EU AI Act for Healthcare: High-Risk Medical AI Compliance

Why Clinical AI Is High-Risk

Healthcare AI reaches the high-risk tier through two distinct routes, and many systems touch both:

• Article 6(1) — regulated medical products. AI that is a medical device or a safety component of one (diagnostic imaging, decision-support software, IVD analysers) is high-risk when it already requires third-party conformity assessment under the MDR (Regulation (EU) 2017/745) or IVDR (Regulation (EU) 2017/746).
• Annex III point 5(d) — emergency triage. AI used to triage patients or dispatch emergency first-response services is listed directly in Annex III, independent of its device status.
• Annex III point 5(a) — access to healthcare. AI that evaluates a person's eligibility for public healthcare benefits and services is also high-risk.

Treatment-recommendation and diagnostic-support tools typically qualify as high-risk. General wellness apps with no medical purpose usually do not — classify each system against Article 6 and Annex III rather than assuming.

Interplay with the MDR and IVDR

The AI Act does not replace medical-device law — it layers on top of it.

For AI that is a medical device, the AI Act's high-risk requirements are integrated into the existing MDR/IVDR conformity-assessment procedure rather than run as a separate track, so a single notified-body assessment can cover both regimes. Manufacturers still need CE marking under the MDR/IVDR, and the AI Act adds obligations — risk management, data governance, logging, human oversight, and technical documentation — on top of the clinical-evaluation and post-market-surveillance duties they already carry.

Practical consequence: your MDR technical file and your AI Act Annex IV documentation should be built as one coherent evidence base, not two.

Core Obligations for Clinical AI

The load-bearing articles for a healthcare high-risk system:

• Article 9 — risk management. A continuous, lifecycle risk-management system covering reasonably foreseeable clinical misuse and residual risk to patients.
• Article 10 — data governance. Training, validation, and testing data must be relevant and appropriately representative; clinical datasets need bias examination and documented provenance, with Article 10(5) allowing limited processing of special-category health data solely to detect and correct bias, under safeguards.
• Article 12 — logging. Automatic recording of events over the system's lifetime so a clinical decision can be reconstructed and traced.
• Article 14 — human oversight. A clinician must be able to understand, monitor, override, or disregard the AI's output — the clinician-in-the-loop stays clinically and legally responsible for the patient.