European medical AI sits at the intersection of two legal regimes. As a medical device, it must satisfy the Medical Devices Regulation (MDR): CE marking, clinical evaluation and quality systems. As an AI system, it must also comply with the European AI Act.
The AI Act classifies medical AI as “high risk” and imposes obligations across the whole life cycle — data governance and quality, technical documentation, transparency, human oversight, cybersecurity and post-market surveillance. The rules are phased in over several years.
What the AI Act requires
- High-quality training, validation and test data
- Technical documentation and logging
- Human oversight of AI decisions
- Robustness, security and post-market surveillance