Software in Medical Devices, by MD101 Consulting

This document is the V2 of a position paper published in V1 in 2021, when the AI Act was still a proposal. Thus, even if this is a V2, this is in fact the first version of the document, since the AI Act came into force.

By many aspects, this position paper could be seen as more controversial than the BSI white paper.
It raises lots of questions about the management of the AI Act by the EU Commission. On purpose.

NB designations and codes

The paper starts with Team-NB's concerns about NB designations and codes. Of course, the medical device NB's advocate for the extension of their notifications on existing codes. Rather than adding a new designation process specific to the AI Act.
Practically speaking, this is probably the best solution if stakeholders want to take as little time as possible to designate NB's able to evaluate MD with AI against the MDR/IVDR and the AI Act.

Access to data and datasets used by NB's

Annex VII paragraph 4.3 of the AI Act leaves the possibility to NB's to have a full access to datasets hold by the manufacturer.
And Annex VII paragraph 4.4 of the AI Act leaves the possibility to NB's to perform their own tests on the AI system subject to conformity assessment.

This introduces the question of having access to the right data, either those hold by the manufacturer, or those chosen by the NB to perform their test.
Especially for personal health data: where to get independent datasets? Anonymized? Pseudonymized? Patient consent? Security? These questions are wide open and are not about to be closed!

Data management process

This document, like the BSI white paper, insists on the requirement to implement robust data governance practices, including traceability and compliance with GDPR. To do so, manufacturers will have to put in place a data management process. This process is new for most of manufacturers. They can have something already in place. But not ensuring conformity to AI Act requirements.

Similarities with BSI white paper

The Team-NB position paper also raises concerns on the interpretation of Safety component, of substantial modification versus significant change. We saw similar discussions in BSI's white paper.
No controversy here, BSI's document is aligned with Team-NB's document on the need of guidance and interpretation of the grey areas present in the AI Act.

However, reading this paper between the lines, we can see the power struggles and tractations happening behind the scenes. In fact, this Team-NB document raises lots of concerns about the implementation of the AI Act, and the absence of any sign showing that the AI Act schedule will be met.

Drifting timelines

To make it short, the position paper calls into question the timelines defined in AI Act and time is really takes to get things done:

• Competent Authorities designations,
• NB designations,
• Harmonized standards,
• Access to independent test dataset,
• Guidance documents on interpretation of AI Act requirements for medical devices
• and probably some other topics...

Hey AI Act guys, do you know how long MDR / IVDR have been delayed?
7 years.
And that's a vertical regulation for a single industry.
And we already had harmonized standards (OK. No. Not harmonized, but harmonized all the same).
And we already had Notified Bodies (OK. No. Not notified, but bodies were already there).


So, now, you can imagine how long it will take for your AI Act, an horizontal regulation with no harmonized standards, with no notified bodies, to be fully applicable.
My optimistic guess is: 2027 for medical devices incorporating High-Risk AI will be postponed to 2030.