We use cookies and similar storage that the site needs to work. With your permission, we would also like to use marketing cookies to understand which of our pages and campaigns interest you and, if we know who you are, to let our team follow up. You can change your mind at any time from Cookie settings at the foot of every page. Cookie Policy
Most health AI is Class IIa or higher, so it needs notified-body certification and, later, AI Act compliance through the same file. A notified body is an independent organisation, designated by a member state, that audits your quality system and technical file and certifies the device.
Fines are national, but the bigger risk is losing market access. Certificate suspension, withdrawal or recall can stop sales outright.
Adopted deadlines run from 28 November 2026 to 2029, while the major relief in COM(2025) 1023 is proposed, not adopted. Parliament's committee votes on 3 December 2026; entry into force before mid-to-late 2027 looks unlikely.
What should you do now?
Finish EUDAMED registration by 28 November 2026. Confirm actor registration and register every legacy device still sold.
Re-test qualification and class for every product. Map each intended purpose against Rule 11 or the IVDR classes, and align marketing claims.
Protect transition rights. Keep legacy products within the 2023/607 or 2024/1860 conditions and avoid significant changes. IVDR Class B and sterile Class A makers should apply to a notified body before 26 May 2027.
Build one AI-ready technical file for 2 August 2028. Add data governance, bias controls, human oversight and AI performance monitoring now. Agree a predetermined change control plan (PCCP), which approves model updates in advance, with your notified body.
Track COM(2025) 1023 without betting on it. Budget for current law and treat the Class I and Section B scenarios as upside.
When does AI count as a device, and what must its certification cover?
It is one when it acts on data for an for diagnosis, prevention, monitoring, prediction, prognosis or treatment.
Intended purpose, as stated in labelling, instructions and marketing, decides whether software is a device.
individual patient
Examples include supporting diagnosis, flagging abnormal physiological values and calculating doses. Usually not devices: software that only stores, communicates or searches data, billing and admin tools, wellness apps, and population-level research aggregation. Your marketing claims can turn a product into a device.
MDR Rule 11 puts most decision-support software at Class IIa or above:
Software that informs diagnostic or therapeutic decisions is Class IIa.
It is IIb if a wrong decision could cause serious deterioration of health or surgery.
It is III if it could cause death or irreversible harm.
Software that monitors physiological processes is IIa, or IIb for vital parameters where variation could create immediate danger.
All other software is Class I, a small residual category.
Class IIa and above needs a notified body, the main cost and time driver. IVDR software, such as software interpreting test results, uses four classes from A (lowest risk) to D (highest). Classes B, C and D, and sterile Class A, need a notified body.
Current obligations for Class IIa+ (MDR) or Class B+ (IVDR) software
Current obligations for Class IIa+ (MDR) or Class B+ (IVDR) software
Obligation
In practice
Obligation
Quality management system (QMS)
In practice
Documented design, risk, supplier and change control, in practice to EN ISO 13485:2016. Audited by the notified body.
Obligation
Clinical / performance evaluation
In practice
Evidence that the device is safe and performs as claimed: clinical evaluation under the MDR, performance evaluation under the IVDR.
Obligation
Technical documentation
In practice
The full design dossier (Annexes II/III): risk management, verification and validation, and software lifecycle evidence (IEC 62304).
Obligation
Post-market surveillance (PMS) and vigilance
In practice
Continuous real-world monitoring. Serious incidents must be reported immediately, and within 2 days for a serious public-health threat, 10 days for a death or unanticipated serious deterioration, and 15 days otherwise.
Obligation
PSUR
In practice
The Periodic Safety Update Report reviews post-market data. It is due at least annually for Class IIb/III and IVD Class C/D, and at least every two years for IIa.
Obligation
PRRC
In practice
A named Person Responsible for Regulatory Compliance. Micro and small firms may use an external PRRC who is permanently and continuously available.
Obligation
UDI / EUDAMED
In practice
Each device carries a Unique Device Identifier. Actors, devices and certificates are registered in EUDAMED, whose first four modules have been mandatory since 28 May 2026.
Obligation
Cybersecurity
In practice
IT security across the software lifecycle is part of the safety requirements, with MDCG 2019-16 as the key guidance.
Non-EU manufacturers also need an EU authorised representative.
The AI Act adds requirements but not a second assessment. An AI medical device needing notified-body assessment is "high-risk" under AI Act Annex I Section A. Joint MDCG and AI Board guidance (MDCG 2025-6, June 2025) confirms one technical file and one conformity assessment via the MDR/IVDR route.
Extend your existing file with:
data governance (representative, bias-mitigated datasets)
transparency
human oversight
post-market monitoring of performance and cyber-resilience
Retraining may count as a significant change under both regimes; PCCPs help avoid repeated reassessment. The Digital Omnibus on AI narrows "safety component", so purely assistive or optimisation features are not automatically high-risk.
What happens if you fail to comply?
