US device makers closed one regulatory conversion on 2 February 2026, when the QMSR replaced the quality system rules of 21 CFR Part 820 with a text that incorporates ISO 13485:2016 by reference.1FDA, Quality System Regulation Amendments, 89 Fed. Reg. 7496 (2 February 2024), effective 2 February 2026. Seven weeks earlier, on 16 December 2025, the European Commission had proposed to move the EU's device rules in what looks like the same direction. Its proposal is a regulation amending the MDR and the IVDR that would remove the expiry date from notified-body certificates, let surveillance audits stretch from every twelve months to every twenty-four, make class I the default for clinical software, and give a manufacturer thirty days rather than fifteen to report a serious incident.2European Commission, COM(2025) 1023 final (16 December 2025), procedure 2025/0404(COD). The reflex on the US side is to read the two events as convergence and to let the next European dossier wait for the simpler rules. That reading misses three things. The proposal is not law, and the deadlines that bind in 2027 and 2028 are the ones it leaves untouched. Its answer to the overlap with the AI Act is not the answer the EU legislator adopted for that overlap in June 2026 and signed in July. And Switzerland, which most US teams file under Europe, incorporates the MDR through a reference frozen at a 2024 amendment, and moves only when Bern decides to move.
1. A Proposal Is Not a Deadline: The Clocks That Keep Running
The proposal, COM(2025) 1023, runs under the ordinary legislative procedure as file 2025/0404(COD), and as at publication neither co-legislator had adopted a position. The Council's Working Party on Pharmaceuticals and Medical Devices began an article-by-article reading on 23 March 2026. The Cyprus presidency's progress report of 5 June 2026, noted by the EPSCO Council on 16 June, records that delegations welcome the objectives and that additional work to refine and complement the proposal will be necessary before a general approach. Among the open points it names the division of tasks between the EMA and the MDCG, the criteria for well-established technology, the effect of mandated fee reductions on the financial sustainability of notified bodies, the legal scrutiny of new Commission delegated powers, and sector-specific requirements for AI-enabled and cybersecurity-relevant devices. It also records that the Parliament is aiming to vote on its position early in 2027.3Council doc 9801/26 (5 June 2026); SANT draft report PE787.987 (30 June 2026); DSV statement (14 July 2026). The Parliament's rapporteur's draft report, dated 30 June 2026 and presented to the Committee on Public Health on 14 July 2026, opened the amendment stage. A statement by the German social-insurance representation of 14 July 2026 welcomed that draft for tightening the equivalence route and the priority pathways discussed below, an indication of the direction from which parliamentary pressure arrives.3 Under the proposal's own final article most of the text applies six months after entry into force, and entry into force follows publication by twenty days. With no first-reading position on either side in July 2026, general application before 2027 is arithmetically excluded.
The proposal also carries five application dates of its own. Art. 5 of the proposed regulation sets the general rule at six months after entry into force, but the certificate-validity provision in Art. 56 MDR and the paragraphs added to Art. 120 MDR would apply from entry into force itself, the rules on the designation, monitoring and fees of notified bodies twelve months after it, the cybersecurity reporting duty in Art. 87a MDR three years after it, and the reversed presumption on single-use devices in Art. 17 MDR five years after it.4COM(2025) 1023 (n 2), Art. 5(1) to (3). None of those clocks has started, because none can start before an act exists, and the intervals are themselves under negotiation.
