2026 will mark the integration phase of the AI Act for health and life sciences companies. AI-supported medical devices, diagnostic solutions and clinical decision support systems will in many cases qualify as high-risk AI systems. Risk management, data governance and technical documentation must therefore be adapted at an early stage to the requirements of the Artificial Intelligence Act (AI Act), Regulation (EU) 2024/1689, in parallel with the Medical Devices Regulation (MDR), Regulation (EU) 2017/745, the In Vitro Diagnostic Medical Devices Regulation (IVDR), Regulation (EU) 2017/746, and the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, particularly when processing sensitive health data for training, validation and performance monitoring.
In practice, this means that AI governance can no longer be treated as a purely digital compliance topic. For manufacturers of AI-enabled medical technologies, AI lifecycle management will need to be embedded in existing quality management systems and technical documentation processes under the MDR and IVDR.
The proposed Digital Omnibus package – a set of legislative proposals aimed at simplifying and clarifying the implementation of the AI Act and related digital legislation – responds to practical implementation challenges without changing the Act’s risk-based structure. Particularly relevant for the life sciences industry is the linking of the effective date of certain high-risk obligations to the availability of harmonised standards and guidelines. This effectively recognises that technical standardisation and regulatory applicability are closely linked in the medical device sector. This approach also reflects the central role of notified bodies in the medical technology sector. As AI functionality becomes increasingly embedded in regulated health products, coordination between AI Act requirements and existing MDR/IVDR conformity assessment procedures will be critical for market access. At the same time, it creates an explicit legal basis for the processing of special categories of personal data for the detection and correction of bias – a key issue for AI training with health data. In addition, there will be greater integration of AI supervision, product regulation and data protection.
Conformity assessment procedures under the MDR/IVDR and AI Act are to be made more coherent in order to avoid double testing. In particular, the proposed shift of the MDR and IVDR from Section A to Section B of Annex I to the AI Act indicates that, for AI-enabled medical devices and IVDs, the high-risk classification under Article 6(1) would remain, while core compliance requirements may increasingly be channelled through the sector-specific product regime rather than through the full set of directly applicable AI Act obligations. At the same time, the role of the AI Office will be expanded, which should lead to more coordinated European supervisory practices in the medium term.
For companies, this means that compliance will increasingly be assessed across sectors, with technological, data protection and product safety requirements intertwining. This will create a more coordinated but still challenging regulatory environment for data-driven research, AI training and digital care models in the healthcare sector. The key challenge lies not in individual standards, but in their consistent integration into existing quality and governance structures.
These developments will increasingly intersect with the question of access to health data – an area that the European Health Data Space (EHDS) is set to address at EU level.
This is important | To Do | Key Takeaways etc.:
- Systematically assess AI-enabled products against the AI Act and MDR/IVDR and validate their classification at an early stage.
- Structure and document training and validation datasets (bias testing, Article 9 GDPR, purpose limitation).
- Integrate AI lifecycle documentation into existing QMS and conformity assessment processes.
- Monitor developments on harmonised AI standards and the Digital Omnibus proposals.
- Prepare internal governance structures for coordinated regulatory oversight.
