EU AI Act + MDR Dual Compliance — The August 2027 Deadline for AI Medical Devices

Correction (2026-04-18): an earlier version of this post stated the deadline as August 2, 2026. That date applies to the Annex III standalone high-risk AI cohort. For medical devices regulated under MDR or IVDR, the correct applicability date is August 2, 2027 under Article 113(c) of Regulation (EU) 2024/1689. This version corrects the date throughout and adds the Article 113(c) reasoning. We apologise for the earlier error.

The EU AI Act's high-risk obligations for AI-enabled medical devices placed on the EU market become applicable on August 2, 2027 — approximately 15 months from today. The Commission's Digital Omnibus proposal (in trilogue as of April 2026) may push this further to August 2, 2028, but until that proposal is adopted, the binding deadline remains 2 Aug 2027. MedTech Europe's widely-publicised push for a four-year delay was rejected; the Digital Omnibus route is giving the sector a potential ~12 months of additional relief instead — if and only if it passes.

This article summarises (1) the actual statutory deadline and why Aug 2027 — not Aug 2026 — applies to medical-device AI; (2) what dual compliance concretely means; (3) the Digital Omnibus proposal; and (4) a realistic 15-month plan.

Why Aug 2, 2027 (not Aug 2, 2026)

The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and staggers applicability via Article 113:

Article 6(1) captures AI systems that are — or are safety components of — products required to undergo third-party conformity assessment under Union harmonisation legislation. Annex I Section A lists that legislation, and it explicitly includes the MDR and IVDR. So:

• An AI-enabled MDR device classified as Class IIa, IIb, or III (third-party conformity required) → Article 6(1) high-risk → Aug 2, 2027 deadline.
• An AI-enabled IVDR device classified as Class B, C, or D (third-party conformity required) → Article 6(1) high-risk → Aug 2, 2027 deadline.
• Class I self-certified MDR devices and Class A IVDR devices are outside Article 6(1) on the device path; they may still be captured if they separately match an Annex III high-risk use case (in which case the Aug 2026 date applies), but in practice AI-in-Class-I-device fact patterns are rare.

Why the Aug 2026 figure circulates. The Aug 2026 date is the general AI Act high-risk applicability date — correct for Annex III standalone systems (biometric, employment screening, credit scoring, law-enforcement, etc.) — and it's the date most cited in analyst write-ups. Several of those write-ups don't carefully draw the Article 6(1) vs Annex III distinction, which leads readers to mis-apply the Aug 2026 date to medical devices. For MDR/IVDR AI specifically, Article 113(c) is the operative clause and the deadline is Aug 2, 2027.

What becomes applicable on August 2, 2027 (for MDR/IVDR AI devices)

Title III Chapters 2 and 3 of Regulation (EU) 2024/1689 — the full high-risk AI compliance regime — becomes applicable. This is a complementary layer that sits on top of MDR/IVDR, not a replacement. Your device must still clear MDR/IVDR conformity; the AI Act adds a second conformity track, running alongside.

The dual-compliance burden — concrete items

For a single AI-enabled medical device placed on the EU market after 2 Aug 2027, you need:

1. Conformity assessment — one notified body, but TWO assessments

• MDR/IVDR conformity assessment (Notified Body review of technical documentation + QMS + clinical evaluation), unchanged in structure.
• AI Act conformity assessment under Title III Chapter 3. Under Article 43 AI Act, the AI Act conformity assessment for Article 6(1) high-risk AI is integrated into the existing third-party conformity assessment of the product under MDR/IVDR. In practice: the same notified body that handles MDR conformity must also be designated under the AI Act. Not all MDR-designated NBs have AI Act designation as of April 2026 (check the NANDO database before planning). Manufacturers whose NB lacks AI Act designation may need to switch — with MDR re-certification risk.

2. Two QMS documentation trees — integrable but separately identifiable

• MDR Article 10(9) QMS (ISO 13485 typically as backbone).
• AI Act Article 17 QMS — overlapping with but not identical to MDR QMS. Key AI Act QMS requirements: risk management specific to AI, data governance across training/validation/testing datasets, technical documentation procedures, record-keeping for logs, post-market monitoring specific to AI performance drift.

Most manufacturers implement this as one integrated QMS with AI Act-specific modules — but the NB will expect to see the AI Act coverage traceable as an identifiable documentation tree.

3. Expanded technical documentation — Annex IV alongside MDR Annex II

AI Act Annex IV adds content beyond MDR Annex II: intended purpose + deployment context + affected persons; training methodologies + dataset provenance + annotation processes + known biases; validation procedures with explicit performance metrics; system architecture + computational resources + cybersecurity measures; human oversight design (Article 14); accuracy / robustness / cybersecurity specifications (Article 15).