The clocks that have started are the ones the proposal does not touch. Under Art. 120(3a) MDR, as amended in 2023, a legacy device certified under the directives may stay on the market until 31 December 2027 if it is a class III device or a class IIb implantable device outside the listed exceptions, and until 31 December 2028 for the other classes that need a notified body. Art. 120(3c) MDR makes both dates conditional on a quality management system and a formal notified-body application in place by 26 May 2024 and a written agreement signed by 26 September 2024.5Regulation (EU) 2017/745 (MDR), Art. 120(3a) to (3c); Regulation (EU) 2017/746 (IVDR), Art. 110(3a) to (3c); Decision (EU) 2025/2371. The Commission's explanatory memorandum calls those extensions a short-term solution, and the enacting text adds paragraphs 14 and 15 to Art. 120 MDR while leaving paragraphs 3a to 3e as they stand. The IVDR's own ladder under Art. 110 IVDR, 31 December 2027 for class D, 2028 for class C and 2029 for class B and sterile class A devices, is likewise untouched. Mandatory use of EUDAMED's first four modules began on 28 May 2026 and continues on the existing legal basis, the subject of Insight 57.5 A device whose transition ends on 31 December 2027 will meet that date under the text as it stands, whatever the co-legislators later agree about certificates that do not yet exist.
The Commission is also legislating under the existing text while proposing to replace parts of it. Implementing Regulation (EU) 2026/977 of 4 May 2026, adopted under Art. 36(3) MDR and Art. 32(3) IVDR, fixes maximum timelines for notified-body work and lays down re-certification procedures for product and quality-system certificates. The timelines are thirty days from a complete application to a signed contract, 120 days for the quality-management-system audit, ninety days for the technical-documentation review of each device or representative device and twenty days for the decision. The Regulation applies from 25 February 2027 to procedures whose written agreement is signed on or after that date, and its re-certification articles reach certificates expiring on or after 25 November 2027.6Commission Implementing Regulation (EU) 2026/977 (4 May 2026), Art. 2(2), Art. 5 to 9. It is an instrument built around the five-year certificate cycle, adopted five months after a proposal that would abolish that cycle, and both are Commission texts. A manufacturer whose certificate expires in early 2028 will be re-certified under the implementing regulation's procedure unless the amending regulation has entered into force by then and the notified body agrees otherwise, and nothing published by July 2026 said which.
That last clause is the proposal's own transitional device, and it makes the choice of regime a term to be negotiated. Under the paragraph 15 that the proposal would add to Art. 120 MDR, where a conformity assessment is pending on the general application date, or a certificate was issued before it, the manufacturer and the notified body may agree to continue applying the regulation in the form applicable before that date until the procedure is finalized or the certificate is renewed.7COM(2025) 1023 (n 2), new Art. 120(15) MDR (election by agreement) and new Art. 35(6a) MDR (dispute mechanism). The provision says who may agree. It does not say what happens when they do not, whether a notified body may condition its agreement, or how the election is recorded. The dispute mechanism the proposal adds in Art. 35(6a) MDR, under which the authority responsible for notified bodies decides within ninety days a substantiated dispute arising from the Annex VII requirements and the notified body's involvement in the assessment, is expressly without prejudice to other remedies, and whether a disagreement about which version of the regulation to apply is a dispute of that kind is left open. Some delegations already find the mechanism challenging as envisaged.7 For a US manufacturer whose European strategy runs through one notified body, the regime under which the next certificate is issued may thus be decided at a contract table rather than in the Official Journal.
A proposal to abolish certificate expiry does not extend a single certificate that expires before the proposal becomes law.
2. What Would Change, and for Whom: Certificates, Classification and Evidence
Under Art. 56(2) MDR as it stands, a certificate is valid for the period it indicates, which may not exceed five years, and may be extended for further periods of up to five years on a re-assessment. The proposal replaces that with a certificate whose validity is not limited in time unless the notified body, in exceptional cases and on duly justified grounds, limits it. It adds a paragraph 2a under which the notified body carries out surveillance during the certificate's life, including periodic reviews proportionate to the risk class, and it widens Art. 56(3) MDR from restrictions on intended purpose and mandated PMCF studies to conditions on validity generally.8COM(2025) 1023 (n 2), Art. 56, Annex VII, Section 4.11, Annex IX, Sections 3.3 and 3.4 MDR as proposed; MDR (n 5), Art. 56(2), Art. 58. In Annex IX the surveillance audit stays annual by default but may fall to every twenty-four months where previous results justify it and post-market data raise no concern, may be remote on justified grounds, and unannounced audits become for-cause. The difference from a PMA, which is not re-approved on a calendar either, is where the discretion sits. The interval of the periodic review, the grounds that make a case exceptional and the conditions attached to validity are the notified body's to set. A manufacturer whose certificate carries a condition it cannot meet on time faces Art. 56(4) MDR, suspension or withdrawal, rather than a renewal it can plan for. A certificate without an end date is also a certificate without a natural moment at which a manufacturer changes notified body, and Art. 58 MDR on voluntary change is not amended.
