Doorn said it’s not too early for manufacturers to start thinking about getting an AI compliance plan together. While the AI Act entered into force on 1 August 2024, the bulk of its compliance requirements for high-risk systems will apply starting in August 2026, though for medical devices and IVDs that undergo a conformity assessment under their respective regulations, the rules will apply beginning in August 2027.

AI systems are considered high risk if they are a safety component of a product, or constitute the product itself, covered under existing EU safety legislation listed in Annex I of the AI Act, including both MDR and IVDR. This means that products such as AI-embedded imaging devices used to detect abnormalities would be considered high risk.

Other systems considered to be high risk under the act include AI-enabled biometric identification and categorization systems, employee management systems, law enforcement systems, and systems used to determine access to essential public and private services.

Under the AI Act, high-risk systems will have to undergo a conformity assessment before they are placed on the market. These conformity assessments are different than those specified under the MDR and the IVDR, though they may be undertaken by the same notified body if the body is designated under all the relevant texts.

In addition, Article 17 sets new requirements governing quality management systems for high-risk systems. The article states that providers of high-risk AI systems should put a quality management system in place. It specifies that the system “shall be documented in a systematic and orderly manner in the form of written policies, procedures and instructions” and include a strategy for regulatory compliance.

Article 11 also establishes requirements for technical documentation. It states that “the technical documents of a high-risk AI system shall be drawn up before that system is placed on the market or put into services and shall be kept up to date.”

It further specifies that “the technical documentation shall be drawn up in such a way as to demonstrate that the high-risk AI system complies with the requirements set out in this Section and to provide national competent authorities and notified bodies with the necessary information in a clear and comprehensive forms to assess the compliance of the AI system with those requirements.”

In other areas, Doorn called for the need to harmonize the AI Act with standards set by other standards bodies such as the European Committee for Standardization (CEN) and the European Committee for Electrotechnical Standardization (CENELEC) in Joint Technical Committee (JTC) 21 plan on AI. This standard addresses AI in quality management, risk management, logging, trustworthiness, data accuracy, and data robustness.

Expert discusses implications of EU AI Act ‘high risk’ provisions on medical devices

Related topics

Recommended content

Welcome to the new RAPS Digital Experience