Software in Medical Devices, by MD101 Consulting

Standards for AI-enabled devices

We already talked about standards for artificial intelligence-enabled medical devices here and there. But the state of the art is moving fast. Faster than you may think.

Here is a graphical representation of standards on artificial intelligence specific to medical devices:

Some are standards like IEC 62304 or IEC 63450, some are documents in a earlier stage, like AAMI CR515 or IEC PAS 63621.

Standards for AI Act

Add to this the standards specific to the AI Act, cooked by the JTC 21. The list of standards is visible in their work programme. A subset of these standards will be harmonized for the AI Act. They are represented here:

AI Act clog

It's obvious this planning is squeezed by the AI Act milestones. All these future harmonized standards shall be ready by mid 2027. Meaning only one year to be fully implemented by manufacturers. One year in theory, more than that in practice. If you plan to CE mark your AI-enabled MD by August 2028, you need to be ready before that milestone.

Since implementing these standards will actually require 12 months or more, manufacturers won't be ready before Mid to End of 2028. Add to that the time needed to CE mark their AI-enabled MD, they will get their certificate by Mid 2029 at the earliest.

Consequence: a drop of CE marked AI-enabled devices in 2028 and 2029.

AI Act harmonized standards overload

These future harmonized standards are made to be applicable to all kind of AI software in annex I and annex III of the AI Act. While they will be new to some industries (E.g: recruitment, police, justice, , ...), they aren't so new for the medical device industry:

• EN 18286 Quality management system for EU AI Act regulatory purposes:
  • As the title says, this is a QMS standard,
  • Based on the High-Level Structure (you know, the structure not followed by ISO 13485 ...),
  • Its clauses overlap a lot with ISO 13485.
• EN 18228 AI Risk Management:
  • This one is a violent copy-paste of ISO 14971,
  • But with risk assessment beyond safety, with this definition of harm: injury or damage to the health of a person or groups of persons, or interference with fundamental rights,
  • And lots of tiny differences compared to ISO 14971. Some interestingly shed a new light on risk management.
• EN 18282 Cybersecurity specifications for AI Systems:
  • Interesting standard in its content, this standard covers cybersecurity throughout the AI system lifecycle,
  • It overlaps with IEC 81001-5-1 but brings lots of interesting practical information,
  • Especially the clause 10 of AI-specific threats, something we already saw in NIST AI 100-2e2023 document.
• EN 18229-x: a series of 5 standards on AI trustworthiness framework:
  • More technical standards with no equivalent in the list of AI-enabled MD standards,
  • EN 18229-1 is under inquiry, others are still being drafted,
  • Looking at EN 18229-1 content, they're probably the standards with the newest, most practical and useful content for MD.
• EN 18284 Quality and governance of datasets in AI:
  • We don't have much information on this standard as it is still under drafting,
  • We can anticipate an overlap with IEC 63621.

A gap assessment + implementation to claim conformity of your QMS to ISO 13485 / ISO 14971 + EN 18286 / EN 18228, as well as other harmonized standards? Probably 12 to 24 months depending on the size of your company.

AI Act transition vs MDR/IVDR transition

According to the Digital Omnibus Act, adopted by the EU Parliament on the 16th June 2026, EU AI Act application dates are the following:

• 2 Dec 2027: Annex III high-risk AI: not for MD but I write it here to show how unrealistic a schedule,
• 2 August 2028: for new MDs placed on the market. I.e. fresh new MDs and legacy MDs (placed on the market before that milestone) with substantial change,
• 2 December 2030: for all MDs, including legacy MDs placed on the market before that 2 August 2028.

A transition ends, another begins. Yes, "begins". Rest assured that the AI Act transition dates will be postponed to whatever is beyond 2030. We had the uncomfortable feeling that the AI Act would require quite some time to be implemented.

Thanks to the progression of harmonized standards availability, we now have a more precise estimate of the work needed to implement them. Believe me, 12 to 24 months won't be too much. (and you're in a heavy regulated industry, you're accustomed to that. Imagine how painful it will be for organisations in education, in recruitment...).

Another glitch in this schedule:

• You have a legacy AI-enabled MD in class I MDD, to be CE-marked in class IIa+ MDR,
• You start your journey with your Notified Body late 2027 (that's so expensive you postponed it to the maximum),
• The CE mark was expected by June 2028, but your Notified Body requests more data (at random, on clinical evaluation) and the conformity assessment crosses the 2 August line,
• What happens between August and December 2028?
• I let the MDCG and AI Bureau answer to this question.

After the MDR/IVDR clog, welcome to the AI Act clog.