Classification is where the proposal reaches furthest into US portfolios, because it reaches software. Rule 11 of Annex VIII MDR, as it stands, puts software intended to provide information used to take decisions with diagnosis or therapeutic purposes in class IIa by default, rising to class IIb or class III with the severity of the harm a wrong decision may cause, with all other software in class I. The proposal inverts the default. Software intended to generate an output that confers a clinical benefit and is used for diagnosis, treatment, prevention, monitoring, prediction, prognosis, compensation or alleviation of a disease or condition would be class I. Where the output is intended for a disease or condition in a critical situation, the software would be class III. Where it is intended for a disease or condition in a serious situation, or to drive clinical management in a critical one, it would be class IIb. Where it is intended for a disease or condition in a non-serious situation, to drive clinical management in a serious one, or to inform clinical management in a critical or serious one, it would be class IIa.9COM(2025) 1023 (n 2), Annex VIII, Rule 11 as proposed, new Art. 2, point 72 and Art. 51a MDR; MDR (n 5), Rule 11, Art. 52(7); 21 U.S.C. § 360j(o)(1)(E). A US counsel will hear the inform-and-drive vocabulary of the IMDRF and think of the clinical-decision-support carve-out that section 520(o)(1)(E) of the FD&C Act made from the device definition. The EU version is not a carve-out. The software stays a device under the MDR's general safety and performance requirements. What changes is that a class I device is self-declared under Art. 52(7) MDR, without a notified body and without a certificate. A classification dispute, which the proposal's new Art. 51a MDR routes to a competent authority, then becomes a dispute about whether a notified body is involved at all. The proposal also lowers reusable surgical instruments to class I and replaces the device lists in Art. 18, 52 and 61 MDR with a defined term whose criteria the Council's progress report says need further refinement and clarification.9 Which side of each line a product falls on is a question of intended purpose as written, and the proposal moves the lines without changing a word on the label.
Clinical evidence moves in the same direction and creates a problem for the manufacturer whose evidence it is. Under Art. 61(5) MDR a manufacturer may rely on equivalence to another manufacturer's marketed device, to avoid running a clinical investigation, only where the two have a contract that explicitly allows the second manufacturer full access to the technical documentation on an ongoing basis and the original clinical evaluation complied with the regulation. The proposal narrows the investigation requirement in Art. 61(4) MDR to implantable class IIb and class III devices and deletes the contract. The second manufacturer would need only to provide clear evidence to the notified body that the original clinical evaluation was performed in compliance with the regulation.10COM(2025) 1023 (n 2), Art. 61(4), (5), (10) and Art. 2, point 48 MDR as proposed; MDR (n 5), Art. 61(5), Annex XIV, Art. 109. How a competitor is to evidence the compliance of a clinical evaluation it has no right to see is not addressed, and Art. 109 MDR still binds the notified body to confidentiality toward the first manufacturer. The same amendment extends clinical data to literature that is not necessarily peer-reviewed and expands Art. 61(10) MDR so that conformity may be justified on non-clinical methods alone, in silico testing among them.10 For a US manufacturer with a predicate-based FDA file the point to hold onto is that EU equivalence remains the technical, biological and clinical test of Annex XIV MDR, not substantial equivalence, and that the manufacturer whose device becomes the reference acquires no contractual position from which to control that use.
