High-risk without safeguards? The EU AI Act and the push for deregulation of medical AI

Abstract

Artificial intelligence (AI) is increasingly embedded in clinical decision-making, yet recent proposals to simplify the European Union (EU) Artificial Intelligence Act (AI Act) have reopened the question of whether AI-enabled medical devices should remain subject to the AI Act’s full high-risk regime. Under the current framework, AI-enabled medical devices are regulated through a combination of sectoral medical device legislation (the Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR)) and additional AI-specific safeguards contained in the AI Act. This narrative review analyses the Health Innovation Package and related legislative developments under the EU simplification agenda and examines their impact on the relationship between the AI Act and medical device law. It shows that the proposed reform would retain the high-risk classification of AI-enabled medical devices while removing most associated AI Act obligations. In effect, this decouples risk classification from the safeguards that give it regulatory meaning, including requirements on data governance, risk management, human oversight and postmarket monitoring. Rather than resolving regulatory overlap, the amendments shift the centre of gravity back to product-focused medical device law without ensuring equivalent AI-specific safeguards. These changes may narrow attention to fundamental rights, weaken oversight in clinical use and increase legal uncertainty regarding accountability and responsibility. In a domain where AI systems directly shape clinical decisions and patient outcomes, these changes risk undermining the conditions for safe, equitable and accountable deployment of medical AI.

WHAT IS ALREADY KNOWN ON THIS TOPIC.

WHAT THIS STUDY ADDS

• This review shows that recent EU ‘simplification’ proposals in the Health Innovation Package would retain the high-risk classification of AI-enabled medical devices while removing most AI Act safeguards.

• The findings suggest that removing AI-specific safeguards may increase legal uncertainty and weaken oversight in clinical practice.

HOW THIS STUDY MIGHT AFFECT RESEARCH, PRACTICE OR POLICY

• The findings clarify the regulatory consequences of current EU reform proposals and provide a basis for evaluating their impact on safety, accountability and health equity.

• They contribute to ongoing policy debates by highlighting the trade-offs between simplification, legal certainty and the governance of AI-specific risks in healthcare.

Introduction

Artificial intelligence (AI) is rapidly becoming embedded in clinical decision-making, from radiology to emergency care. While these technologies promise improvements in diagnostic accuracy and efficiency, they also introduce risks that arise across the AI lifecycle, from data collection and model design to deployment and real-world clinical use.^1,2 Recognising these challenges, the European Union (EU) adopted the Artificial Intelligence Act (AI Act),³ which complements existing medical device legislation—the Medical Devices Regulation (MDR)⁴ and In Vitro Diagnostic Medical Devices Regulation (IVDR).⁵ It introduces additional safeguards tailored to AI-specific risks, including requirements relating to data governance, transparency, human oversight and postmarket monitoring.⁶ However, this ‘horizontal’, cross-sectoral approach to AI regulation is now increasingly contested.^7,8

Under the EU’s broader ‘simplification’ agenda,⁹ two recent proposals are relevant to the medical sector. First, the European Commission’s Health Innovation Package (December 2025) proposes to simplify the rules governing medical devices in the EU, amending the MDR, the IVDR and the AI Act. Among other changes, it would move AI-enabled medical devices from Section A to Section B of Annex I to the AI Act, removing most of the AI Act’s high-risk obligations applicable to these systems.^10,11 At the time of writing, the European Commission’s Health Innovation Package still needs to be discussed by Parliament and Council, meaning that the future allocation of AI-specific obligations between the AI Act and medical device legislation remains uncertain.

