RegulationIllustrative imageArtificial Intelligence Act
Horizontal rules for AI systems placed on the EU market, with medical software generally falling in the high-risk category and obligations phased in over several years.
The act takes a risk-based approach and prohibits a limited set of practices outright. Systems used as safety components of products covered by sectoral legislation, including medical devices, are classified as high-risk where they require third-party conformity assessment under that legislation.
High-risk systems carry obligations for risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy and cybersecurity. Providers must operate a quality management system and carry out post-market monitoring, reporting serious incidents to the market surveillance authorities.
For medical device software, the act is designed to align with the existing sectoral framework so that a single conformity assessment can cover both sets of requirements. Where a notified body assesses the device, it may also assess the AI Act requirements, subject to its designation.
Obligations apply in stages. Prohibitions took effect first, general-purpose model rules followed, and the high-risk regime applies from a later date. Providers are expected to map the applicable dates against their release plans rather than assume a single compliance deadline.
Important: this page is an editorial summary for demonstration purposes. It is not legal advice and does not replace the official text. Always rely on the consolidated version published in the Official Journal of the EU and on qualified regulatory advice.