Does the EU AI Act apply to my AI system, and what obligations do I have alongside MDR, IVDR and GMP?
The EU AI Act (Regulation (EU) 2024/1689) captures AI in life sciences mostly as high-risk AI: AI as a safety component of a medical device, or as a product that is subject to a conformity assessment by a notified body under MDR or IVDR, falls into the strictest tier via Art. 6(1). For this tier, Art. 8 to 15 apply: risk management, data governance, technical documentation, human oversight and robustness. The decisive point is not a second stack of files, but integration: those who embed AI Act evidence into the existing MDR/IVDR documentation and the QMS avoid the duplicate documentation world on which these projects fail.
- MedTech
- IVD
- Pharma
- Biotech
Overview
What obligations does the EU AI Act place on AI in life sciences?
AI in medical devices, IVDs and GxP · EU AI Act (EU 2024/1689) Art. 6–15, MDR (EU 2017/745), IVDR (EU 2017/746), draft GMP Annex 22
Last updated: 2026-06-12
The EU AI Act (Regulation (EU) 2024/1689) has been in force since August 2024 and introduces a second compliance layer alongside MDR and IVDR for AI in medical devices, IVDs and GxP processes. The obligations depend on the risk class. The four points where life science projects most often get stuck:
- Classification as high-risk AI: AI as a safety component, or as a product that is subject to a conformity assessment by a notified body under MDR or IVDR, qualifies as high-risk AI via Art. 6(1). Annex III (Art. 6(2)) additionally captures AI in certain use cases independently of product law. The risk class must be determined and documented first, before the scope of obligations can be derived.
- Obligations for high-risk AI under Art. 8 to 15: continuous risk management (Art. 9), data governance with evidence of representativeness and bias (Art. 10), technical documentation under Art. 11 and Annex IV, human oversight (Art. 14), as well as accuracy, robustness and cybersecurity (Art. 15).
- Concurrency with MDR (EU 2017/745) and IVDR (EU 2017/746): Software as a Medical Device is subject to both frameworks at the same time. The AI Act requirements must be integrated into the existing technical documentation and the QMS, rather than maintaining a second set of documents.
- AI in GxP processes: For AI in pharmaceutical manufacturing, quality control and laboratory systems, the draft EU GMP Annex 22 (consultation 2025) addresses an additional layer on top of Annex 11, for example model monitoring and AI-specific change control. The annex is not yet final; the requirements should be factored in early.
Services
How we support you
EU AI Act gap analysis & classification
Classification of your AI system under Art. 6 (product route under (1) or use-case list in Annex III), comparison against the high-risk requirements Art. 8 to 15, and a prioritised action list with a roadmap. Deliverable: documented risk class and gap report referencing the relevant articles.
Integration with MDR & IVDR
A harmonised framework that maps the EU AI Act and MDR (EU 2017/745) or IVDR (EU 2017/746) without duplicate documentation. Deliverable: mapping of the AI Act obligations onto existing technical documentation and QMS processes.
Learn more →Technical documentation under Annex IV
Preparation of the AI-specific technical documentation under Art. 11 and Annex IV: system description, training data documentation, performance metrics, description of human oversight and robustness assessment. Deliverable: an Annex IV compliant dossier.
Learn more →Data governance & human oversight
Data documentation under Art. 10 including sources, bias review and evidence of representativeness, plus demonstration of human oversight under Art. 14 through design and UX. Deliverable: data governance dossier and human oversight description.
Post-market monitoring for AI
Building the AI Act post-market monitoring under Art. 72, integrated with MDR/IVDR post-market surveillance: monitoring of model performance, concept drift and undesirable outputs. Deliverable: AI monitoring plan, interlocked with the existing PMS system.
Learn more →AI in GxP under Annex 22
Extension of the existing CSV framework (Annex 11) with the requirements of the draft Annex 22 for AI in GxP processes: model monitoring, traceability and AI-specific change control. Deliverable: an Annex 22 oriented extension of the validation documentation, designed for the final annex.
How we work together
What it comes down to
The EU AI Act (Regulation (EU) 2024/1689) does not require a second, free-standing stack of files for AI in life sciences, but a second layer of evidence on the same product. The sequence is decisive: first the risk class under Art. 6 must be established - for AI as a medical device or safety component via (1), for the use cases in Annex III via (2) - because only it determines whether the obligations under Art. 8 to 15 apply at all. Once the classification as high-risk AI is established, risk management (Art. 9), data governance (Art. 10), technical documentation under Annex IV (Art. 11), human oversight (Art. 14) as well as accuracy and robustness (Art. 15) must be evidenced. Those who skip this classification build evidence for a scope of obligations that may not even apply, or overlook obligations they should already be meeting.
