Short answer: the AI Act (Regulation (EU) 2024/1689) regulates AI systems by risk. For health, three situations matter. An AI system that is, or is a safety component of, a medical device requiring third-party conformity assessment under the MDR or IVDR is high-risk (Annex I): it must meet the Act's requirements on risk management, data, documentation, logging, transparency, human oversight, accuracy and cybersecurity, assessed together with the device's conformity assessment. AI used for emergency triage or to decide access to health services is high-risk under Annex III even outside device law. Assistants and chatbots that are not high-risk still carry transparency duties (people must know they are talking to AI; generated content is marked). The Act entered into force on 1 August 2024, with obligations phased in to 2027; the Commission proposed in late 2025 to adjust some deadlines, so check the current state.
The risk pyramid
The EU AI Act sorts AI systems into tiers: prohibited practices banned since February 2025, high-risk systems under Annex I (AI in medical devices needing a notified body) and Annex III (emergency triage, access to health services), limited-risk systems with transparency duties such as health chatbots, minimal-risk tools with no specific obligations, and general-purpose AI models with provider duties.
| Tier | Health examples | Consequence |
|---|---|---|
| Prohibited (Art. 5) | Manipulative techniques exploiting vulnerabilities, untargeted scraping for facial recognition, emotion recognition at work or school (with exceptions for medical and safety uses) | Banned since 2 February 2025 |
| High-risk, Annex I | AI in a medical device or IVD that needs a notified body (most class IIa and above software): imaging AI, decision support, dose calculators | Full high-risk requirements, assessed within the MDR/IVDR conformity assessment |
| High-risk, Annex III | Emergency call and patient triage systems; AI evaluating eligibility for public health benefits and services; biometric categorisation; employment decisions about health workers | Full high-risk requirements, self-assessment or notified body per Annex III rules, registration in the EU database |
| Limited risk (transparency, Art. 50) | Health chatbots and assistants, AI-generated text or images about health, deepfake-type content | Disclose AI interaction; mark generated content; human oversight where relevant |
| Minimal risk | Spam filters, scheduling optimisation, administrative tools | No specific obligations; voluntary codes |
| General-purpose AI models (Chapter V) | Foundation models used in health products | Provider obligations: technical documentation, copyright policy, training summary; extra duties for systemic-risk models |
A health app that is not a device and does not fall in Annex III (a record with an AI summary feature, a symptom diary with a conversational interface) is in the limited tier: transparency and the general duty of AI literacy for staff (Art. 4), plus everything the GDPR already requires. If the same app adds a feature that informs diagnosis or treatment, it becomes a device under the MDR and, if a notified body is involved, high-risk under the AI Act; see Software as a medical device.
What high-risk requires (Chapter III, Section 2)
A high-risk AI system under the EU AI Act requires a risk management system, data governance for training and test data, technical documentation and logging, transparency to deployers, human oversight by design, accuracy, robustness and cybersecurity, a quality management system, conformity assessment with CE marking, post-market monitoring and incident reporting, and registration in the EU database for Annex III systems.
- Risk management system across the lifecycle (Art. 9), integrated with ISO 14971 for devices.
- Data governance (Art. 10): training, validation and test data relevant, representative, examined for bias, with documented provenance; processing of special-category data for bias correction allowed under conditions.
- Technical documentation (Art. 11, Annex IV) and record-keeping / logging (Art. 12) for traceability.
- Transparency and instructions to deployers (Art. 13).
- Human oversight by design (Art. 14): the ability to understand, override and stop.
- Accuracy, robustness and cybersecurity (Art. 15), with declared metrics.
- A quality management system (Art. 17), which for devices is the ISO 13485 system extended.
- Conformity assessment, the CE marking and the EU declaration of conformity covering both regulations; registration in the EU database for Annex III systems.
- Post-market monitoring and serious incident reporting (Art. 72–73), coordinated with MDR vigilance.
- Deployers (hospitals, clinics) have their own duties: use according to instructions, human oversight, logs, informing people, and for public bodies a fundamental rights impact assessment (Art. 27).
The overlap with the MDR and IVDR
The EU AI Act overlaps with the MDR and IVDR by design: for AI in medical devices listed under Annex I, the Act's requirements are assessed as part of the device's conformity assessment by the same notified body, with a single documentation set and one quality system. Harmonised standards from CEN-CENELEC JTC 21 will give presumption of conformity once published.
The Act was written to avoid a second parallel process: for Annex I devices, the AI requirements are assessed as part of the MDR/IVDR conformity assessment by the same notified body, which must be designated for the AI Act as well; documentation can be a single set; the quality system is one. Harmonised standards (for AI risk, data quality, robustness) are being developed by CEN-CENELEC JTC 21 and will give presumption of conformity; until they exist, manufacturers use ISO/IEC 42001, ISO/IEC 23894 and the device standards. The Medical Device Coordination Group and the AI Board are expected to publish joint guidance; the interplay of post-market and incident reporting is the area to watch.
