Article 27 requires deployers that are bodies governed by public law, private operators providing public services, or deployers of certain Annex III systems (creditworthiness, life and health insurance risk assessment) to perform a Fundamental Rights Impact Assessment. It documents the deployment process, categories of persons affected, specific risks of harm, human-oversight measures, and mitigation actions.

Why it matters

Public hospitals and health-service bodies deploying AI-enabled devices may qualify as deployers required to perform a FRIA, even though the manufacturer already performed the AI Act conformity assessment. MedTech commercial teams should be ready to support customers with the information needed for their FRIA.

Common pitfalls

•Assuming every AI-enabled medical device used by a public hospital requires a FRIA. Article 27 targets specified Annex III high-risk uses, so public-hospital status alone does not establish the obligation.
•Treating the manufacturer's conformity assessment as a substitute for the deployer's FRIA. Where required, the FRIA addresses the local deployment context and its effects on people.
•Treating a data protection impact assessment as a complete substitute. A FRIA must address the applicable fundamental-rights requirements beyond any overlapping data protection analysis.

Sources

Regulation (EU) 2024/1689, Article 27 · EUR-Lex
FDA - Medical Devices · FDA
European Commission - Medical Devices · European Commission

Open full page

Select term B to compare.

Why compare MedTech terms side by side?

MedTech terminology is full of pairs that look interchangeable but carry very different regulatory, clinical, and commercial consequences. Picking the wrong framework, pathway, or standard early in a project can add months to a submission, invalidate clinical evidence, or trigger an audit finding. Side-by-side comparison is the fastest way to surface those differences before they become costly mistakes.

Each comparison on this page pulls from the same vendor-neutral, sourced definitions used throughout the MedTech Terms glossary. You see the one-line summary, the formal definition, why it matters in practice, common pitfalls, and the primary sources (FDA guidance, EU MDR/IVDR articles, ISO/IEC standards, MDCG documents, IMDRF principles) that back each entry. That makes the comparison defensible in regulatory strategy memos, design reviews, and submission narratives.

Common comparison patterns

Regulatory pathway choice - 510(k) vs PMA, 510(k) vs De Novo, Abbreviated vs Special 510(k).
Quality systems - QSR vs ISO 13485, QMSR vs QSR.
Software classification - SaMD vs SiMD, Locked vs adaptive AI.
EU frameworks - MDR vs IVDR, CE Mark vs UKCA.
Cybersecurity artifacts - SPDX vs CycloneDX SBOM, CVE vs CVSS.
Post-market actions - Recall vs field action, Removal vs correction.

How to use this tool

Pick term A and term B from the dropdowns, or click a preset above. The URL updates with both slugs so you can bookmark or share the exact comparison with a colleague, a notified body reviewer, or your regulatory consultant. Click Open full page on either side for the complete entry, including FAQs, related terms, and the full citation list. If you are not sure which term to start with, browse the Categories view or the A-Z index.

MedTech Terms is a vendor-neutral community resource sponsored by Blue Goat Cyber. Definitions are written for educational use and are not legal or regulatory advice.