The European AI Act and Medical Devices: What Happens in August 2026 and What Happens in August 2027

Everyone is talking about the AI Act. Most people in the industry can't explain what exactly applies and when. Here's the distinction it's crucial to understand before deciding whether to act now.

If you've been following regulatory news over the past year, you've surely come across the phrase, "The European AI Act will enter into force in 2026." That's correct. But it also doesn't tell the whole story.

The AI Act (Regulation EU 2024/1689) is a regulation that enters into force in stages over several years, with each stage addressing a different type of AI system. For the medical device industry, the critical distinction is between August 2026 and August 2027, and between those falling under Annex III and those falling under Annex I in conjunction with Article 6(1).

If that last sentence sounded too technical, you've just hit on the problem: most people in the industry are not familiar with this distinction, and therefore don't know whether they need to act now or if they still have time.

Timeline: What's Already in Force and What's Not

The AI Act officially entered into force on August 1, 2024. Since then, several stages have been activated:

February 2025: Prohibitions on AI uses considered an unacceptable risk, such as social scoring, psychological manipulation, and real-time biometrics in public spaces, will be enforced. AI literacy requirements for employees will also come into effect.

August 2025: Requirements for general-purpose AI (GPAI) models, governance structures, and financial penalties will begin to apply.

August 2026: Most requirements for high-risk AI systems will enter into force, including for medical devices in certain categories.

August 2027: A further, later stage, which applies specifically to medical devices where the AI is a safety component of a regulated product.

The Important Distinction: Annex III versus Annex I

This is where the biggest confusion in the industry lies.

Annex III details use-case categories considered high-risk by the AI Act itself, regardless of existing product regulations. Examples: use of AI for biometrics, employee screening, credit scoring. Those falling under Annex III must comply with the full requirements of the AI Act from August 2026.

Annex I in conjunction with Article 6(1) refers to products already subject to existing European legislation, specifically MDR 2017/745 and IVDR 2017/746. A medical device that contains an AI component which is a safety component of the device, or is itself an AI medical device, falls into this category. Those here have been granted an additional transition period: until August 2027.

For example: An SaMD software for diagnosing lung cancer based on CT scans, which requires CE marking under the MDR and conformity assessment by a notified body, falls under Article 6(1) and Annex I. Therefore, the stringent requirements of the AI Act will apply to it from August 2027, not 2026. In contrast, an AI system for screening job applicants under Annex III must comply with the requirements as early as August 2026.

What Are the Actual Requirements for AI-Enabled Medical Devices

The requirements imposed by the AI Act on high-risk AI systems are substantial. They do not replace the MDR, but they add layers that do not exist in it:

AI Risk Management: Beyond the standard ISO 14971, a risk management process specific to the nature of AI systems is required, including risks of bias, model drift, and training data quality.
Data Governance: Strict documentation of the datasets used to train the model, validation data, and testing data. The quality, relevance, and absence of biases must be documented.
Transparency: An obligation to provide "deployers" (i.e., hospitals, clinicians) with clear information about the system's capabilities and limitations to enable genuine human oversight.
Human Oversight: The system must be designed so that professionals can monitor, understand, intervene, and override the AI's outputs.
Reporting and Registration: High-risk systems must be registered in the European EU AI database, which is supposed to be publicly available, although as of January 2026 the database was not yet open.
Expanded Quality Management System: Article 17 of the AI Act requires a quality management system that covers AI-specific aspects, including algorithm lifecycle management, change control processes, and post-market surveillance of model performance.

The Digital Omnibus: Could the 2026 Deadline Be Postponed?

Here, another factor worth monitoring comes into play.

In November 2025, the European Commission published the Digital Omnibus, a regulatory package proposing changes in several digital areas. Regarding the AI Act, the Omnibus proposes a unique mechanism: the requirements will come into force not on a fixed date, but approximately 6 months after the Commission confirms that "support measures" are available, such as harmonised standards, implementation guidelines, and common specifications. The proposed end date is December 2027 for Annex III categories, and August 2028 for medical devices in Annex I.

This proposal is still in the co-decision process in the European Parliament and the Council. In other words, it is not yet in force. The official dates as of today are August 2026 and August 2027. If the Omnibus moves forward, the timeline might be extended, but this cannot be relied upon in current planning.

Why It's Worth Starting Now, Even if There's "More Time"

Even if a medical device in the Annex I/MDR category is eligible for the transition period until 2027 or beyond, there are three strong reasons to start preparations now:

First, gap analysis takes time. Understanding the mapping between existing MDR requirements and the new AI Act requirements is not trivial. Data documentation, algorithm management, and human oversight planning are areas likely not sufficiently covered in existing documentation.

Second, Notified Bodies are already asking. Even before the requirements officially enter into force, Notified Bodies conducting MDR audits of devices with AI are already starting to ask questions about algorithm management, training data quality, and model change management. Companies that prepare for the AI Act's requirements will also improve their performance in today's MDR audits.

Third, European standards are evolving. The Commission and CEN/CENELEC are working on harmonised standards that will provide a "presumption of conformity" with the AI Act, similar to how ISO 13485 provides a presumption of conformity with MDR requirements. When the standards are released, companies that have already built an infrastructure according to the requirements will be close to compliance. Those who only start then will be behind.

What You Can Do Now

Classify the device under the AI Act: Is your device in Annex III, Annex I/Article 6(1), or both? What is the relevant timeline for you?
Gap Analysis: Perform a gap analysis between your existing quality system documentation and the requirements of Article 17 of the AI Act. Focus specifically on data governance, model change management, and human oversight planning.
Algorithm Lifecycle Management: Do you have a defined process for post-market monitoring of model performance, drift detection, and update management? This is an explicit requirement of the AI Act that is often missing even from MDR documentation.
Chain of Responsibility: The AI Act also defines obligations for "deployers," i.e., hospitals and clinicians. You must ensure that the Instructions for Use (IFU) and Technical Documentation provide sufficient information to enable the deployer to fulfill their obligations.
Monitor the Digital Omnibus: If the timeline changes, an announcement will come from the European Commission as part of the legislative process. Stay updated via the MDCG and the Commission's AI Act Service Desk.

In Conclusion

The AI Act is not a future document; it is already partially in force. For medical device companies, the most direct deadline may be August 2026 (Annex III) or August 2027 (Annex I, medical devices with AI as a safety component). But preparation, gap analysis, data governance documentation, and human oversight planning are processes that take time and cannot be left until the last minute.

Anyone developing SaMD, a device with AI for diagnostics, or any product that incorporates AI as a functional component, needs to start a conversation today between the regulatory team, the development team, and the quality manager, and map out the relevant requirements before the deadline clock hits zero.