Article 11(2) AI Act explicitly permits integration of AI Act technical documentation into MDR Annex II technical documentation when the device is a product under Union harmonisation legislation — i.e. a single integrated dossier is legally acceptable; two physically separate files are not required.

Most common gaps: training-data governance (provenance, bias monitoring, representativeness) and human-oversight design under Article 14 are genuinely new content, not renamed MDR content.

4. Post-market surveillance — one integrated plan with an AI-Act section

• MDR Articles 83–86 PMS plan continues.
• AI Act Article 72 PMS runs in parallel, focused on AI performance drift, data shift, accuracy/robustness maintenance, and real-world outcomes.
• Recital 173 + cross-reference to MDR PMS permit integration; operationally this is one PMS plan with an AI-Act-specific section, not two separate processes.
• The PMS plan must explicitly identify AI-Act-specific monitoring triggers, KPIs, and review cadence — and be available to the NB on demand.

5. Serious-incident / adverse-event reporting — separate trigger thresholds

• MDR Article 87 vigilance: serious incident (Art. 2(65) MDR) reporting timelines immediate / 10 days / 15 days depending on severity.
• AI Act Article 73: serious incident (Art. 3(49) AI Act) — death or serious harm, serious property damage, breach of Union law protecting fundamental rights, serious harm to critical infrastructure — reporting immediate / not later than 15 days from awareness.
• Overlap is partial, not complete. Fundamental-rights-breach and critical-infrastructure-harm triggers are AI-Act-specific and have no MDR analogue. An MDR vigilance report does not automatically satisfy AI Act Article 73, and vice versa.
• Operational advice: single incident-intake process with dual-classification logic that tags events as MDR-reportable, AI-Act-reportable, or both, and routes accordingly.

6. Registration — EUDAMED + AI Act Article 49 database are separate

• EUDAMED UDI + device registration under MDR Article 29.
• AI Act Article 49: high-risk AI systems in Annex III register in the EU AI Act database before placing on the market. For Article 6(1) AI in products (= MDR medical devices), the provider registers the AI system in a dedicated section of the AI Act database, separate from EUDAMED (Article 49(5) and related implementing acts).
• Two registration streams, two reference numbers, maintained in parallel. No auto-sync.

The Digital Omnibus proposal — watch but don't rely

As of 2026-04-18, the Commission's Digital Omnibus proposal is in trilogue, targeting political agreement by ~28 April 2026.

Council (adopted 13 Mar 2026) and Parliament (adopted 26 Mar 2026) have both agreed to these replacement dates:

• Annex III standalone high-risk AI: 2 Aug 2026 → 2 December 2027
• Article 6(1) high-risk AI embedded in products (MDR/IVDR AI devices): 2 Aug 2027 → 2 August 2028
• Transparency obligations (Art. 50): Council wants 2 Feb 2027; Parliament wants 2 Nov 2026

Editorial posture: until the Digital Omnibus is adopted and published in the OJ, the operative legal deadline for MDR-regulated AI medical devices remains 2 August 2027. Plan against 2027; treat the Digital Omnibus as a watch-track item, not a replacement date. A manufacturer who plans for 2 Aug 2028 and the proposal doesn't land as expected is 12 months over-deadline.

Implementing acts + NB capacity — the other gating factor

A reason the Digital Omnibus is being used to delay: the guidance surface is incomplete.

Until harmonised standards are cited and MDCG guidance lands, avoid confident statements about exactly what NB practice will look like for the first tranche of AI Act conformity assessments. Track the NANDO database for the specific bodies designated for your device code.

Where overlap helps — and where it doesn't

Useful overlaps:

• A robust ISO 13485 QMS gives you most of the AI Act Article 17 QMS structure.
• An MDR risk management file (ISO 14971) is the natural home for AI-specific risk analysis — extend, don't rebuild.
• An existing PMS plan under MDR can be extended to cover AI performance monitoring — add AI-specific triggers and KPIs.
• Clinical/performance evaluation naturally includes model validation; the AI Act wants more explicit training/test data documentation.

Where overlap does NOT help:

• Data governance (training-data provenance, annotation, bias monitoring) is genuinely new work for most manufacturers.
• Human oversight measures (Article 14) — "how does a human meaningfully intervene if the AI outputs a dangerous recommendation?" needs to be designed in AND documented.
• AI-specific cybersecurity (Article 15) is more prescriptive than general-purpose MDR cybersecurity expectations.

A realistic 15-month plan

Months 1–3 (Apr–Jul 2026): gap analysis + governance foundation

• Map current technical file against AI Act Annex IV. Identify missing sections.
• Audit QMS against Article 17. Scope data-governance, AI risk management, post-market monitoring modules to add.
• Classify your AI component under Article 6(1) / Annex III criteria — confirm MDR device path + capture Article 6(1).
• Start engaging NB on AI Act designation scope.

