The AI Act will take effect in August 2027
High-risk AI must comply with the AI Act starting in August 2027. MDCG 2025-6 governs the interaction with the MDR/IVDR. Those who start planning early and in a structured manner gain planning certainty.
EU AI Act · MDCG 2025-6 High-Risk AI · Data Strategy PCCP · EU & FDA
AI Regulation for Medical Devices: AI from a Single Source – Robust and Maintainable
AI in medical devices is not a traditional software project; rather, it requires an appropriate process framework. We consistently integrate the software life cycle, data strategy, risks, and evidence—embedded within the QMS and technical documentation rather than managed in parallel—ensuring that changes are controllable and the necessary evidence is generated.
3+
Years of AI classification
10+
Intended-Use Assessments
15+
Gap Analyses & Implementation Strategies
3+
AI & MDSW Experts
What It's All About
A Comprehensive Approach to AI Regulation—Not in Silos
Metecon supports manufacturers throughout the entire software life cycle: from regulatory categorization and classification, through architecture, data strategy, and risk management, to verification, validation, and post-market surveillance. We prioritize decision-relevant requirements early on, ensure clear interfaces with software development, cybersecurity, risk management, and technical documentation, and keep changes and further developments under control. The goal is to create robust AI processes that are operationally feasible—traceable during audits and maintainable throughout the product life cycle.
Intended for: Heads of Regulatory Affairs / Regulatory Leads and Heads of Software / Development Managers, as well as executives at SaMD manufacturers with AI-driven product strategies and Quality Management Leaders.
Typical Challenges
Three Problems That Arise Without a Comprehensive Framework for AI Regulation
Regulatory Considerations Are Coming Too Late
AI systems are being developed, but regulatory requirements are coming too late—resulting in rework and delays.
Data, Development, and QM Without Integration
Interfaces between development, quality management, and regulatory affairs are unclear—documentation is created in isolation and is inconsistent across departments.
AI, Software, and Approval Are Considered Separately
Requirements are considered separately. Regulatory requirements are not implemented. The necessary supporting documentation is not available, and the resulting changes are extremely time-consuming.
Classification at a Glance
When AI Becomes High-Risk AI—and What That Means
The AI Act and MDR/IVDR apply in parallel. We clearly classify your product and integrate the requirements of both frameworks into a consistent documentation structure.
AI Act × MDR/IVDR
Data Strategy & Documentation
EU vs. FDA & ISO 42001
AI Act × MDR/IVDR (MDCG 2025-6)
If the AI itself is a medical device (or safety component) and a Notified Body is involved in the conformity assessment, it is considered high-risk AI. This typically applies to MDR class IIa+ or IVD class B+. The AI Act classification does not change the MDR class—the regulatory frameworks build upon one another.
High-Risk Classification of the AI System
Procedure for classification under article 6 of the AI Act.
Integrated Rather Than Parallel
Integrate AI Act requirements into the existing QMS and technical documentation; do not create duplicate systems.
Transparency & Human Oversight
Practical implementation of transparency and human oversight requirements (AI Act, Art. 14).
Relevant Fundamentals
- EU AI Act (2024/1689)
- MDCG 2025-6 (interaction between the MDR/IVDR and the AI Act)
- MDCG 2019-11
- High risk once a Notified Body is involved (typically MDR class IIa+/IVD class B+)
- Full compliance as of August 2027
Data Strategy & Evidence
The data strategy determines the capabilities of the resulting AI:
The origin, quality, representativeness, and traceability of the data form the basis for any demonstration of the AI’s validity for its intended purpose.
Data Governance
document training, test, and validation data in a traceable manner, including evidence of the data's independence
Proof of Performance
conduct of verification and validation of the AI function in a robust and traceable manner
AI Risk Management
structured assessment of risks arising from data quality and model behavior (ISO 14971 + ISO/IEC 23894)
Relevant Fundamentals
- ISO/IEC 23894 (AI risk management)
- ISO/IEC 24029 (robustness)
- ISO 14971
- Data strategy as a prerequisite for assessment and model maintenance
The EU vs. the FDA & the Role of ISO/IEC 42001
The EU and the FDA pursue similar goals through different approaches. The FDA focuses on integrating the requirements into the existing regulatory framework. With the AI Act, the EU is pursuing its own regulatory framework for AI, which is harmonized with other laws such as the MDR/IVDR.
PCCP & GMLP
Define planned model changes in advance so that predictable changes can be made without the need for re-approval.
Classify ISO/IEC 42001
Realistically assess the benefits and limitations for your own QMS: not harmonized, generic. We prevent duplicate effort.
