Where Article 6(1) interlocks with the Medical Device Regulation, and where Annex III applies independently
Clinical decision support AI is high-risk under the EU AI Act and, in most cases, a medical device under the Medical Device Regulation. These are not parallel regulations. They interlock. The hospital DPO whose tool was approved under one and not the other has a finding waiting at the next inspection.
This piece is the operational map of how the two regimes connect for a DPO at a hospital, clinic group, or health technology firm . The Article 6(1) safety-component test, the MDR overlap, the AI risk classification categories that apply when MDR does not, and the coordination work the hospital DPO has to lead.
EU AI Act Article 6(1) - The Safety-Component Test
Article 6(1) of the EU AI Act classifies an AI system as high-risk when two conditions are met. The AI system is intended to be used as a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I to the Act. And the product whose safety component is the AI system, or the AI system itself as a product, is required to undergo a third-party conformity assessment under that Union harmonisation legislation.
Both conditions matter. The first establishes the universe of products to which Article 6(1) applies, products regulated by Union harmonisation legislation listed in Annex I. The second narrows it to those products that go through third-party conformity assessment, excluding products that self-certify.
The Medical Device Regulation - Regulation (EU) 2017/745, and the In Vitro Diagnostic Medical Device Regulation - Regulation (EU) 2017/746, both appear in EU AI Act Annex I. Most clinical decision support AI, when it qualifies as a medical device under MDR or IVDR, requires third-party conformity assessment because it falls outside Class I and therefore needs notified body involvement. The two conditions are typically met together for clinical AI of any operational consequence.
The Medical Device Regulation Overlap
MDR has classified software as a medical device since 2021, including AI-based diagnostic and decision-support software, when the software's intended purpose meets the definition of a medical device in Article 2 of the MDR: diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease. The classification under MDR is determined by the intended purpose stated by the manufacturer, applying the Rule 11 classification criteria.
The interlock works as follows. When clinical decision support AI is a medical device under MDR, the manufacturer's MDR conformity assessment establishes that the device meets MDR's general safety and performance requirements. The EU AI Act adds, on top of that, the high-risk obligations under Chapter III: risk management system, technical documentation, quality management system, conformity assessment for the AI-specific aspects, post-market monitoring with AI-specific elements, registration in the EU database for high-risk AI systems.
In practice, the AI Act allows the MDR conformity assessment process to absorb the AI Act conformity assessment for the AI safety component, avoiding double assessment. Article 102 to 110 of the AI Act amend the relevant sectoral regulations to integrate the AI Act requirements into existing conformity assessment procedures. The manufacturer goes through one conformity assessment that satisfies both regimes, with the notified body assessing both the device and the AI dimensions - the most efficient path to EU AI Act compliance for manufacturers of clinical AI.
The integration is structural for the manufacturer. For the hospital deployer, the obligations remain distinct: MDR's deployer-equivalent obligations (use the device as intended, report adverse events) and EU AI Act Article 26 deployer obligations (use the AI system in line with the provider's instructions, ensure human oversight, monitor operation, conduct fundamental rights impact assessment where applicable). Both apply in parallel, and the hospital cannot satisfy one by satisfying the other.
Annex III Healthcare Categories - When MDR Does Not Apply
Some healthcare AI does not qualify as a medical device under MDR but is still high-risk under the AI Act through Annex III. The relevant entry is Annex III paragraph 5(a), AI systems used to evaluate the eligibility of natural persons for essential public services and benefits, including emergency healthcare services, and to grant, reduce, revoke, or reclaim such services and benefits. This is where AI risk classification under Annex III applies independently of MDR, and where hospitals most commonly discover gaps in their EU AI Act compliance posture.
This catches AI systems that triage incoming emergency cases, that determine eligibility for clinical pathways, that allocate scarce resources between patients, and that determine access to specialist services. These systems frequently are not medical devices under MDR, their intended purpose may be administrative or operational rather than clinical, but they still produce decisions affecting natural persons in healthcare contexts and are therefore high-risk under the AI Act.
The compliance route differs. There is no MDR conformity assessment to absorb the AI Act assessment, so the AI Act provider obligations apply standalone. The hospital deployer's obligations under Article 26 apply the same as for clinical AI.
What a Hospital DPO Needs to Coordinate
The clinical AI governance posture rests on coordination across three functions that do not naturally talk to each other.