Months 4–9 (Aug 2026 – Jan 2027): documentation build

• Build data governance documentation covering training, validation, testing datasets (including provenance, representativeness, bias evaluation).
• Document human oversight measures (Article 14) — usually the biggest gap.
• Define AI-specific performance, robustness, and cybersecurity metrics (Article 15) with stated thresholds + maintenance plan.
• Integrate AI Act QMS coverage into the ISO 13485 documentation tree.

Months 10–13 (Feb 2027 – May 2027): NB engagement + technical file finalisation

• Submit updated technical file to NB; allow 3–6 months for first-round review + response cycles.
• Align PMS plan + adverse-event intake with AI Act Articles 72 + 73 triggers.
• Prepare AI Act database registration content.

Months 14–15 (Jun–Aug 2027): registration + go-live

• Complete AI Act Article 49 registration before 2 Aug 2027.
• Activate integrated PMS plan on day one of applicability.
• Serial-number / EUDAMED / AI Act database alignment check.

If the Digital Omnibus delay lands: you buy ~12 months of schedule relief. But if you were going to finish on time anyway, the delay is a non-event — you just have more runway for iteration. Plan as if the delay doesn't happen.

Cross-jurisdiction leverage — do it once, benefit three times

The documentation the EU AI Act requires is substantially the same work other major regulators are now asking for:

• Singapore (HSA) — GL-04 R4 + GN-37 CMP + AIHGle 2.0 + GN-15 R13 expect lifecycle documentation, post-market monitoring, change management, and clinical-AI classification reasoning.
• Australia (TGA) — Compliance Principles 2026–2027 named SaMD as an enforcement priority; the standards stack (IEC 62304, ISO 14971, IEC 62366-1, ISO 13485) maps directly.
• US FDA — the AI SaMD TPLC direction (CDRH A-list for FY2026) pulls toward the same continuous-monitoring + documented-change-management posture.

Scope the project as global AI-SaMD compliance rather than EU-only and the ROI is materially different.

Who this affects most

• SaMD-only developers — your entire product is the AI. Full impact.
• Medical device OEMs with AI components — scope your AI subsystem precisely; document the boundary.
• Notified Bodies — capacity crunch is real; designate early.
• Clinical trial sponsors running AI device trials — post-market commitment framework must satisfy both MDR and AI Act from trial-phase design.

If you are outside the EU market

The EU AI Act applies wherever the device is placed on the EU market. If you never target the EU, you're not directly in scope — but see the cross-jurisdiction leverage note above. Singapore, Australia, and the US are tracking the same direction. Building AI Act-compliant documentation positions you for those markets even if the EU isn't your first entry point.

Sources

• Regulation (EU) 2024/1689 (EU AI Act) — eur-lex.europa.eu/eli/reg/2024/1689/oj — Article 113 (staggered applicability), Article 6(1) + Annex I Section A (scope capturing MDR/IVDR AI).
• Regulation (EU) 2017/745 (MDR) — safety-component pathway for Article 6(1) triggers.
• Regulation (EU) 2017/746 (IVDR) — parallel to MDR under Annex I Section A.
• EU AI Act implementation timeline — artificialintelligenceact.eu — maintained with Commission liaison; confirms Article 113(c) Aug 2 2027 for embedded high-risk AI.
• Baker McKenzie (2025) — The EU AI Act and Medical Devices — "From 2 August 2027, these devices will need to comply with the requirements for high-risk AI systems under the AIA, if placed on the EU market (Article 113(c), AIA)".
• Sidley Austin (Dec 2025) — Digital Omnibus implications for MedTech; confirms 2 Aug 2027 baseline and the proposed Aug 2028 replacement.
• Gardner Law, Addleshaw Goddard (2026) — Digital Omnibus Council (13 Mar 2026) and Parliament (26 Mar 2026) positions; trilogue target ~28 April 2026.
• MedTech Europe (2025) — four-year-extension ask to 2 Aug 2029 was not granted; Digital Omnibus route gives ~12 months of potential relief if adopted.
• NANDO database — ec.europa.eu/growth/tools-databases/nando/ — canonical NB designation reference.

Related regMD coverage

• HSA SaMD & AI Device Landscape — Singapore 2026
• TGA Compliance Principles 2026–2027 — SaMD Enforcement Priority
• Medical Device SaMD — Software Classification
• EU MDR — Medical Device Classification

This article summarises publicly available guidance and analysis on the EU AI Act and MDR/IVDR intersection as of April 18, 2026, and does not substitute for regulatory or legal advice. Always refer to the primary Regulation text and consult EU-qualified Regulatory Affairs counsel for device-specific decisions. The AI Act's secondary implementing acts, NB designations, and the pending Digital Omnibus proposal continue to evolve.