Medical devices meet the AI Act: what MDR and IVDR manufacturers need to know

Two sets of rules at once

If you make a medical device that contains AI, or an AI system used as a safety component in one, you already know the Medical Device Regulation (MDR) or the In Vitro Diagnostic Regulation (IVDR). From 2 August 2028, the AI Act adds a second layer ^[1].

Think of it like a car that has to pass both emissions testing and safety testing. Neither replaces the other, and the AI Act's high-risk requirements land on top of what MDR and IVDR already ask for.

What counts as high-risk

Article 6 of the AI Act says that an AI system is high-risk if it is, or is a safety component in, a product that requires third-party conformity assessment under EU product legislation listed in Annex I ^[1]. MDR and IVDR are both on that list.

So if your AI system is itself a medical device—say, software that analyses X-rays—or if it is a safety component in a device that needs notified body approval, it is high-risk under the AI Act. If it doesn't need third-party assessment, it stays outside the high-risk category, though other AI Act duties may still apply.

Logging what the system does

Article 12 requires high-risk AI systems to technically allow for the automatic recording of events over their lifetime ^[2]. The logs are there for traceability: spotting risks, post-market surveillance and helping users monitor the system.

The rule says what to log. It doesn't say how to protect the logs once they exist, but MDR and IVDR already require post-market surveillance, and logs that can be quietly edited are harder to rely on when a question comes up a year later.

Articles 19 and 26 say providers and users must keep the logs they control for at least six months, unless another law asks for longer ^[3]. Medical device rules often do.

Data governance

Article 10 is about the data used to train, validate and test the AI ^[4]. It must be relevant, representative and of sufficient quality. Providers must document how the data is governed, including its origin.

For medical AI, this overlaps with MDR and IVDR requirements on clinical evaluation and performance studies, but the AI Act spells out data governance in its own terms.

Technical documentation

The AI Act asks for technical documentation covering design, development and how the system meets the high-risk requirements ^[5]. Much of it mirrors what MDR and IVDR already require, but now the AI Office and notified bodies will both be looking.

When it applies

The high-risk requirements for Annex I systems, including medical devices, apply from 2 August 2028 ^[1]. That's the date to work backwards from.

If your device is already on the market, check whether it counts as high-risk and what that means for post-market surveillance. If you're developing something new, the AI Act's requirements shape the design from the start.

How a digital witness fits here

Medical device manufacturers already keep logs for post-market surveillance, incident tracking and regulatory inspections. The question the AI Act sharpens is whether those logs will hold up when someone—a notified body, a regulator or a court—asks to see them years later.

Here, the thing to seal is each log record as it is written: the event type, the timestamp, the device identifier and the outcome. Sealing takes a fingerprint of the record, not the record itself, so patient data and device internals stay in your systems.

When an auditor or supervisor asks whether the log has changed, anyone you share it with can check the fingerprint against the sealed one. If they match, the record is exactly what was written on the day. Change one character and it won't match.

A digital witness doesn't replace your logging system, your quality management or your clinical evaluation. It gives you a way to show that the log you're handing over is the one the system wrote, unchanged. That matters when the log is evidence.

You can seal log records as they are written with the REST API, the SDK or the MCP server. The content stays with you. The first 2,000 witnesses a month are free. Documentation is at WitniumChain.

How it would work

1. Your logging system writes a record and sends its fingerprint to the witness.
2. The witness returns a witness ID and seals the fingerprint on a chain where any later change would show.
3. When the record is questioned, you share it with the auditor, who calculates the fingerprint and checks it against the sealed one.

What this means for you

If you make AI-based medical devices or IVDs:

• Check whether your AI system is high-risk under Article 6 and Annex I. If it needs third-party assessment, it is.
• Review your logging setup. Can it automatically record the events Article 12 lists, and can you keep those logs for at least six months?
• Document your data governance. Where does your training data come from, and how do you ensure it is relevant and representative?
• Plan for 2 August 2028. If you're developing something new, build the AI Act's requirements in from the start. If you have devices on the market, map what changes post-market surveillance will need.
• Ask your notified body how they're handling the overlap between MDR/IVDR and the AI Act. The two sets of rules will be assessed together.

What to watch

• 2 August 2026: General transparency duties under the AI Act, including the obligation to tell people when they are interacting with an AI, already apply ^[6].
• 2 August 2027: Codes of practice for Article 50's labelling of AI-generated content should be ready ^[7].
• 2 August 2028: High-risk requirements for Annex I systems, including medical devices, come into force ^[1].

The European Commission's AI Office is publishing guidance for medical device manufacturers and notified bodies. Watch ai-act-service-desk.ec.europa.eu for updates.