Where the two regulations actually pinch.
EU AI Act evidence that also serves the MDR.
Three clinical settings.
A medical-AI vendor selling diagnostic imaging into EU hospitals.
- Annex IV doubles as the MDR technical-file annex.
- One sealed IFU package, a sharing token per hospital.
- Procurement checks the seal at a public verify URL.
A 600-bed hospital deploying vendor radiology and cardiology AI.
- Provider-only obligations hidden from the dashboard.
- Vendor IFUs imported, and the oversight plan pre-filled.
- Where Annex III applies, the deployer's FRIA goes to the clinical-governance committee.
A life-sciences group with research AI and clinical-operations AI.
- R&D provider and deployer obligations kept in separate organisations.
- Models used solely for scientific research sit outside the Regulation.
- A group view for the audit committee, a dossier per subsidiary.
13 obligations apply to a deployer of a high-risk system.
Features that fit governance built around the MDR.
EU AI Act for healthcare: questions clinical teams ask
Our AI is already a medical device under the MDR. Does the EU AI Act add a second conformity assessment?
Usually not a separate one. Clinical AI reaches high-risk via the Annex I product route, so EU AI Act conformity travels with the MDR notified-body procedure. Veritome records the pathway at the Art. 43 step.
We are a hospital deploying vendor AI. What do we actually owe?
The Art. 26 deployer duties: use per the instructions, human oversight, logs and worker notification. Where the system is Annex III and you act in a public-services capacity, the Art. 27 FRIA too.
Does patient data change the register?
Yes. Special-category health data brings GDPR Art. 9 and a DPIA into the system's register, and the FRIA's answers sit under the DPIA's Art. 35(7) headings.
Is a DPIA a substitute for the FRIA?
No. The FRIA is its own assessment under Art. 27, though Art. 27(4) lets it build on an existing DPIA. Necessity and proportionality still need the DPIA's own analysis.