Which AI Act articles does a Notified Body actually need to assess for a medical device?

The Notified Body's extended scope typically covers Articles 8 through 15, addressing risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness, and cybersecurity for the AI system embedded in or constituting the device. These requirements are additive to, not a substitute for, the underlying MDR or IVDR general safety and performance requirements and clinical evaluation obligations.

Do Notified Bodies need specific AI Act designation to assess these requirements, or does existing MDR designation suffice?

Notified Bodies conducting conformity assessment of AI-enabled medical devices need appropriate expertise and, depending on the scope of their existing MDR or IVDR designation, may need to demonstrate specific competence in assessing AI system requirements to their designating authority. Manufacturers should confirm with their Notified Body early in the process that its designation and internal expertise actually cover AI Act assessment, since not every currently designated body has built out this capability at the same pace.

What happens for a Class I MDR device with an embedded AI system that requires no Notified Body involvement?

If a device does not require third-party conformity assessment under MDR, such as many self-certified Class I devices, it generally falls outside the Article 6 high-risk definition for AI Act purposes as well, since Article 6 requires that the underlying product be one that needs third-party conformity assessment. Manufacturers should not assume this exemption applies broadly, however, since it depends on the specific device classification and whether any Annex III listing independently triggers high-risk status.

All terms

RegulatoryRegulated Pathways AI / ML in Devices Global Markets

AI Act Conformity Assessment (Medical Devices)

For AI-enabled medical devices, AI Act requirements are assessed through the MDR/IVDR notified-body procedure, not a separate CE route.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed July 25, 2026

Definition

Article 43(3) provides that where an AI system is a safety component of, or is itself, a product covered by Annex I legislation such as the MDR or IVDR, the AI Act requirements are checked as part of the conformity assessment procedure under that legislation. The notified body performing the MDR/IVDR assessment therefore extends its scope to cover the relevant AI Act articles.

What the regulation says

Regulation (EU) 2024/1689 (AI Act), adopted on 13 June 2024, links certain high-risk AI assessments to existing product conformity assessment procedures. Under Article 6(1), this applies where AI is a safety component of, or itself constitutes, a product covered by Annex I legislation and that product requires third-party conformity assessment. Article 43(3) integrates the AI Act’s Chapter III, Section 2 requirements into that assessment. For MedTech, the relevant frameworks include Regulation (EU) 2017/745 (MDR), Article 52, applicable from 26 May 2021, and Regulation (EU) 2017/746 (IVDR), Article 48, applicable from 26 May 2022. Manufacturers must therefore address applicable AI requirements alongside device requirements, including risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity under Articles 8 to 15. Article 43(3) allows notified bodies to assess these AI requirements only where their compliance with specified AI Act competence and organisational requirements has been assessed through the relevant designation procedure. An existing MDR or IVDR designation is therefore not automatically sufficient. Article 113 makes Article 6(1) and its corresponding obligations applicable from 2 August 2027.

What this means in practice

Practically, manufacturers must ensure their notified body is designated for the AI Act scope relevant to the device. Technical documentation under MDR Annex II or IVDR Annex II must be extended to include the AI Act Annex IV elements (data governance, training methodology, evaluation, cybersecurity, human oversight).

Examples

An AI-powered diagnostic imaging system, classified as a Class IIb medical device under the MDR, will undergo a single conformity assessment procedure by its notified body, which will simultaneously verify compliance with both MDR and the relevant AI Act provisions.
A software as a medical device (SaMD) utilizing machine learning for predicting patient deterioration, already CE-marked under IVDR, will need its manufacturer to update technical documentation to demonstrate adherence to AI Act requirements for data quality and human oversight.
A manufacturer developing an AI-enabled surgical robot must ensure their notified body, designated for the device's MDR classification, is also accredited to evaluate the AI component's conformity with the comprehensive AI Act stipulations.

Common pitfalls

•Selecting a notified body designated only under MDR without confirming AI Act scope designation.
•Duplicating documentation instead of integrating AI Act evidence into the existing technical file.

Frequently asked questions

No, Article 43(3) provides that where an AI system is a safety component of, or is itself, a product covered by Annex I legislation such as the MDR or IVDR, the AI Act requirements are checked as part of that product's existing conformity assessment procedure rather than through a separate AI Act certification process. There is a single CE mark and a single conformity assessment procedure, with the Notified Body's scope extended to cover the relevant AI Act articles alongside the device regulation requirements.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Regulatory

AI Act Technical Documentation (Annex IV)

The information set a provider must maintain to demonstrate a high-risk AI system's compliance with Articles 8 to 15.

Regulatory

High-Risk AI System (EU AI Act)

AI systems captured by Article 6 of the EU AI Act because they are safety components of regulated products or listed in Annex III.

Regulatory

Notified Body(NB)

EU-designated organization that assesses conformity of medical devices under MDR and IVDR.

More in Regulatory

· Same category

Regulatory

510(k) Premarket Notification(510(k))

FDA submission demonstrating a device is substantially equivalent to a legally marketed predicate.

Regulatory

510(k) Summary vs 510(k) Statement

Two alternative disclosure mechanisms in a 510(k) submission, a Summary is public on FDA's website; a Statement promises to share Safety & Effectiveness info on request.

Regulatory

513(g) Request for Information(513(g))

Formal mechanism to ask FDA whether a product is a device and, if so, its likely classification.

Regulatory

Abbreviated 510(k)

510(k) variant that relies on FDA guidance, special controls, or recognized consensus standards.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (3)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 1Tier 4Trade press and expert commentary· 1

Link health: 3 verified· last checked 2026-06-20

EUR-Lex·1RAPS·1FDA·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Regulatory0 / 101

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Regulatory
Sources: 3
Updated: 7/25/2026

Compare with another term

Learn in 60 seconds

For AI-enabled medical devices, AI Act requirements are assessed through the MDR/IVDR notified-body procedure, not a separate CE route.

·Practically, manufacturers must ensure their notified body is designated for the AI Act scope relevant to the device.
·The notified body performing the MDR/IVDR assessment therefore extends its scope to cover the relevant AI Act articles.

Remember this

Watch out: Selecting a notified body designated only under MDR without confirming AI Act scope designation.

Related terms

You may also need

Auto-suggested from Regulatory and shared keywords.

All Regulatory terms

From the Blue Goat network

Related resources and services on this topic.