Second, the European Commission’s Digital Omnibus on AI (November 2025) was introduced to facilitate the implementation of the AI Act by addressing practical implementation challenges.¹² During the legislative process, however, the European Parliament proposed amendments that would similarly have reduced the AI Act’s application to AI-enabled medical devices, illustrating a broader political momentum towards deregulation of medical AI.^7,8,13 Nonetheless, following trilogue negotiations, the final compromise (July 2026) retained AI-enabled medical devices within Section A of Annex I, while introducing a mechanism allowing certain AI-specific requirements to be incorporated into sectoral legislation through delegated acts.¹⁴ It remains uncertain to what extent the legislative compromise reached in the Digital Omnibus will influence the negotiations on the Health Innovation Package.

This article reviews recent EU regulatory developments concerning AI in medical devices and examines their implications for the governance of medical AI in healthcare. Drawing on EU legislation, policy proposals, regulatory guidance and academic literature, it shows that the reforms proposed in the Health Innovation Package, viewed in the context of the broader simplification agenda reflected in the Digital Omnibus negotiations, risk creating a category of AI-enabled medical devices that remain formally classified as high-risk while no longer being subject to most of the AI Act’s high-risk safeguards. Given the EU’s role as a global regulatory standard-setter, these developments raise broader legal, ethical and social questions about how AI should be governed in healthcare, particularly in relation to patient safety, health equity and accountability in clinical decision-making. Our concern is not the pursuit of regulatory simplification per se. Instead, we argue that simplification is being pursued at the wrong regulatory layer. It would be more prudent to simplify existing procedures and administrative processes while preserving important safeguards that already exist for high-risk AI systems.

The AI Act’s original design: AI-specific safeguards for medical devices

When the AI Act was adopted in 2024, the EU legislator classified AI systems that are safety components of medical devices regulated under the Medical Devices Regulation (MDR) or the In Vitro Diagnostic Medical Devices Regulation (IVDR) as high-risk AI systems (Annex I, Section A). In practice, this meant that manufacturers of AI-enabled medical devices had to undergo conformity assessment under the MDR or IVDR while also complying with additional safeguards introduced by the AI Act.¹⁵ These included requirements on data governance and dataset quality, risk management, transparency and technical documentation, human oversight and postmarket monitoring. The purpose of these rules was to address risks associated with AI systems that traditional medical device legislation was not designed to capture.^16,17

The need for these additional safeguards stems from the way AI-based systems differ from traditional medical devices, including conventional medical software. Traditional devices are typically rule-based and relatively stable: they are assessed in terms of whether they perform their intended function safely and reliably under (pre)defined conditions. However, some AI systems may produce systematically different outcomes across patient groups or clinical settings when deployed on the ground.^18,19

These characteristics give rise to two distinct regulatory challenges. First, AI-based medical devices must be assessed not only for laboratory performance, but also for their real-world clinical performance across diverse populations and settings.^20,21 Second, some AI systems continue to learn or adapt after deployment. While this may improve performance in some cases, it can also introduce new risks or degrade performance over time if changes are not effectively monitored.²² These challenges are only partly addressed by the existing EU medical device framework, which is primarily oriented towards evaluating products at the point of market entry. By contrast, many risks associated with medical AI arise across the system’s lifecycle, including development, deployment and clinical use, and may reinforce existing inequalities.^21,23 These include not only technical forms of bias, such as unrepresentative training data, but also contextual risks arising from how systems are used in practice, including disparities in access, digital literacy and clinical decision-making.¹⁶ A simplification agenda should ideally contend with preserving meaningful safeguards across that entire lifecycle.²⁴

The AI Act was therefore designed to complement the MDR and IVDR by introducing governance requirements tailored to AI systems across their lifecycle. The introduction of these safeguards reflects the legislator’s view that existing medical device law alone is insufficient to address the distinctive risks of medical AI. The Commission’s Health Innovation Package proposal, however, rests on a different diagnosis: that the current framework creates unnecessary regulatory overlap.

Is regulatory overlap really the problem?