The real bottleneck lies in the concurrency: Software as a Medical Device is subject to MDR (EU 2017/745) or IVDR (EU 2017/746) and the AI Act at the same time, and AI in GxP processes additionally to the draft EU GMP Annex 22. Those who run these frameworks as separate projects create redundant documentation and conflicting versions. We therefore start early with the integration model: the AI Act obligations are mapped onto the existing technical documentation, the QMS and the post-market system, so that each requirement is evidenced once and consistently rather than twice and divergently.
Our approach
Our approach
Step
Result
Scoping & classification
Determined risk class under Art. 6 (product route under (1) or Annex III under (2)), documented with rationale; clarified whether high, limited or minimal risk applies.
Gap analysis
Target-versus-actual comparison against Art. 8 to 15, prioritised action list referencing MDR/IVDR and, where relevant, Annex 22.
Framework design
Defined integration model: AI Act obligations mapped onto existing technical documentation, QMS and PMS, without duplicate record-keeping.
Documentation & evidence
Technical documentation under Annex IV, data governance dossier under Art. 10, human oversight and robustness evidence under Art. 14 and 15.
Conformity assessment
AI Act requirements embedded into the conformity assessment under MDR/IVDR, notified body findings worked through in a structured manner.
Post-market & operation
Post-market monitoring under Art. 72 in operation, interlocked with PMS and, for GxP AI, with the Annex 22 change control.
Common pitfalls
Where projects commonly fail
The risk classification is not formally documented.
Art. 9 EU AI Act requires a documented risk management system; a classification that is discussed internally but not recorded counts as not met in an audit and forces rework before any obligations can even be derived.
The AI Act and MDR are run as separate projects with their own sets of documents.
Software as a Medical Device is subject to both frameworks at the same time; without integrating the technical documentation under Annex IV with the MDR technical documentation, you create redundant maintenance effort and conflicting versions.
Data governance under Art.
10 is set at the level of ordinary ML development. The AI Act demands more: source evidence, bias review and documented representativeness of the training, validation and test data. Without this evidence, a central high-risk requirement remains open.
Human oversight under Art.
14 is assumed but not evidenced. Human oversight must be implemented as a design principle and demonstrated through design and UX documentation; the fact that a user can theoretically intervene is not enough without a documented mechanism.
AI in GxP processes is only assessed against Annex 11.
The draft EU GMP Annex 22 anticipates additional requirements for AI such as model monitoring, traceability and AI-specific change control; those who align the CSV framework with these today avoid rework once the annex is final.
FAQ
Frequently asked questions
Sources
- Regulation (EU) 2024/1689 (EU AI Act): primary text, Art. 5, 6, 8–15, 72, Annex III, Annex IV
- Regulation (EU) 2017/745 (MDR): primary text
- Regulation (EU) 2017/746 (IVDR): primary text
- EU GMP Annex 22 (draft, consultation 2025): AI in GxP processes; EU GMP Annex 11: computerised systems
- ISO/IEC 42001:2023: AI management system; IEC 62304: software life cycle for medical device software
- Entourage landing page ai-compliance (EU AI Act Readiness Check, internal source material)
- https://theentourage.de/expertise/ki-regulierung-life-sciences/ (existing page content, revised)
Life Science Journal
Regulatory updates, straight to your inbox.
New requirements, authority decisions and practice notes. Once a month, unsubscribe any time.
Case Studies
What this looks like in practice
Related insights
All insights →Regulations & standards considered
- Regulation (EU) 2024/1689 (EU AI Act)
- EU AI Act Art. 5 (Prohibited AI practices)
- EU AI Act Art. 6(1) (High-risk AI as a product or safety component under MDR/IVDR)
- EU AI Act Art. 6(2) + Annex III (High-risk AI per use-case list)
- EU AI Act Art. 9 (Risk management system)
- EU AI Act Art. 10 (Data and data governance)
- EU AI Act Art. 11 + Annex IV (Technical documentation)
- EU AI Act Art. 14 (Human oversight)
- EU AI Act Art. 15 (Accuracy, robustness and cybersecurity)
- EU AI Act Art. 72 (Post-market monitoring)
- EU 2017/745 (MDR)
- EU 2017/746 (IVDR)
- EU GMP Annex 22: draft (AI in GxP processes)
- EU GMP Annex 11 (Computerised systems)
- IEC 62304 (Software life cycle for medical device software)
- ISO/IEC 42001:2023 (AI management system)
Related topics
MDR Consulting →
Conformity assessment under EU 2017/745, into which the AI Act obligations are integrated
IVDR Readiness →
The counterpart for AI-supported in vitro diagnostics under EU 2017/746
Post-Market Surveillance →
PMS under MDR/IVDR, interlocked with the AI Act monitoring under Art. 72
Risk Management →
Risk management as the basis for Art. 9 EU AI Act and ISO 14971
Have a concrete project?
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +49 89 4161170-0
info@theentourage.de
- Reply usually within one working day
- 4 offices: DE · CH · IT · US
- 100% life sciences