Relevant Fundamentals
- FDA: GMLP
- predetermined change control plan (PCCP)
- IMDRF
- ISO/IEC 42001 (AI management system, not harmonized)
- distinction from ISO 13485/27001
Building on each other, not duplicating
The AI Act classification does not change the MDR class. AI Act requirements must be integrated into the existing QMS and technical documentation. ISO/IEC 42001 helps with the integration of AI-specific requirements into the existing process landscape.
Decision-Making Guide
High-Risk AI? A Three-Step Classification
According to Article 6 of the AI Act and MDCG 2025-6, AI in a medical device is considered high-risk AI if both of the following conditions are met:
1 • Medical device?
Is the AI software itself a medical device or a safety component of one?
2 · Notified Body?
Is a Notified Body involved in the conformity assessment (typically MDR class IIa and higher / IVD class B and higher)?
3 · High-Risk AI
If both apply: The AI Act and MDR/IVDR apply in parallel, integrated into the QMS and technical documentation.
Special Case: Class I / Not a Medical Device:
If no Notified Body is involved, Annex III of the AI Act requires special attention. The AI Act classification does not change the MDR risk class.
If no Notified Body is involved, Annex III of the AI Act requires special attention. The AI Act classification does not change the MDR risk class.
AI Across the Product Life Cycle
From Classification to Market Maintenance in six Steps
1
Categorization & Classification
regulatory categorization of AI software and classification (MDCG 2019-11), including high-risk assessment
2
Architecture & Data Strategy
The backbone of robust AI: software architecture and a traceable data life cycle for training, test, and validation data. The foundation for any future verification.
3
AI Risk Management
assessment of data, model, and change risks (ISO 14971 + ISO/IEC 23894), ensurance of transparency and human oversight, implementation of appropriate measures to ensure the safe use of AI in the product or as a product
4
Verification & Validation
provision of robust evidence of AI performance and traceability
5
Changes & PCCP
keeping model, data, and architecture changes under control via a predetermined change control plan
6
Post-Market Surveillance
systematic incorporation of market data into evaluation, model maintenance, and further development
The data life cycle is the backbone
The origin, quality, traceability, and timeliness of the data determine the validity of the AI.
Why Metecon
AI Expertise that Meets Industry Benchmarks
AI Act Mapping & High-Risk Classification
use-case analysis and classification in accordance with the AI Act and MDCG 2025-6, with clearly defined actions
Data Strategy & Data Governance
reliable, traceable data processes for training, validation, and updates, to serve as regulatory evidence
PCCP & Change Management
predetermined change control plan and significant change assessment, changes are manageable rather than risky
Putting ISO/IEC 42001 into Perspective
an AI-based management system with a sense of proportion: clear benefits and limitations, no duplicate effort required for ISO 13485 compliance
EU & FDA from a Single Source
Consider the AI Act and FDA GMLP/PCCP together. Develop requirements once and use them for both markets.
Claims risk clearly defined Integrated monitoring concept 3+ AI & MDSW experts
Part of the Metecon Group: 25+ years of regulatory experience, 50+ compliance experts, and offices in Mannheim (Germany) and Bern (Switzerland). We translate complex regulations into feasible strategies.
Our benchmarks are based on the strengths of leading providers: the substantive mapping of regulatory requirements by specialized knowledge centers, PCCP/change control approaches, and AI governance tools. Metecon meets these criteria and combines them with end-to-end implementation "from a single source", embedded within the MDSW documentation framework (link).
Part of the MDSW family
AI is not a standalone feature, but rather part of the software life cycle. We cover medical device software (MDSW), cybersecurity, and software validation on separate pages. They are linked here as a cohesive reference structure.
360° AI Regulatory Support
An Overview of Regulatory Support for AI
-
GAP Analysis & Implementation Strategy
Review of existing documentation and processes for gaps in compliance with the AI Act, MDR/IVDR, and standards, with a concrete roadmap.
Technical Documentation → -
Intended Purpose & Classification
Clear definition of intended purpose and classification: the basis for high-risk classification and scope.
-
Workshops & Training
In-house workshops on product definition, classification, and AI requirements for development, quality management, and regulatory affairs.
Workshops & Training →
-
Communication with Notified Bodies & the FDA
Preparation and support in interactions with Notified Bodies and regulatory authorities—reliable and consistent.
-
AI Governance & Change Control
For AI governance, monitoring, and change control, we integrate specialized tools and partners as needed, incorporating them into your documentation structure.
-
AI Regulation for IVD Software
The same regulatory framework for AI also applies under the IVDR to software for, in, and as an IVD.
