AI‑Based Medical Devices: Regulatory Landscape and Emerging Roles
Dual Regulation Under the MDR and the AI Act
AI‑enabled medical devices (AIMDs) are currently governed simultaneously by the EU Medical Device Regulation (MDR/IVDR) and the EU Artificial Intelligence Act (AIA). This dual framework assigns responsibilities to economic operators in two parallel tracks: the manufacturer under the MDR and the provider under the AIA.
Key Economic Operators
Manufacturer (MDR): A natural or legal person who designs, manufactures, refurbishes, or markets a device under its own name or trademark.
Provider (AIA): A natural or legal person, public authority, agency, or other body that develops an AI system or a general‑purpose AI model and places it on the market or puts it into service under its own name or trademark.
In practice, the same entity often fulfills both roles, especially when a medical‑device company integrates an AI model developed by a software partner. The software partner is typically not considered the “provider” of the AIMD because the final responsibility rests with the device manufacturer.
Users vs. Deployers
User (MDR): Any healthcare professional or lay person who directly uses a medical device. Users do not carry regulatory obligations under the MDR, although national laws may impose certain duties.
Deployer (AIA): A natural or legal person, public authority, agency, or other body that uses an AI system under its authority. Deployers have explicit regulatory duties under the AIA, regardless of whether the actual operation is performed by individual clinicians.
Consequently, in a hospital setting the hospital (legal entity) is the deployer for the AI component, while doctors and nurses are the users of the medical device.
Proposed Legislative Change (December 2025 EC Proposal)
The European Commission’s draft regulation aims to simplify the regulatory picture by removing AIMDs from the scope of the AIA, except for the risk‑classification rule in Article 6(1). Under this scenario:
- AIMDs would be regulated solely by the MDR.
- All product responsibility would rest with the manufacturer as defined in the MDR.
- AI‑specific obligations could still be introduced via MDR delegated or implementing acts, covering aspects such as human oversight, data governance, and transparency.
The proposal is still under negotiation; the European Parliament supports removing AIMDs from the AIA, while the Council prefers maintaining the dual framework. The trilogue on 28 April 2026 ended without agreement, and discussions are expected to continue in May 2026.
Implications for Stakeholders
Manufacturers should anticipate continued AI‑related duties within the MDR, even if the AIA no longer applies. Preparing for potential MDR amendments that embed AI requirements will be crucial.
Healthcare organisations (hospitals, clinics) must monitor whether new MDR provisions will impose obligations similar to the current AIA duties for deployers. Until such changes materialise, they remain primarily responsible for the safe use of AIMDs as users under the MDR.
Software partners developing AI models for medical devices should clarify contractual arrangements, ensuring that the medical‑device manufacturer retains the “provider” role and ultimate liability.
Key Takeaways
- The MDR manufacturer and the AIA provider are usually the same entity, but their legal definitions differ.
- MDR “users” are individuals (clinicians, patients); AIA “deployers” are organisations with authority over AI use.
- The EC’s December 2025 proposal could consolidate AIMD regulation under the MDR, shifting all responsibility to the manufacturer.
- Future MDR delegated acts are likely to embed AI‑specific requirements, preserving AI‑related duties for manufacturers.