The Commission justifies the proposed reform of the AI Act within the Health Innovation Package primarily by the wish to lower administrative burdens, pointing to regulatory overlap between the AI Act and existing medical device legislation. There is some basis for these concerns. Since the entry into application of the MDR and IVDR, the regulatory framework for medical technologies has become more demanding than under the previous directives. Stricter clinical evidence requirements, limited capacity among notified bodies and complex conformity assessment procedures have made it more complex to bring certain medical devices to market.^25–27

However, attributing these burdens to the AI Act risks misidentifying the source of the problem.²⁸ The AI Act was not designed to introduce a separate regulatory pathway for AI-enabled medical devices. Instead, it was intended to operate alongside existing sectoral legislation such as the MDR and IVDR. Recital 64 of the AI Act explicitly recognises that multiple EU legal frameworks may apply to the same product where they address different risks.^29,30 This logic is reflected in the structure of the Regulation itself. Rather than establishing a parallel approval pathway, the AI Act integrates its requirements into the conformity assessment procedures already required under sectoral legislation. Article 43(3) requires compliance with the AI Act to be assessed within the same procedures applicable under the MDR and IVDR, while Article 11(2) mandates the use of a single set of technical documentation to demonstrate compliance with both frameworks. This design does not require two separate regulatory processes. Instead, testing, documentation and assessment can be aligned within a single integrated procedure. This follows the AI Act’s own architecture where it allows providers to integrate requirements on testing, reporting and documentation with sector-specific procedures.^29,30 This reading is confirmed by a recent guidance document on the interplay between the MDR/IVDR and the AI Act, endorsed by the Artificial Intelligence Board and the Medical Device Coordination Group.³¹

The next section examines how the proposed reforms would modify the relationship between the AI Act and medical device legislation.

The health innovation package: narrowing the obligations for AI medical devices

The Commission’s proposed reform of the AI Act within the Health Innovation Package modifies the relationship between medical device legislation and the AI Act. Importantly, it does not change the scope of the AI Act or the classification of AI-enabled medical devices as high-risk systems. AI systems embedded in medical devices regulated under the MDR or IVDR would therefore remain formally included within Annex I—the high-risk category—of the AI Act.

However, the proposal introduces a significant structural change by moving AI-enabled medical devices from Section A to Section B of Annex I.¹⁰ This is consequential because AI-based medical devices would retain the ‘high-risk’ label while most safeguards underpinning that label are removed. First, under Article 2 (2), Section B systems are excluded from the high-risk regime under Chapter III (and remain subject to only a narrow subset of provisions). In effect, the core requirements relating to risk management, data governance, human oversight and postmarket monitoring would, therefore, no longer apply. Second, the narrow subset of provisions that continue to apply is Article 6 (1), Articles 102 to 109 and Article 112, with Article 57 applying only insofar as the requirements for high-risk AI systems under the AI Act have been integrated into the relevant sectoral legislation. These remaining provisions are largely procedural (eg, regulatory sandboxes and transitional provisions) and do not impose substantive requirements on developers or users. In practice, AI-enabled medical devices would retain the ‘high-risk’ label while most safeguards attached to it would be removed.

As shown in figure 1, the proposed reform under the Health Innovation Package therefore alters the regulatory framework for medical AI in three important respects. First, the core obligations normally attached to the AI Act’s high-risk classification would no longer apply, including requirements relating to data governance, risk management, transparency, human oversight and postmarket monitoring. Second, the scope of actors subject to regulatory duties would narrow. Under the current AI Act framework, certain obligations apply not only to manufacturers but also to deployers of AI systems, including healthcare institutions responsible for integrating such tools into clinical practice, for example through duties relating to training, monitoring and record-keeping.¹⁰ Under the Commission’s proposal, these deployer obligations would no longer apply to medical AI systems. Third, the nature of risk governance would shift. While the MDR and IVDR require manufacturers to implement risk management systems focused on safety and performance, the AI Act requires providers to identify and mitigate risks posed by AI systems not only to health and safety but also to broader fundamental rights, including risks related to non-discrimination, privacy and access to healthcare.³² If adopted, the reform would remove this broader dimension from the regulation of AI medical devices. These changes have important implications for patient safety, health equity, and the overall coherence of the regulatory framework, which are examined in the following section.

