Overview of Regulation (EU) 2017/745 (MDR) and Its Application to AI Software in Medical Devices
Regulation (EU) 2017/745, commonly referred to as the Medical Device Regulation (MDR), was adopted on 5 April 2017 and entered into force on 26 May 2021. It establishes a comprehensive framework for the regulation of medical devices within the European Union and the European Economic Area. The MDR consolidates and replaces previous directives, specifically Council Directives 90/385/EEC and 93/42/EEC, to create a unified regulatory system. Its primary objectives are to ensure a high level of safety and health protection for patients and users while fostering innovation and maintaining the smooth functioning of the internal market for medical devices.
The MDR applies to all medical devices, including software intended for diagnostic or clinical purposes, provided they meet the definition of a medical device under the regulation. This includes AI-driven software that is designed to diagnose, monitor, treat, or mitigate diseases or medical conditions. The regulation explicitly aims to address the unique challenges posed by software-based medical devices, including those utilizing artificial intelligence, by introducing stringent requirements for conformity assessment, clinical evaluation, and post-market surveillance.
The MDR’s scope extends to medical devices that incorporate software, whether standalone or integrated into hardware. The regulation ensures that such devices undergo rigorous evaluation to demonstrate their safety, performance, and compliance with general safety and performance requirements before being placed on the market.
Key Provisions of the MDR Relevant to AI Software in Medical Devices
The MDR introduces a risk-based classification system for medical devices, which is critical for determining the level of regulatory scrutiny required for AI-driven software. AI software used in high-risk applications, such as diagnostic tools that provide critical clinical decisions, will likely fall into Class IIa, IIb, or III, necessitating more stringent conformity assessment procedures, including involvement of notified bodies.
For AI software classified as a medical device, manufacturers must conduct a thorough clinical evaluation to demonstrate its safety and performance.
For higher-risk AI software, this may include a full quality management system audit, design examination, or clinical investigation review by a notified body.
Interaction with the AI Act and Future Compliance Requirements
While the MDR currently governs AI software as medical devices, the upcoming Artificial Intelligence Act (AI Act) will introduce additional obligations for high-risk AI systems, including those used in medical applications. The AI Act, set to apply from August 2028, will layer further requirements on top of the MDR, particularly for AI systems classified as high-risk. This includes stricter rules on transparency, accuracy, cybersecurity, and human oversight, which will complement the MDR’s existing framework.
Under the AI Act, AI software used in medical devices will be subject to additional conformity assessment procedures, particularly if it is deemed high-risk. Manufacturers will need to ensure that their AI-driven medical devices meet both the MDR’s device-specific requirements and the AI Act’s broader AI-related obligations, creating a dual compliance landscape.
The transition to the AI Act will require manufacturers of AI software as medical devices to adapt their processes to align with both regulatory regimes. Additionally, manufacturers may need to implement new governance structures to ensure ongoing compliance with both the MDR and the AI Act, particularly as the AI Act introduces obligations for post-market monitoring and incident reporting tailored to AI systems.
Borderline Cases and Regulatory Clarity
One of the challenges in applying the MDR to AI software is distinguishing between medical devices and other regulated products, such as medicinal products or cosmetics. The MDR provides mechanisms for resolving borderline cases, including the involvement of the Medical Device Coordination Group (MDCG) and, where necessary, consultations with other EU agencies such as the European Medicines Agency (EMA) or the European Chemicals Agency. This ensures consistent qualification decisions across Member States, particularly for products that combine elements of medical devices with other regulated categories.
This is particularly relevant for AI systems that integrate with medicinal products or provide diagnostic outputs that may be considered in vitro diagnostic medical devices (IVDR). The MDR and IVDR (Regulation (EU) 2017/746) must be applied in harmony, with appropriate interactions during pre-market assessments and vigilance activities.
The MDR also addresses products that claim non-medical purposes but pose similar risks to medical devices. In such cases, the Commission may adopt common specifications to guide manufacturers in demonstrating conformity, particularly regarding risk management and clinical evaluation.
Required actions
- Classify software with a medical purpose under Rule 11 (most AI diagnostic software is Class IIa or higher) and obtain notified-body conformity assessment - Provide clinical evaluation, post-market surveillance and vigilance reporting; changes to AI algorithms may require re-assessment - AI medical devices are Annex I high-risk systems under the AI Act, with obligations applying from August 2028