Clinical informatics. Owns the AI deployment, often procures it directly from clinical leadership budgets without going through central procurement. Knows the intended use, the validation evidence, and the workflow integration.
Quality and regulatory. Owns the MDR side. Verifies the manufacturer's CE marking, the notified body involvement, the conformity assessment evidence, the post-market surveillance arrangements. Often does not see the deployment until a vigilance event.
Data protection. Owns the GDPR side, the Article 9 special category data exposure, and increasingly the AI Act deployer obligations. Often inherits the AI deployment without input on the MDR or AI Act compliance posture.
The coordination gap shows up consistently in audits. The clinical AI is in clinical use; the MDR conformity assessment evidence is held by the manufacturer and was checked at procurement; the AI Act deployer obligations have not been assigned. Each function assumes the others have it covered, and the result is that the EU AI Act deployer obligations under Article 26 go unassigned.
What Montro Finds at Healthcare Onboarding |
When Montro onboards a healthcare client, the clinical AI register the DPO presents is almost always partially complete in the same way. The MDR conformity status is documented: CE marked, notified body confirmed, and post-market surveillance arrangements noted. The EU AI Act deployer obligations column is empty. Not because no one thought about it, but because each function assumed another had it covered. Clinical informatics assumed that quality and regulatory would consider AI Act compliance alongside the MDR audit. Quality and regulatory believed that the DPO would include the deployer obligations in the GDPR assessment process. The DPO assumed the manufacturer's conformity assessment satisfied both regimes. All three assumptions were reasonable, and all three turned out to be incorrect. The deployer obligations under Article 26, human oversight, monitoring, and fundamental rights impact assessment, had not been assigned to anyone, and the clinical AI had been in production use for eight months. |
The realistic operating model: the DPO leads a quarterly clinical AI governance review with named representation from clinical informatics, quality and regulatory, and the medical director's office. The agenda covers each clinical AI in production use. The output is a register entry per system showing the MDR status, the AI risk classification, the deployer obligations assigned, and the next review date. The register is presented to the management body annually as part of the firm's NIS2 Article 20 governance evidence where applicable.
None of this is exotic. All of it is operational. The hospitals that arrive at the August 2026 deadline ready will be the ones that have coordinated the work continuously rather than discovering the cross-regime obligations during the supervisor's first request.
Frequently Asked Questions
Does a CE-marked medical device automatically satisfy EU AI Act requirements?
No. CE marking under MDR establishes that the device meets MDR's general safety and performance requirements. The EU AI Act adds additional high-risk obligations: risk management system, technical documentation, post-market monitoring with AI-specific elements, and registration in the EU AI database, that MDR conformity does not cover unless specifically integrated by the notified body. The hospital deployer's obligations under Article 26 of the AI Act remain independent regardless of the manufacturer's conformity status.
What is a notified body under the Medical Device Regulation?
A notified body is a third-party conformity assessment organisation designated by a member state to assess whether medical devices meet MDR requirements before CE marking. For most clinical AI medical devices beyond low-risk Class I classification, notified body involvement is mandatory. The same notified body can assess both MDR and EU AI Act dimensions under the integrated conformity assessment pathway created by Articles 102 to 110 of the AI Act.
What is Annex III paragraph 5(a) of the EU AI Act?
Annex III paragraph 5(a) classifies as high-risk AI systems used to evaluate eligibility for essential public services and benefits, including emergency healthcare services, and to grant, reduce, revoke, or reclaim those services. This catches triage AI, clinical pathway eligibility systems, and resource allocation tools that are not medical devices under MDR but still produce decisions affecting patients in healthcare contexts. These systems face standalone EU AI Act compliance obligations with no MDR conformity assessment to absorb them and no shortcut to high-risk AI system deployer status under Article 26.
What is a Fundamental Rights Impact Assessment and when is it required in healthcare AI?
A Fundamental Rights Impact Assessment is required under Article 27 of the EU AI Act for deployers of high-risk AI systems in certain contexts, including public hospitals and private entities delivering essential healthcare services. It assesses the system's potential impact on fundamental rights beyond data protection, including non-discrimination, dignity, and access to healthcare. For clinical AI determining patient eligibility or resource allocation, the FRIA should be coordinated between the DPO, quality and regulatory, and clinical informatics before deployment.