IVD Software →
Prioritize Early, Reap the Benefits Later
We first clarify the requirements that are relevant to the decision. This prevents the need for rework and ensures that AI products can be planned, approved, and maintained.
Interfaces
What AI Regulation Is Interlinked With
Medical Device Software (MDSW)
AI is part of the software life cycle. Unambiguously classify SaMD, embedded or MDSW.
Cybersecurity
AI systems are vulnerable to manipulation, data poisoning, and model attacks.
Risk Management
Systematically assess and keep up to date data, model, and change risks, as well as risks posed by AI itself (ISO 14971).
Technical Documentation
Consistently document model descriptions, development decisions, and supporting evidence.
Verification & Validation
Robust evidence of the performance and traceability of AI in or as a medical device.
Post-Market Surveillance
Market data influences valuation and further development; this is systematically factored in.
Thorsten Stumpf
Principal Expert, Software & AI · RAC Devices · Metecon GmbHThorsten Stumpf is an expert in RAC Devices and software—and is extremely well-connected within the industry on this topic. His team assists manufacturers with the regulatory classification of AI-based medical devices within the complex interplay of the MDR, IVDR, and AI Act. It also provides support in classifying, documenting, and translating AI system characteristics into regulatory-compliant arguments.
EU AI Act & MDCG 2025-6 • Data Strategy & PCCP • EU & FDA“AI in medical devices is not an isolated software project. It requires a process landscape in which the software life cycle, data strategy, risk management, and regulatory documentation work together consistently. It is crucial to integrate these requirements into the quality management system and the technical documentation from the very beginning. This is the only way to manage changes in a controlled manner and generate the necessary evidence in a reliable way."
– Thorsten Stumpf, Principal Expert, Software & AI · RAC Devices · Metecon GmbH
Frequently Asked Questions About AI Regulation
At which stage of development does it become worthwhile to classify an AI system for regulatory purposes?
As early as possible: starting with the concept and architectural phases. By structuring classification, data strategy, and risks early on, you can avoid rework and keep costly changes under control later on.
How can changes to the model, data, or architecture remain subject to regulatory oversight?
Through a predetermined change control plan (PCCP) and a significant-change assessment: Planned changes and their limits are defined and documented in advance, so that not every foreseeable adjustment triggers a new conformity assessment.
How can you tell if the documentation structure is sufficient for AI systems?
It is robust when classification, data strategy, risk management, V&V, and PMS are consistently linked, and AI is integrated into all processes and documented in a traceable manner. Isolated evidence for aspects of AI is a red flag.
How are risk management, verification, and validation related in AI systems?
Risks arising from the training data used and model behavior (ISO 14971 + ISO/IEC 23894) determine which characteristics must be demonstrated. V&V verifies the implementation and effectiveness of measures to ensure the safe use of AI systems. This is consistent with risk management and data strategy.
Which role does data strategy play in regulatory resilience?
One key factor: The origin, quality, representativeness, and traceability of the data determine the performance of AI systems. Sound data governance is a prerequisite for an AI system to reliably deliver the promised performance in the context of medical devices.
How is market data (PMS) systematically incorporated into the AI's evaluation?
Through a closed-loop process: Post-market data regarding the AI system are collected in a structured manner, evaluated against expectations and risks, and incorporated into model maintenance, change management, and, if necessary, a new conformity assessment.
What distinguishes the regulatory classification of an AI system from that of conventional medical device software under IEC 62304?
In addition to the life cycle activities specified in IEC 62304, there are also activities related to AI-specific requirements: data strategy, model behavior and robustness, transparency, and human oversight; and—for high-risk AI—the requirements of the AI Act in addition to the MDR/IVDR.
What does the AI literacy requirement (AI Act, Art. 4) mean for manufacturers?
Article 4 of the AI Act requires that individuals who provide or operate AI systems possess sufficient AI expertise. For manufacturers, this means providing verifiable training for the teams involved. We provide support through workshops and product-specific certifications. We clearly delineate data protection aspects (e.g., GDPR Article 9 regarding health data) in this process.
How much does AI regulation cost at Metecon?
The effort involved depends on the product, AI system, risk, data availability, and target markets (EU/U.S.). During a free initial consultation, we'll assess your case, review the high-risk classification, and then provide a reliable framework.
Establishing a Regulatorily Sound AI Product
Start with a free initial consultation. We’ll assess the high-risk classification, determine compliance with the AI Act and MDR/IVDR, and outline your AI documentation structure. Complexity is then transformed into clarity—reliably, efficiently, and always one step ahead.
Your contact:
Milan Weiß
Sales Manager
T: +49 621 123469-040
milan.weiss@metecon.de
