FACT SHEETMarch 2023

THE EU MEDICAL DEVICES REGULATION
AND THE EU AI ACT: A SHORT COMPARISONTWO DIFFERENT FRAMEWORKSIn April 2021, the European Commission proposed
the Artificial Intelligence Act, which is now
debated in the EU parliament. The AI Act (AIA) isthe EU’s first attempt to create a comprehensive
AI regulatory framework and aims to ensure theprotection of fundamental rights in this field. AI
applications used in healthcare are often ‘medical
devices’ and are thus regulated under the EU
Medical Devices Regulation (MDR).
In its current version, the AI Act only regulates
AI medical devices that are subject to the MDR.
Other health-related AI applications fall outside
the scope of the AI Act. However, also the MDR is
not fully adapted to the risks posed by AI. Whileboth the AI Act and the MDR are risk-based,
the comparison below shows the differences inassessment criteria. For AI medical devices, theAI Act provides improvements for fundamental
rights but also needs some specifications to fill
the gaps left by the MDR.

Fundamental rights include interalia the right to life, the right toprivacy, as well as the prohibitionof discrimination. Such rights
are enumerated in various
human rights instruments, suchas the European Convention on
Human Rights.
The increasing use of AI
threatens such fundamentalrights. AI systems are trainedon the basis of large databases,
which are too often low-quality
and full of biases. When usedwithin AI systems, this canlead to discrimination. In thehealthcare context, these biases
or AI errors may lead to patient
harm.

FACT SHEET – THE EU MEDICAL DEVICES REGULATION AND THE EU AI ACT1

The Medical Devices Regulation

The AI Act

Art. 51 of the MDR divides medical devices into
four classes based on a different level of risk
according to their intended purpose: “low risk”
devices are listed in Class I, medium risk devices
in Class IIa and Class IIb, and all high-risk
devices in Class III.

The AIA distinguishes between AI applications
that present I) an intolerable risk, II) a high risk,and III) a low or negligible risk. It generally
considers devices regulated in the MDR to be“high risk”.

Medical devices are classified according to somespecific criteria: duration of contact with thepatient, the invasiveness, type of operation andanatomical site on which the device acts.

Art. 6 AIA lists two conditions for theassessment of high-risk medical devices:
they must be used as a safety component of a
product, or are a product, and they are required
to undergo a third-party conformity assessment
under the MDR.

For medium- and high-risk devices,manufacturers are required to conduct a
conformity assessment that includes an audit ofa notified body.

Article 17 also requires a conformity assessment:
examination, test and validation proceduresmust be carried out before, during and after thedevelopment of the high-risk AI system.

Human oversight is not required and attention
to data quality is only present in the post-market
clinical follow-up procedure.

Human oversight as a risk management measureon high-risk medical devices is provided in
Article 14. The quality of data must be “relevant,representative, free of errors and complete”
and AI systems are subject to data governanceand management practices.

In short: one of the primary issues with the MDR
is that a lot of AI applications are not covered.
Many AI applications utilised in the healthcare
industry are therefore excluded, including
various lifestyle and health apps. This meansthat the AI Act’s rules for high-risk AI also do notapply.

problems, such as worse health outcomes for
ethnical and racial minorities or women, it
is necessary to improve the transparency ofalgorithms and the quality of data collected, andto establish a human rights impact assessment
for all AI-based medical devices. With the new
proposal of the AI Act still at the negotiation table,
there is an opportunity to implement stronger
protections for fundamental health rights in theAI Act.

The MDR is more concerned with establishingtechnical standards for risk assessment topreserve physical safety than with preventing
potential discrimination due to the use of medical
devices. In that sense, it is not a patient’s rightsinstrument.
On the other hand, although the AIA guarantees
better protection of the fundamental rights ofpatients in the field of health, it still has someshortcomings. In particular, the AIA deals withAI in general and does not provide for specificmeasures in the health sector, which means thatthe list of high-risk AI devices in Annex III does
not include a specific section on “healthcare”.
Considering the possibility of AI-based medicaldevices causing diversity and discrimination

CONTACTJanneke van Oirschot: janneke@haiweb.org
Hannah van Kolfschooten: hannah@haiweb.org
With thanks to Claudia Nicastro, legal researchintern.
This work was made possible thanks to the support of the European Artificial
Intelligence & Society Fund.

FACT SHEET – THE EU MEDICAL DEVICES REGULATION AND THE EU AI ACT2