The MDR and IVDR set no EU-level fines. Member states set effective, proportionate and dissuasive penalties.
What happens if you fail to comply?
What happens if you fail to comply?
Member state
Penalties
Member state
Germany
Penalties
Marketing a device without required conformity assessment or CE marking: up to 3 years' imprisonment or a fine; 1 to 10 years in aggravated cases, such as endangering many people. Administrative fines up to €30,000 per offence.
Member state
France
Penalties
The regulator, ANSM: up to €150,000 for individuals. Companies: up to 30% of the product's turnover for product-related breaches, capped at €1 million, plus possible daily penalties. Ceilings from 2015 guidance.
Member state
Ireland
Penalties
National regulations create criminal offences for MDR breaches, and directors may face personal liability. Device-specific maximum penalties could not be confirmed.
Commercial sanctions hurt more. Authorities can order corrective action or withdraw, recall or restrict devices, and notified bodies can suspend certificates.
Civil liability is widening. From 9 December 2026, the new Product Liability Directive adds strict liability for defective products, including software.
Which deadlines are fixed, and what relief is only proposed?
Adopted law sets fixed deadlines from 28 November 2026 to 31 December 2029 (see the dates table below). The MDR extensions (Regulation (EU) 2023/607) hold only if three conditions are met:
you had a QMS and a notified-body application in place by 26 May 2024
you signed an agreement by 26 September 2024
you have made no significant changes since
The AI Act date has moved to 2 August 2028. Regulation (EU) 2026/1744, the Digital Omnibus on AI (in force 27 July 2026), deferred high-risk obligations for AI medical devices from 2 August 2027. It kept devices in Section A, with no carve-out. Annex I systems already on the market are exempt unless their design changes significantly.
Faster notified-body reviews are not guaranteed. A December 2025 Commission draft implementing regulation would cap review times and standardise quotations. Its adoption is unconfirmed, so build buffers into launch plans.
COM(2025) 1023 (16 December 2025) would bring major relief, but it is proposed, not adopted
COM(2025) 1023 (16 December 2025) would bring major relief, but it is proposed, not adopted
Proposal
Effect
Proposal
Rule 11 rewritten
Effect
Most diagnosis, treatment and monitoring software generally Class I. Broad wording could still push some products back to IIa.
Proposal
Devices moved to AI Act Annex I Section B
Effect
Most AI Act obligations would stop applying to devices. AI requirements would be handled inside the MDR.
Proposal
Certificates without expiry
Effect
Risk-based reviews would replace five-year recertification.
Proposal
Lighter PSUR and vigilance
Effect
PSURs every two years for IIb/III and C/D, and only when necessary for IIa. 30 days for non-severe incidents.
Proposal
Notified-body fee cuts
Effect
At least 50% for micro firms and 25% for small firms.
Proposal
Other
Effect
Relaxed PRRC rules, more flexible clinical evidence (including in-silico), cybersecurity added to the safety requirements, and regulatory sandboxes.
The timetable is long and the content may change. Per the latest reporting (July 2026), the committee vote is scheduled for 3 December 2026 and the plenary for early 2027. The Council aims for a general approach by end-2026. Entry into force before mid-to-late 2027 looks unlikely. In the Omnibus, co-legislators chose to keep devices in AI Act Section A.
What are the MDR and IVDR?
The MDR (Regulation (EU) 2017/745, applying since 26 May 2021) and the IVDR (Regulation (EU) 2017/746, applying since 26 May 2022) apply directly across the EU. They govern how devices and diagnostics are designed, certified, sold and monitored.
Commission guidance on qualifying software (MDCG 2019-11 Rev.1, June 2025) introduced "medical device artificial intelligence" (MDAI): device software also caught by the AI Act. It requires modular products to document each module's purpose, and signals that prognosis or prediction software tends to fall in higher classes.
Which dates matter?
Which dates matter?
Which dates matter?
Date
What happens
Date
28 May 2026
What happens
Four EUDAMED modules became mandatory: actors, UDI/devices, certificates and market surveillance. The vigilance and clinical-investigation modules are not live yet.
Date
28 Nov 2026
What happens
Legacy and other devices still sold after 28 May 2026 must be registered in EUDAMED.
Date
26 May 2027
What happens
IVDR Class B and sterile Class A: notified-body application deadline (agreement due by 26 Sep 2027).
Date
28 May 2027
What happens
Notified bodies must register pre-existing certificates in EUDAMED.
Date
31 Dec 2027
What happens
Transition ends for MDR Class III and IIb implantables, and for IVDR Class D.
Date
2 Aug 2028
What happens
AI Act high-risk obligations apply to AI medical devices.
Date
31 Dec 2028
What happens
Transition ends for all other MDR legacy devices, including software up-classified by Rule 11, and for IVDR Class C.
Date
31 Dec 2029
What happens
Transition ends for IVDR Class B and sterile Class A.