The proposal borrows two US labels and attaches different consequences to them. Section 515B of the FD&C Act lets a sponsor request breakthrough designation from the FDA for a device that offers more effective treatment or diagnosis of a life-threatening or irreversibly debilitating condition, and the humanitarian-use device rules turn on a condition manifested in not more than 8,000 individuals in the United States per year.11COM(2025) 1023 (n 2), new Art. 52a and Art. 120(14) MDR; 21 U.S.C. § 360e-3; 21 CFR 814.3(n); DSV statement (n 3). The proposal's Art. 52a MDR defines a breakthrough device by a high degree of novelty in the Union and a significant positive clinical impact for a life-threatening or irreversibly debilitating disease, and an orphan device by a disease or condition presenting in not more than 12,000 individuals in the Union per year with insufficient alternatives or an expected clinical benefit over them. Designation comes not from a regulator but from a published expert-panel opinion, requested by the manufacturer or the notified body. The notified body then prioritizes the assessment, may apply a rolling review, and may certify on limited clinical data where the benefit of immediate availability outweighs the risk of the missing data or the manufacturer commits to post-market clinical follow-up, limiting the certificate's validity and attaching conditions as it does so.11 For legacy orphan devices a new Art. 120(14) MDR would let a legacy device under Art. 120(3a) or (3b) MDR stay on the market past the 2027 and 2028 dates on an expert-panel opinion, subject to conditions. Among them are an annual PSUR to the competent authority, no CE marking without a valid certificate, and a renewed opinion at least every ten years.11 A device sold under a declaration that it is an orphan device placed on the market under a transitional provision is a category no distribution agreement drafted before 2026 describes. The statement of 14 July 2026 welcomed what it described as the draft report's five-year limit on both pathways' certificates, so the pathways may end narrower than proposed.
The post-market changes read as relief, and each carries a second clause. Art. 87(3) MDR would give a manufacturer thirty days rather than fifteen to report a serious incident, the same thirty calendar days that 21 CFR 803.50 allows a US manufacturer. But the two-day clock for a serious public-health threat and the ten-day clock for death or an unanticipated serious deterioration in Art. 87(4) and (5) MDR are not amended. Art. 86(1) MDR would require class IIb and class III manufacturers to update the PSUR within the first year after certification and every two years thereafter, or when the benefit-risk determination changes significantly, and class IIa manufacturers only when necessary.12COM(2025) 1023 (n 2), Art. 86, 87, new Art. 87a, Annex VII, Section 4.9 MDR; MDR (n 5), Art. 86(1), 87(3) to (5); Regulation (EU) 2024/2847 (CRA); 21 CFR 803.50, 803.53; 21 U.S.C. § 360e-4. The new Art. 87a MDR then adds a duty the existing text does not carry. It requires a report within thirty days of an actively exploited vulnerability, or of a severe incident within the meaning of the Cyber Resilience Act, filed through EUDAMED to the coordinating CSIRTs and to ENISA, applying three years after entry into force and running beside, not instead of, the Art. 87 MDR vigilance report and the reporting clocks examined in Insight 67. In Annex VII the notified body's procedures and contracts would have to distinguish changes that need not be reported, changes reported without prior approval and changes requiring prior approval, and the notified body and the manufacturer would agree, where appropriate, a predetermined change control plan letting the manufacturer implement planned changes without prior information.12 That is the vocabulary of section 515C of the FD&C Act, but an FDA plan is approved by an agency and an EU plan would be agreed with a private body as a term of a contract.
The chapter US readers will search for first is the shortest. A new section after Art. 108 MDR would commit the Commission to international regulatory cooperation, name the IMDRF and the MDSAP among the fora in which it participates, and let it join reliance mechanisms under Art. 108b MDR that enable the use of assessments, inspections and other regulatory decisions of third-country authorities, on condition of an equivalent level of protection and effective arrangements for information exchange, transparency and oversight. The mechanisms would fall to be taken into consideration by competent authorities, economic operators and notified bodies, and their detailed rules would be left to implementing acts.13COM(2025) 1023 (n 2), new Art. 108a to 108c MDR; Council doc 9801/26 (n 3), para 18. Nothing in that text makes an FDA clearance, an MDSAP audit report or a QMSR inspection a substitute for a notified-body certificate. The implementing acts that would give the phrase content do not exist, and the Council's report records that most delegations support the aim while recalling the procedures of the Treaties and the prerogatives of the Council. A US strategy that assumes the FDA file will one day travel is assuming a decision the Commission has reserved to itself and the Member States have flagged.