Timeline
The EU AI Act entered into force on 1 August 2024. Prohibitions and AI literacy duties applied from 2 February 2025, general-purpose model obligations from 2 August 2025, most of the Act including Annex III high-risk systems from 2 August 2026, and Annex I high-risk systems such as AI in medical devices from 2 August 2027, subject to proposed adjustments.
- 1 August 2024: entry into force.
- 2 February 2025: prohibitions and AI literacy obligations apply.
- 2 August 2025: general-purpose AI model obligations; governance (AI Office, notifying authorities); penalties.
- 2 August 2026: most of the Act applies, including Annex III high-risk systems and transparency obligations.
- 2 August 2027: Annex I high-risk systems (AI in regulated products such as medical devices) and general-purpose models placed on the market before August 2025.
In November 2025 the Commission proposed, within a "digital omnibus", to tie the application of the high-risk rules to the availability of standards and support tools, which could shift the 2026 and 2027 dates; the proposal was under negotiation at the time of writing. Treat the dates above as the law as adopted and follow the Official Journal for changes.
What a health-app team should do now
The practical steps for a health-app team under the EU AI Act are to classify each AI feature as device, Annex III or transparency tier, disclose AI interaction and mark generated content, document training data and evaluation by subgroup, keep humans in control with outputs as drafts, obtain documentation from the general-purpose model supplier, and run the GDPR work alongside.
- Classify each AI feature: device or not (Is a health app a medical device?); Annex III or not; transparency tier otherwise.
- Disclose AI interaction and mark generated content now; it costs nothing and will be required.
- Document data and evaluation: where training and test data came from, how performance was measured, by subgroup; this is the core of Articles 10 and 15 and also good engineering (AI on medical data: the map).
- Keep humans in control: outputs as drafts and suggestions, never auto-committed clinical facts; logs of what the AI produced and who accepted it.
- Check the model supplier: general-purpose model providers must supply documentation you will need for your own file.
- Run the GDPR work (Article 22 on automated decisions, the DPIA) alongside; the AI Act does not replace it (GDPR Article 9).
In Anpheros
Anpheros's AI features restate and locate what a person's record contains and are disclosed as AI; they do not diagnose or recommend treatment, so the product is not a medical device and sits in the Act's transparency tier. Model use is documented, outputs carry provenance, and nothing an assistant produces becomes a clinical fact in the record without a human asserting it.
This page explains regulation for product and engineering teams. It is not legal advice; the texts linked under Sources are the authority. Last reviewed: October 2026.
Related pages
- AI on medical data: the map
- Software as a medical device: MDR and IEC 62304 classes
- Is a health app a medical device? EU MDR Rule 11
- GDPR Article 9 for health data
- Health data regulation map
- RAG on medical records
Sources
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex
- European Commission: AI Act (policy page and timeline)
- European Commission: AI Office
- Regulation (EU) 2017/745 (MDR), EUR-Lex
- CEN-CENELEC JTC 21: Artificial Intelligence
- ISO/IEC 42001:2023, AI management system
Frequently asked questions
Is every medical device with AI high-risk under the AI Act?
Only those that undergo third-party conformity assessment under the MDR or IVDR, which is most class IIa and above software. A class I device with AI that is self-certified is not Annex I high-risk, but still has the Act's general and transparency duties.
Does the AI Act apply to a US company?
Yes, when its AI system is placed on the EU market or its output is used in the EU, the same way the MDR and the GDPR apply. Providers outside the EU appoint an authorised representative for high-risk systems.
Do I need a second CE mark for AI?
No. For Annex I devices one conformity assessment covers both regulations and one CE mark and declaration of conformity reference both. The documentation must cover the AI Act's requirements.
What changes for a health chatbot?
Transparency: users must be told they are interacting with AI, generated content must be marked, and staff need AI literacy. If the chatbot gives individual diagnostic or treatment advice it becomes a medical device and the picture changes entirely.
Try it free in the sandbox
Your first FHIR call in 5 minutes. An HL7 FHIR R4 API with the patient's consent built in: try it in the sandbox, then connect your own app or clinic system.
Free · 30 synthetic patients · no card
Anpheros builds a medical record that the patient controls and can share with any clinic, on an HL7 FHIR R4 platform, based in the EU. These guides help you understand and organise your health; they do not replace your doctor.
About Anpheros →
AnpherosThe more you log, the clearer your record
Your health history in one place, under your control.
Free · Works in your browser · No card