Figure 1. Original and proposed EU regulatory framework for AI-enabled medical devices under the Health Innovation Package. AI, artificial intelligence; IVDR, In Vitro Diagnostic Medical Devices Regulation; MDR, Medical Devices Regulation.

Parallel reforms under the Digital Omnibus illustrate the contested nature of this regulatory debate. The Commission’s Digital Omnibus proposal primarily sought to facilitate implementation of the AI Act through procedural simplification, including delayed application of certain high-risk obligations, simplified documentation requirements and greater integration with existing sectoral conformity assessment procedures.³³ This approach was built on earlier guidance emphasising procedural alignment and the avoidance of duplication. During the legislative process, however, the proposal evolved considerably. In March 2026, the European Parliament’s Committees on the Internal Market and Consumer Protection (IMCO) and on Civil Liberties, Justice and Home Affairs (LIBE) proposed amendments that would have substantially narrowed the AI Act’s application to AI-enabled medical devices.³⁴ Specifically, they proposed deleting Section A of Annex I and incorporating its contents into Section B, while amending Article 2 (2) so that AI-enabled medical devices would remain formally classified as high-risk but would become subject only to a limited subset of the AI Act’s requirements.³⁵

Following trilogue negotiations, the colegislators ultimately adopted a more moderate approach than that initially proposed by the European Parliament. The final legislative text of 8 July 2026 retains AI-enabled medical devices within Section A of Annex I to the AI Act, thereby preserving their status as high-risk AI systems.¹⁴ Rather than removing these systems from the AI Act’s high-risk framework, the reform introduces a new mechanism allowing the application of specific AI Act obligations to be limited where Union harmonisation legislation listed in Section A of Annex I, such as the MDR and IVDR, provides an equivalent or higher level of protection for health, safety or fundamental rights. The Commission is empowered to adopt delegated acts specifying the AI systems concerned, the obligations that may be limited and the conditions under which such limitations apply, while ensuring that the overall level of protection guaranteed by the AI Act is not reduced.¹⁴

This represents a markedly different regulatory approach from that proposed in the Health Innovation Package. Rather than removing AI-enabled medical devices from the AI Act’s substantive high-risk regime altogether, the Digital Omnibus preserves the horizontal framework while permitting targeted derogations only where equivalent safeguards exist under sectoral legislation. It also seeks to reduce administrative burdens through procedural integration, including unified designation procedures for notified bodies designated under both the AI Act and the MDR/IVDR. Whether this more incremental model of simplification will influence the ongoing negotiations on the Health Innovation Package remains uncertain.

What is at stake: safety, equity, and regulatory coherence in healthcare

These developments have implications not only for regulatory design, but also for the ethical, legal and social dimensions of AI use in healthcare. While the MDR/IVDR provide an extensive framework for assessing the safety and performance of medical devices, they were not designed to govern AI-specific issues such as algorithmic bias, human oversight in clinical use or broader fundamental-rights risks. The following sections examine three consequences of the proposed reform: the narrowing of the AI Act’s fundamental-rights perspective, the removal of deployer obligations governing clinical use and the legal uncertainty and consequential barriers to AI adoption.

Narrowing the fundamental-rights dimension

The AI Act is distinctive in that it combines elements of product safety regulation with a focus on fundamental rights risks associated with AI systems.³⁶ This is particularly important in the healthcare context, where AI systems directly affect legally protected interests such as the right to health, non-discrimination, privacy and human dignity.^37,38 While AI-enabled medical devices are not subject to the fundamental rights impact assessment (FRIA) under Article 27,³⁹ this does not mean that fundamental-rights considerations are absent. Rather, the AI Act embeds such concerns throughout the high-risk framework itself.⁴⁰ The obligations in Articles 8–15, covering data governance, risk management, transparency, human oversight and postmarket monitoring, are framed as protecting not only health and safety, but also fundamental rights. The proposed reform therefore does not merely remove an additional layer of rights-based assessment; it removes the core mechanisms through which these concerns are operationalised in the governance of medical AI.

