Medical and clinical AI sits where technical performance, product regulation, human oversight, patient safety, and evidence continuity meet. The business needs to know what the AI is, what regulated product it belongs to, what decision it influences, and whether the current evidence still supports that use.
Article 6 classifies certain AI systems as high-risk when they are products or safety components covered by Annex I legislation and subject to third-party conformity assessment. The Regulation specifically includes medical devices and in vitro diagnostic medical devices among the relevant product categories and requires continuing risk management and other high-risk controls.
Start with the actual system, role, use case and evidence boundary. The same regulation can produce different obligations for different actors and systems.
Article 6 can classify AI as high-risk when it is a product, or a safety component of a product, covered by Annex I legislation and the product requires third-party conformity assessment. Medical devices and in vitro diagnostic medical devices are specifically included in that product framework.
Clinical decision support, diagnostics, triage, treatment recommendations, monitoring, prioritization, and other health-related uses should be classified by intended purpose and actual decision role—not by the fact that the product uses AI.
For high-risk systems, the Act requires a continuous risk-management process and human-oversight measures appropriate to the intended purpose. Preserve who can review, override, interrupt, or refuse reliance on the AI output.
Healthcare systems evolve. Preserve versions, validation data, performance evidence, risk controls, instructions, post-market information, material changes, and the revalidation basis so an old clinical claim does not silently attach to a new system state.
The goal is not merely to reach an answer. It is to preserve what facts, evidence, scope and limitations supported that answer at that time.
Separate the medical device or IVD, the AI component, external models, cloud services, clinical workflow, and downstream human decision. The correct boundary determines which product and AI Act obligations attach.
Determine whether the system enters the Annex I product route, an Annex III route, or another obligation pathway. Preserve the basis for the classification rather than relying on a generic “healthcare AI” label.
Connect risk management, technical documentation, validation, data governance, logging, instructions, human oversight, accuracy, robustness, cybersecurity, and post-market evidence to the claims they support.
A changed model, dataset, intended purpose, indication, workflow, threshold, user population, product integration, or legal-source state can change whether yesterday’s evidence remains admissible for today’s use.
Choose the smallest operating tier that fits the portfolio today. Upgrade when system count, team size or governance scope actually requires it.
Keep a living system-level evidence record with obligations, gaps, versions and revalidation state.
START EVIDENCE PASSPORT →Coordinate evidence, owners, documentation, incidents and team compliance work in one governed workspace.
START COMPLIANCE WORKSPACE →Operate broader high-risk, GPAI, FRIA, post-market and material-change governance across a growing portfolio.
START GOVERNANCE PRO →Run institutional governance with expanded users, authority workflows, examiner rooms and portfolio reporting.
START INSTITUTION →Use the free classifier to establish the system, intended purpose, possible actor role, EU exposure and unresolved facts. When continuing evidence infrastructure is needed, paid access begins at $19 per month. Independent human readiness review remains a separate service.
They can be. Article 6 treats an AI system as high-risk when it is a product, or a safety component of a product, covered by Annex I legislation and the relevant product requires third-party conformity assessment. Medical devices and in vitro diagnostic medical devices are included among those product categories.
Not necessarily. The Regulation expressly distinguishes AI Act high-risk classification from the risk classification used in the relevant product legislation. The two regimes can apply together without using the same risk labels.
Among other requirements, high-risk systems are subject to risk management, data governance, technical documentation, record-keeping, transparency and instructions for use, human oversight, and requirements relating to accuracy, robustness and cybersecurity.
The intended purpose and degree of influence over the clinical decision are critical. Organizations should preserve the system’s role, performance evidence, limitations, human-review requirements, escalation paths, and the exact conditions under which outputs may or may not be relied upon.
No. Model updates, new data, changed clinical workflows, new patient populations, revised thresholds, changed intended purpose, or altered product integration can make prior validation or classification evidence stale.
No. TA-14 can preserve the classification basis, evidence, gaps, review history, change events, and revalidation state. It does not itself provide legal advice, medical-device conformity assessment, certification, or regulatory approval.
TA-14 Exchange Activity
Live cumulative activity recorded across the public Exchange surface.
···
Visitors
Recorded public visitors
···
Page Views
Recorded Exchange views