Five gaps between the AI Act high-risk criteria and our MDR QMS

Description and use

Problem: integrating AI Act requirements into an existing MDR QMS for SaMD. Solution: a parallel framework with cross‑references, separate documents for new requirements, and process automation.

Problem

A SaMD manufacturer needs to reconcile the AI Act high‑risk classification with its existing MDR Class IIa SaMD QMS, but the overlap is more complex than guidance suggests.

Outcome

By treating the AI Act as a parallel framework with explicit cross‑references, the manufacturer reduces cross‑referencing errors, aligns audit requirements, and ensures compliance with both MDR and AI Act obligations.

Workflow

• 1. Map AI Act articles to device scope during change control.
• 2. Flag AI Act Article 9 when risk‑management changes occur.
• 3. Prompt Article 10 review for CAPA affecting data quality.
• 4. Maintain separate fundamental‑rights risk register linked to ISO 14971.
• 5. Create deployer‑facing documentation for transparency and limitations.
• 6. Implement human‑oversight mechanisms (kill switches, explanation interfaces).
• 7. Keep a side‑by‑side incident log for AI Act Article 72 and MDR PSUR.
• 8. Coordinate audit cycles with notified bodies, anticipating longer cycles and document churn.

Evidence

The AI Act’s recitals and the joint Commission guidance are clear: where a medical device is also a high‑risk AI system under Annex I, the manufacturer follows the MDR conformity assessment pathway, and the AI Act’s horizontal requirements are presumed to be satisfied to the extent the MDR framework covers them.

Source

We are now adding one as a separate artefact, cross‑referenced from our ISO 14971 risk management files.

Source

The AI Act has its own post‑market monitoring system expectations, including active monitoring of serious incidents and reporting timelines that do not line up cleanly with the MDR’s vigilance and PSUR cadence.

Source

I am treating it as a parallel framework with explicit cross‑references, which is roughly the framing I found in the qmsWrapper writeup on EU AI Act for medical device companies.

Source