Council wraps up first review of EU device reforms, flags key issues

The European Union's regulatory landscape for medical devices, governed by the Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR), is undergoing its first comprehensive review. This evaluation highlights persistent challenges in implementation, including notified body capacity, complex classification, and supply chain disruptions. A significant focus of the review and ongoing discussions concerns the operational implications arising from the recently enacted Artificial Intelligence Act (AI Act). The AI Act introduces a parallel, risk-based framework that classifies AI-enabled medical devices as 'high-risk,' imposing additional stringent requirements on manufacturers, particularly concerning technical documentation, quality management systems, risk management, and post-market surveillance. The interplay between these regulations necessitates an integrated compliance approach for legal and medical technology professionals.

The European Union's framework for medical devices and in vitro diagnostics, established by Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR) respectively, is currently under its first review, marking a critical juncture for the industry. These regulations, which became fully applicable in May 2021 and May 2022, aimed to enhance patient safety, transparency, and traceability within the EU market, replacing previous directives. However, their implementation has been fraught with challenges, leading to calls for adjustments to ensure a sustainable and effective regulatory environment.

Central to the ongoing discussions and the future trajectory of medical device regulation is the profound impact of the Artificial Intelligence Act (Regulation (EU) 2024/1689), which entered into force on August 1, 2024. The AI Act introduces a horizontal legal framework for artificial intelligence across various sectors, with significant implications for AI-enabled medical devices. This article will explore the key issues identified during the review of the MDR and IVDR, and critically examine the operational challenges and compliance requirements arising from the intersection of these device regulations with the new AI Act, offering insights for legal and regulatory professionals navigating this evolving landscape.

The Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR) represent a fundamental overhaul of the EU's legal framework for medical products, replacing the earlier Medical Devices Directive (93/42/EEC) and In Vitro Diagnostic Directive (98/79/EC). These regulations were introduced to address concerns regarding patient safety, keep pace with technological advancements, and ensure a robust, transparent, and sustainable regulatory system. Key changes included a broader scope, stricter clinical evidence requirements, enhanced traceability through Unique Device Identification (UDI), increased post-market surveillance, and more stringent requirements for Notified Bodies.

Despite their ambitious goals, the implementation of the MDR and IVDR has encountered significant hurdles. Persistent issues include a critical shortage and bottlenecking of Notified Body capacity, which are essential for conformity assessments, leading to delays in certification and market access. Manufacturers have also grappled with complex device reclassification rules, extensive documentation requirements, and the substantial time and financial investment needed for compliance, raising concerns about potential product shortages and stifled innovation within the EU.

Adding another layer of complexity, the EU Artificial Intelligence Act (AI Act) was adopted, establishing a risk-based approach to regulating AI systems. The AI Act categorizes AI systems into unacceptable, high, limited, and minimal risk, with corresponding obligations. Given the potential impact on individuals' health and safety, AI systems incorporated into medical devices are generally classified as 'high-risk' under the AI Act, triggering the most stringent compliance requirements. This dual regulatory burden has created a complex interplay that manufacturers must navigate.

The first review of the EU device reforms, particularly the MDR and IVDR, has underscored several critical challenges that continue to impede their smooth operation. A primary concern remains the severe bottleneck in the availability and capacity of Notified Bodies, which are crucial for conducting conformity assessments for medium to high-risk devices. This shortage has led to significant delays in product certification, impacting market access and potentially threatening the availability of essential medical devices. Furthermore, the complex reclassification rules under both MDR and IVDR have necessitated substantial efforts from manufacturers to update technical documentation and clinical evidence, often requiring retrospective data for legacy devices.

The emergence of the AI Act introduces a new dimension to these challenges, particularly for AI-enabled medical devices (AIMDs). The AI Act, published as Regulation (EU) 2024/1689, mandates that most AI systems integrated into medical devices will be considered 'high-risk,' thereby subjecting them to additional, rigorous requirements beyond those of the MDR/IVDR. This means manufacturers must comply with both regulatory frameworks, which, while sharing a risk-based approach and the CE mark pathway, are not fully harmonized in their concepts and obligations.

Operationally, the AI Act imposes several key obligations on providers of high-risk AI systems. These include maintaining comprehensive technical documentation specific to the AI-enabled functionality, implementing a robust Quality Management System (QMS) that ensures AI Act compliance, and establishing a rigorous risk management system to identify and mitigate potential risks to health, safety, and fundamental rights throughout the AI system's lifecycle. The AI Act also emphasizes data governance, requiring high-quality data for training, validation, and testing of AI systems, and mandates increased transparency and provision of information to deployers regarding safe operation, intended purpose, and potential risks.

Moreover, the AI Act introduces specific requirements for human oversight of AI-enabled medical devices by deployers, such as healthcare facilities. The need for Notified Bodies to develop expertise in AI systems for conformity assessments is also a significant implication, potentially leading to further delays and increased costs. While the EU Commission has acknowledged the complexities and published guidance (MDCG 2025-6) on the interplay between the AI Act and MDR/IVDR, open questions remain. There is an ongoing legislative effort, including a December 2025 proposal, to harmonize the AI Act's tenets for medical devices with the MDR/IVDR, potentially removing AIMDs from the AI Act's high-risk scope to streamline conformity assessment and reduce duplicated obligations. This proposed shift, anticipated by summer 2026 or 2027, aims to create a more unified framework, but the transition period itself may present further complexities.

The ongoing review of the EU's medical device regulations and the simultaneous implementation of the AI Act present a multifaceted challenge for legal and regulatory professionals in the medical technology sector. The persistent issues with Notified Body capacity, complex classification, and the sheer volume of documentation under MDR and IVDR are now compounded by the additional, albeit complementary, requirements of the AI Act for AI-enabled medical devices. The classification of most AIMDs as 'high-risk' under the AI Act necessitates an integrated and comprehensive approach to compliance, encompassing enhanced technical documentation, robust quality and risk management systems, and meticulous post-market surveillance.

Practitioners must proactively assess their product portfolios to identify AI-enabled devices and understand the specific obligations under both the MDR/IVDR and the AI Act. This includes updating quality management systems, ensuring data governance practices meet AI Act standards, and preparing for more extensive conformity assessments. While legislative efforts are underway to harmonize these frameworks and potentially simplify the regulatory pathway for AIMDs, the current environment demands vigilance and strategic planning. Staying abreast of forthcoming guidance from the Medical Devices Coordination Group (MDCG) and monitoring the progress of proposed legislative amendments will be crucial for ensuring continued market access and fostering innovation within the EU's evolving regulatory landscape.