August 2026: what the EU AI Act obligations deadline actually means for medical device manufacturers

If your software is both an MDR-regulated medical device and an AI system that falls under Annex III of the EU AI Act, you are subject to both regulatory frameworks simultaneously from August 2026.

Not all AI-enabled medical device software is automatically high-risk under the AI Act. The classification depends on the intended purpose and the risk category. But if your device is Class IIa or above under MDR and uses AI, the overlap is very likely.

The high-risk AI system obligations under the EU AI Act include: a risk management system, data governance requirements, technical documentation, transparency and logging, human oversight mechanisms, accuracy and robustness requirements, and a post-market monitoring plan.

The good news: if you have a mature MDR compliance programme, you already have much of the foundation. ISO 14971 risk management, IEC 62304 software lifecycle documentation, and the MDR Annex II technical file cover significant ground.

The gaps are real, however. The AI Act's data governance requirements are more explicit than anything in MDR. Human oversight provisions require specific design and documentation that MDR does not mandate in the same way.

Start with a gap analysis. Map your existing MDR documentation against the EU AI Act high-risk system requirements. Identify what you already have, what needs to be extended, and what is genuinely new.

For manufacturers that have not yet started MDR conformity assessment, the practical advice is to design your compliance programme to satisfy both frameworks from the outset. Retrofitting is significantly more expensive.