The European Commission has published draft guidelines on the classification of artificial intelligence systems as high-risk under the AI Act (Regulation (EU) 2024/1689). The document has been sent out for consultation with stakeholders prior to its final adoption. For the medical device sector, the guidelines are of particular importance: any medical device with an AI component, covered by the MDR or IVDR and requiring a conformity assessment by a notified body, is automatically classified as a high-risk AI system, regardless of how the manufacturer describes its intended use.

Two scenarios for classification as high risk

The AI Act provides for two separate pathways leading to the classification of a system as high-risk. The first concerns AI systems acting as a safety component of a product covered by EU harmonisation legislation, including the MDR and IVDR, for which a third-party assessment is required. Class IIa, IIb and III medical devices and Class B, C and D IVDs meet this condition by definition. Any AI system integrated into such a device or constituting its diagnostic software is therefore subject to the full requirements for high-risk systems.

The second pathway covers AI systems falling within specific categories of use set out in Annex III to the AI Act. In the medical field, the following are particularly relevant:

  • AI systems for medical diagnosis and clinical decision support,
  • software assessing health risks based on patient data,
  • AI systems used in the management of critical healthcare infrastructure.

Intended purpose as a key classification factor

The guidelines pay particular attention to the concept of the intended purpose of an AI system. The Commission explicitly states that simply including a clause in the terms of use of the system excluding high-risk applications is insufficient if the overall presentation of the product, examples of use or market positioning actually promote or enable such use. Classification is based on a comprehensive assessment of the supplier’s communications, not on a single provision in the terms and conditions.

For manufacturers of medical devices incorporating AI, including software as a medical device (SaMD), this means that the functional scope must be described consistently across all materials. The following documents must be consistent with one another and unambiguous:

  • instructions for use (IFU) – a description of functions that leaves no room for interpretation regarding unintended uses,
  • technical documentation – a precise indication of the intended purpose consistent with the MDR declaration of conformity,
  • promotional and sales materials – no examples of use should go beyond the described functional scope.

When does a distributor or user become a supplier?

The guidelines highlight a mechanism that can transform a distributor, importer or user of an AI system into a supplier, with all the resulting regulatory obligations. This occurs in three cases:

  • placing one’s own name or trademark on a high-risk AI system already placed on the market,
  • making a significant modification to such a system in a way that maintains its classification as high-risk,
  • changing the intended purpose of a system not previously classified as high-risk in a way that results in its reclassification into that category.

In the context of medical devices, this applies in particular to importers rebranding off-the-shelf AI solutions and entities adapting diagnostic algorithms to new clinical indications – even an apparently minor change to the clinical scope may result in the assumption of full supplier obligations.

Effective dates – AI Omnibus postpones deadlines

The original timetable envisaged high-risk AI systems being subject to obligations in August 2026 and August 2027 respectively. The AI Omnibus package has postponed both dates:

  • 2 December 2027 – obligations for systems classified under Annex III (including medical diagnostics),
  • 2 August 2028 – obligations for systems that are safety components of products covered by the MDR/IVDR.

AI systems placed on the market before 2 August 2026 are subject to the new requirements only in the event of significant design changes. For systems used by public authorities, the deadline is 2 August 2030. The postponement of these dates gives medical device manufacturers time to integrate certification processes compliant with the AI Act and the MDR, but does not exempt them from the need to undertake them — the sooner a gap analysis is carried out, the less costly the adaptation will be.

Nature of the guidelines and next steps

The draft guidelines are non-binding – the final interpretation of the AI Act rests with the Court of Justice of the European Union. Before adoption by the Commission, the document will undergo further consultation with the European Artificial Intelligence Board. Manufacturers of medical devices containing AI components should already be analysing their portfolio in relation to both classification pathways, assessing the consistency of the intended use description across all documents, and consulting the AI Act Service Desk on any cases of doubt — a tool available on the AI Act information platform, which will be operational until 2 August 2026.

Source: Draft Commission guidelines on the classification of high-risk AI systems under Article 6 of Regulation (EU) 2024/1689 (AI Act) for stakeholder consultation