This shift is particularly relevant because many of the key risks of medical AI, such as algorithmic bias and unequal clinical outcomes, are not only technical issues but raise fundamental rights concerns, including discrimination and unequal access to healthcare.⁴¹ Under the full high-risk framework of the AI Act, developers would be required to implement a risk management system and ensure that training datasets are appropriate, representative and free of biases (Articles 9–10). Hospitals deploying the system would also need to ensure that clinicians receive appropriate training and that the system’s use is monitored (Article 26). If these requirements no longer apply, the system would still undergo MDR conformity assessment, but without explicit obligations to identify or mitigate such biases. Real-world testing and regulatory sandboxes may help identify such risks, but they are selective, time-limited and no substitute for system-wide obligations on data governance, human oversight, accuracy and postmarket monitoring.^42,43

One concern relates to the quality and representativeness of training data. Machine-learning systems depend on their training data, and if these do not reflect diverse patient populations, outputs may produce systematic disparities in diagnostic accuracy or risk prediction.⁴⁴ For example, an AI system designed to predict cardiovascular risk may perform differently across demographic groups if its training data disproportionately represent certain populations.⁴⁵ Empirical research shows that systems performing well in controlled settings may behave differently in clinical workflows, particularly when deployed in hospitals with different patient populations or data infrastructures.⁴⁶

While the MDR and IVDR may address some forms of technical bias through safety and performance assessment, they do not capture contextual biases arising in the deployment and use of AI systems, such as unequal access, differential treatment of patients or disparities linked to digital literacy and healthcare infrastructure.^1,2 The AI Act partially addresses this by regulating both providers and deployers of high-risk AI systems—a feature that becomes particularly significant in light of the proposed removal of deployer obligations, discussed below.

No more deployer obligations: weakened human oversight in clinical practice

Under the current AI Act framework, deployers of high-risk AI systems are subject to obligations concerning use of AI systems in accordance with instructions, human oversight, quality control of input data, monitoring, log retention and incident reporting. It should be noted that the ‘deployer’ under the AI Act is not the same as the ‘user’ under the MDR/IVDR. Under the joint AI Board/Medical Device Coordination Group (MDCG) guidance, the concept of a ‘deployer’ under the AI Act cannot be equated with the MDR/IVDR understanding of a healthcare professional or lay user.⁴⁷ In practice, the ‘deployer’ will often be the healthcare institution that uses the AI system in its organisational workflow. In the absence of EU-level deployer obligations under the AI Act, responsibility for these aspects of AI use is therefore left to national law and professional standards within Member States. This risks uneven oversight across Member States and variation in how healthcare institutions manage AI-related risks. The proposed disapplication of deployer obligations will, therefore, create a regulatory blind spot at the point of use.

From a patient safety perspective, this is problematic because AI safety depends not only on technical performance but on how systems are used in practice.⁴⁸ AI tools in healthcare are typically introduced as decision-support systems, meaning that their outputs must be interpreted, contextualised and, where necessary, challenged by clinicians.⁴⁹ Meaningful oversight requires organisational measures such as training, performance monitoring and mechanisms to detect and respond to errors.⁵⁰ Recent research on clinical workflows underscores that safe implementation requires technological robustness, humans in the loop and ethical safeguards operating together, rather than a narrow focus on model performance only.⁴⁹ Without deployer obligations ensuring these conditions, there is a risk that AI systems are used in ways that compromise patient safety, for example through over-reliance on automated outputs or failure to detect system errors in practice.

