Clinical decision support, diagnostic imaging AI, and triage systems fall under Annex III as safety components of medical devices or standalone high-risk systems. If your AI influences patient care decisions, you have until December 2, 2027 — 561 days — to comply.
AI systems used as safety components of medical devices — or AI that is itself a medical device — are automatically high-risk under Annex I. Clinical decision tools also fall under Annex III, point 5.
AI that assists clinicians in diagnosing conditions, recommending treatments, or prioritising patients based on clinical data
Systems that analyse medical images, lab results, or patient records to detect diseases, flag abnormalities, or suggest diagnoses
AI that determines urgency of care, allocates hospital resources, or scores patient risk levels for emergency or surgical settings
Systems that assess mental health conditions, predict patient deterioration, or recommend psychiatric interventions based on behavioural patterns
Administrative and operational AI in healthcare settings generally won't trigger Annex III — unless it directly influences clinical outcomes for individual patients.
Even if your system is not high-risk, transparency obligations under Article 50 may still apply. Run the free classifier to find out.
MDR / IVDR + EU AI Act
If your AI qualifies as a medical device under the MDR or IVDR, the EU AI Act conformity assessment integrates with your existing CE marking process. The notified body handling your MDR/IVDR assessment will also evaluate AI Act compliance. This means you won't need a separate conformity assessment — but you do need the additional AI-specific documentation: bias testing, model accuracy records, and continuous post-market monitoring plans.
See the full regulatory overlap mapping →Each must be in place before December 2, 2027. Non-compliance risks fines up to €15 million or 3% of global turnover.
Some work carries over
Healthcare organisations handling patient data under GDPR already have data protection impact assessments and processing records. These partially cover Article 10 (data governance) and Article 9 (risk management) of the AI Act. But you'll still need AI-specific documentation: model accuracy and bias testing, conformity assessment, and continuous post-market monitoring.
See the full GDPR overlap mapping →