Adding AI to a medical device: usability and the AI Act's 2028 rules
Gideon Awolesi ·
If you add AI to a medical device, you're now designing for two sets of rules: the MDR or IVDR, and the AI Act. For a lot of devices, the AI Act's high-risk requirements apply, and since the Digital Omnibus on AI, they apply from 2 August 2028. The good news is that the two are meant to work together, through one conformity assessment and one set of technical documentation. The work that's new lands mostly on the interface: transparency, human oversight, and usability.
01When an AI medical device is high-risk
Under Article 6(1) of the AI Act, an AI system is high-risk if it's a medical device, or a safety component of one, and the device has to go through conformity assessment with a notified body under the MDR or IVDR. The joint guidance from the Medical Device Coordination Group and the AI Board, MDCG 2025-6, spells out what that means by class.
| Not high-risk under the AI Act | High-risk under the AI Act | |
|---|---|---|
| MDR | Class I that isn't sterile, measuring, or reusable surgical | Class I sterile, measuring, or reusable surgical, and classes IIa, IIb, and III |
| IVDR | Class A that isn't sterile | Class A sterile, and classes B, C, and D |
The AI Act doesn't change your device's MDR or IVDR class. It's the other way round: the class decides if the AI Act's high-risk rules apply.
02The dates
The AI Act originally applied its high-risk rules to products like medical devices from 2 August 2027. The Digital Omnibus on AI, Regulation (EU) 2026/1744, moved that to 2 August 2028. MDCG 2025-6 was published in June 2025, before the change, so it still mentions 2027.
03One conformity assessment, one technical file
You don't run two separate processes. The MDR or IVDR conformity assessment is the one you follow, and the notified body assesses the AI Act's requirements for high-risk systems as part of it. The AI Act also asks for a single set of technical documentation, so the AI Act evidence goes into the same file as your MDR or IVDR evidence.
04Transparency in the interface
MDCG 2025-6 says information on how the AI contributes to the device's performance should appear in the instructions for use or the user interface, and that manufacturers should provide interpretation tools and user interfaces that make the AI's outputs meaningful. In practice, that means showing clinicians what the output is based on, how sure the system is, and where it's known to be less reliable, at the point where they make the decision.
05Human oversight as a risk control
Article 14 asks that people can understand the system, stay aware of over-relying on it, interpret its output, override it, and stop it. MDCG 2025-6 suggests treating oversight as a risk control measure, in the same order as other risk controls: safe design first, then protective measures and alarms, then information for safety.
It also makes a point that's easy to miss: for a highly autonomous device, the design shouldn't allow human intervention during critical phases if that intervention would put the patient at risk. So oversight isn't always "more buttons". Sometimes it's deciding carefully where a person can step in.
06Usability engineering
The MDR and IVDR already ask you to reduce the risk of use errors, taking into account users' knowledge and training, and a lot of teams do that with IEC 62366-1. AI adds new use errors to look for: trusting a wrong output, misreading a confidence level, or not noticing that the system is outside the range it was tested on. Add these to your hazard-related use scenarios, and test them with people from your user group.
If you also sell in the US, the FDA's draft guidance on AI-enabled device software functions, from January 2025, asks for a full picture of the user interface in your submission, and for usability evaluation that shows users can find, understand, and apply the information the device gives them.
07Where to start
- Check your device's MDR or IVDR class to see if the AI Act's high-risk rules apply.
- Add AI-specific use errors to your use-related risk analysis.
- Design the interface for transparency and oversight, and test it with representative users.
- Put the AI Act evidence into the same technical documentation as your MDR or IVDR evidence.
Our Usability Review checks your usability engineering file against IEC 62366-1 and the FDA's guidance, clause by clause, including AI-specific use errors, in four weeks from €6,000.