The removal of deployer obligations further weakens the ability to identify and address biases that arise in clinical use. As discussed above, many biases in medical AI arise in the context of deployment rather than solely in system design. These risks cannot be addressed through product regulation alone.⁵¹ Although healthcare professionals must report serious incidents under the MDR/IVDR, these obligations are largely reactive and limited to safety events. Gradual harms, such as biased performance across patient groups, may remain invisible without obligations to log AI use and monitor outcomes.

Legal uncertainty, fragmentation and legal barriers to AI adoption

Legal uncertainty is already a major barrier to the adoption of AI in healthcare. According to a WHO/Europe report on AI readiness, 86% of responding states identify legal uncertainty as a key constraint, while only a small minority have developed health-specific liability frameworks. At the same time, clear rules on accountability and liability for manufacturers, deployers and users are seen as essential enablers of safe and effective AI use.^52,53 A reform presented as simplification for innovation may reduce certain compliance burdens, but it may also deepen existing uncertainty about accountability, responsibility and the safe uptake of AI systems in practice. This uncertainty is compounded by the absence of a dedicated EU liability framework for AI following the withdrawn AI Liability Directive proposal.⁵⁴

Against this background, the proposed reform does not resolve this existing uncertainty, but instead deepens it by introducing an additional form of legal ambiguity that can be described as ‘signalling incoherence’. In risk-based regulation, classification systems are intended to perform a core function of prioritisation, calibration and signalling, aligning regulatory obligations with the level of risk.⁵⁵ Under the EU AI Act, the designation of an AI system as ‘high-risk’ is intended to trigger stringent obligations. Under the proposed reform, however, AI-enabled medical devices remain classified as high-risk while being exempted from most associated requirements, thereby misaligning the regulatory label and its legal consequences. This weakens the signalling function of risk classification.⁵⁶ When a high-risk label is no longer coupled with corresponding safeguards, it becomes unclear what compliance requires in practice. Rather than enhancing predictability, the reform creates a category that signals heightened concern without specifying its implications, undermining the coherence and trustworthiness of the AI Act’s risk-based framework.⁵⁷

More broadly, the reform contributes to a fragmented and unstable regulatory landscape. If AI-specific safeguards are removed from the horizontal framework and reintroduced through sectoral legislation such as the MDR/IVDR, developers may face diverging standards, timelines and conformity assessment procedures across sectors. Instead of a single EU framework for high-risk AI, this would result in multiple overlapping regimes. Similar inconsistencies are already visible in the regulation of consumer-facing technologies and general-purpose AI, where systems that influence health-related decisions may fall outside medical device regulation depending on their intended purpose, despite their real-world impact on patient care.⁵⁸ Such misalignments increase compliance complexity and reduce legal certainty.

For patients, these forms of legal uncertainty translate into concrete risks. They may not be aware of when AI is used in diagnosis or treatment, how it influences clinical decision-making or what safeguards apply. Where harm occurs, it may be difficult to determine who is responsible—clinicians, healthcare providers or developers—particularly in the absence of clear and consistent obligations across the system.⁵⁹ Legal uncertainty may also undermine informed consent and obscure patterns of unequal outcomes, especially where AI systems perform differently across population groups.⁶⁰ In this sense, fragmentation and signalling incoherence do not merely affect regulatory design but directly shape the level of protection available to patients in practice.⁶¹

Finally, the implications for innovation and competitiveness are more complex than the simplification narrative suggests. While the Commission presents the reform as reducing administrative burdens and increasing predictability, removing core AI-specific safeguards risks producing a less coherent regulatory regime. In the longer term, this may undermine rather than strengthen the EU’s ambition to provide a ‘simple’ and trusted environment guiding the development of medical AI.⁶²

