EU MDR & EU AI Act for Medical AI: A Startup Guide

EU MDR (Regulation (EU) 2017/745)

Rule 11 (Annex VIII) classifies software. Software that provides information used for diagnostic or therapeutic decisions is Class IIa by default; Class IIb if those decisions could cause serious deterioration of health or a surgical intervention; Class III if they could cause death or irreversible deterioration. Software that monitors physiological processes is IIa, or IIb when it monitors vital parameters where variations could result in immediate danger. All other software is Class I (EUR-Lex 2017/745).
MDCG 2019-11 (as revised) is the Medical Device Coordination Group guidance on qualifying and classifying software under MDR/IVDR, including Rule 11 examples (MDCG guidance list).
Practical effect. Most diagnostic or decision-support software falls in Class IIa or higher, so it needs a notified body.

High-risk via Annex I (Article 6(1)). An AI system is high-risk if it is a product, or a safety component of a product, covered by Annex I legislation (which includes the MDR and IVDR) and that product requires third-party conformity assessment. In practice, that means MDAI needing a notified body, generally Class IIa and above (MDCG 2025-6; EUR-Lex 2024/1689).
Original timeline. General application on Aug 2, 2026, with Annex I high-risk obligations from Aug 2, 2027 (EUR-Lex 2026/1744 recital 40).
AI Digital Omnibus, now in force. Regulation (EU) 2026/1744 received the Council's final approval on June 29, 2026 and entered into force on July 27, 2026 (Council; Commission). It sets fixed new dates for high-risk obligations (Chapter III, Sections 1–3) (EUR-Lex 2026/1744):
Dec 2, 2027 for Annex III standalone high-risk systems
Aug 2, 2028 for Annex I product-embedded high-risk systems, which covers medical devices

It's an FAQ confirming that MDAI is high-risk under Art. 6(1) when it is the device or a safety component and requires notified-body assessment. AI Act high-risk status doesn't change the device's MDR/IVDR class. Manufacturers are expected to fold AI Act requirements (data governance, transparency, record-keeping, human oversight, post-market monitoring) into their existing MDR/IVDR quality management system and technical documentation, ideally with one combined conformity assessment (MDCG 2025-6 PDF).

If you need a notified body, plan for the AI Act too. You have until Aug 2, 2028 for AI Act high-risk obligations, but notified-body review under MDR already takes time.
Build one QMS. Extend ISO 13485/MDR technical documentation with AI Act data-governance and bias evidence now rather than running a parallel program later.
Bias and data quality are regulatory evidence. Dataset documentation, labeling quality and subgroup performance are now explicit expectations in both regimes.
Watch for further guidance. Harmonised standards and updated MDCG guidance are still pending.

EU MDR 2017/745 — https://eur-lex.europa.eu/eli/reg/2017/745/oj/eng
MDCG guidance list (incl. MDCG 2019-11, current revision) — https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en
EU AI Act 2024/1689 — https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
AI Omnibus 2026/1744 — https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
Commission, "AI Omnibus enters into force" — https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
Council press release June 29, 2026 — https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/
MDCG 2025-6 — https://health.ec.europa.eu/system/files/2025-06/mdcg_2025-6_en.pdf