The legislative path ahead

The Commission’s proposal must be understood within the EU’s broader agenda of competitiveness and regulatory simplification. Reducing unnecessary administrative burdens and improving access to innovative medical technologies are legitimate policy goals, particularly in a sector characterised by high development costs and complex conformity assessment procedures. Indeed, a shift towards greater sectorisation in certain aspects of AI governance for medical devices could have long-term merits in streamlining cross-institutional coordination, provided that risks such as diverging standards, cross-sector fragmentation and capacity gaps are addressed from the outset. Nevertheless, healthcare occupies a special place in the regulatory landscape. Medical technologies directly affect bodily integrity, patient safety and access to care, often in situations of vulnerability and reliance on professional expertise. In this context, regulatory simplification must be balanced against the need to maintain safeguards addressing the distinctive risks of AI. In other words, simplification should not occur at the expense of lowering existing safeguards, nor should it postpone important questions about formulating AI-specific standards in a way that further undermines legal certainty.

The Health Innovation Package remains pending before the European Parliament and the Council under the ordinary legislative procedure. The recent legislative compromise reached in the Digital Omnibus demonstrates that simplification need not necessarily entail removing AI-enabled medical devices from the AI Act’s full high-risk regime. Rather, the colegislators opted to retain these systems within Section A of Annex I while introducing mechanisms allowing certain AI-specific requirements to be incorporated into sectoral legislation through delegated acts. In our view, this provides the more appropriate legislative model for the Health Innovation Package. By retaining AI-enabled medical devices within Section A of Annex I while allowing AI-specific requirements to be progressively incorporated into sectoral legislation where appropriate, the Digital Omnibus preserves the coherence of the AI Act’s risk-based framework without foreclosing future sector-specific adaptation. Whether a similar approach will emerge during negotiations on the Health Innovation Package remains uncertain. This uncertainty is compounded by the parallel reform of the MDR itself. Because the scope and interpretation of key provisions such as Rule 11 remain under discussion, it is currently difficult to predict how AI-enabled software will ultimately be classified and regulated under the future medical device framework.

The key legislative question is not whether simplification is desirable, but where it should occur. Many of the burdens identified by the Commission stem from the operation of the MDR and IVDR themselves. These challenges point towards a different, more principled route to simplification: reducing procedural and administrative complexity rather than weakening the substantive safeguards governing high-risk AI. This could include improving the capacity of notified bodies, aligning documentation requirements across regulatory frameworks, digitalising submission and reporting processes, developing integrated guidance for compliance and strengthening coordination between oversight bodies. Such measures would simplify the compliance architecture while preserving the normative foundations of AI governance in healthcare. By contrast, removing AI-specific safeguards risks addressing the symptoms of regulatory complexity while exacerbating existing uncertainty about accountability, responsibility and the safe deployment of AI systems in clinical practice.

Several regulatory pathways therefore remain open to legislators. The preferred legislative pathway is therefore to retain AI-enabled medical devices within Section A of Annex I, following the approach adopted in the Digital Omnibus. This preserves the AI Act’s horizontal high-risk framework while allowing future AI-specific requirements to be integrated into the MDR and IVDR through delegated acts where this can be shown to provide equivalent protection. A further possibility would be to classify certain categories of AI-enabled medical devices under Annex III of the AI Act through implementing acts, subjecting them to the high-risk regime of the AI Act without the sectoral link with the MDR/IVDR. Alternatively, if legislators do decide to abandon the horizontal approach of the AI Act, equivalent AI-specific safeguards should be incorporated directly into the MDR and IVDR without further delay and to set an appropriate baseline. It is, however, questionable whether safeguards relating to fundamental rights and deployer duties will be incorporated into this manufacturer-focused product safety framework.⁶³

The key issue is whether a high-risk label without meaningful AI-specific safeguards is sufficient in a sector as sensitive as healthcare. As AI becomes increasingly embedded in clinical decision-making, the challenge for EU policymakers is to ensure that regulatory simplification does not come at the expense of patient safety, health equity and trust in healthcare systems. A high-risk label that no longer carries high-risk duties is not a simplified version of the original regulation. It is a different regulation altogether.