3. The AI Act Interface: Two Instruments, Two Tools, One Overlap
An AI-enabled device reaches the AI Act's high-risk category through Art. 6(1) AI Act, which requires both that the AI system be a product, or the safety component of a product, covered by the Union harmonization legislation in Annex I and that the product undergo third-party conformity assessment under that legislation. The MDR and the IVDR are points 11 and 12 of Section A of that Annex, and for Section A products Art. 43(3) AI Act carries the requirements of Chapter III, Section 2 AI Act into the product's own conformity assessment. For products under the Section B list, aviation, vehicles, marine equipment and rail among its entries, Art. 2(2) AI Act applies only Art. 6(1), Art. 102 to 109 and Art. 112 AI Act, a list the Digital Omnibus on AI examined below rewrites, as adopted, to Art. 6(1), Art. 60a and Art. 102 to 112 AI Act.14Regulation (EU) 2024/1689 (AI Act), Art. 2(2), Art. 6(1), Art. 43(3), Annex I, Annex III, point 5(d); COM(2025) 1023 (n 2), Art. 4, recital 23; Council doc 9801/26 (n 3), para 19. Art. 4 of the proposal deletes points 11 and 12 from Section A and adds the MDR and the IVDR to Section B as points 21 and 22. Recital 23 says why. It reasons that the parallel application of the two regimes could lead to overlaps and stifle innovation, and that the AI Act's application to devices should therefore be limited to the provisions Art. 2(2) AI Act names, with the Commission free to lay down AI-specific requirements under the MDR by implementing or delegated act and with notified bodies that assess high-risk AI under the MDR expected to meet Art. 31 AI Act.14 As proposed, the AI Act's high-risk requirements would cease to apply to medical devices as AI Act obligations and would return, if at all, as MDR requirements written by the Commission. The two texts do not even share a numbering. The adopted Omnibus deletes point 1 of Section A and assigns point 21 of Section B to the Machinery Regulation, the same point number the proposal reserves for medical devices.15Digital Omnibus on AI, COM(2025) 836, adopted 29 June 2026 and signed 8 July 2026: Art. 113, Art. 2(13), Art. 111(2) and Art. 6(1a) to (1c) AI Act as amended.
The EU legislator dealt with the same overlap by a different instrument while the proposal was being read. The Digital Omnibus on AI, proposed on 19 November 2025, was adopted by the Council on 29 June 2026 and signed on 8 July 2026. At publication the Official Journal had yet to carry it. As adopted, it moves the application date for Annex I high-risk systems, the route a regulated device travels, to 2 August 2028. It inserts an Art. 2(13) AI Act under which the requirements of Art. 9 to 15 and Art. 17 to 25 AI Act may be limited, by delegated acts due by 2 August 2027, for Art. 6(1) AI Act systems where and to the extent that the Section A product legislation provides an equivalent or higher level of protection, and it narrows the safety-component gateway in Art. 6(1a) to (1c) AI Act.15 That mechanism presupposes that medical devices remain in Section A, because Art. 2(13) AI Act is written for Section A legislation. The proposal presupposes that they leave it. Two texts, one adopted and awaiting publication and one under negotiation, resolve the same overlap by opposite routes. The adopted one keeps the AI Act's requirements and lets the Commission subtract from them where the MDR already protects. The proposed one removes them and lets the Commission add back under the MDR. The cybersecurity analysis in Insight 67 was written on the first footing, as any analysis had to be in July 2026. A compliance program built to Art. 15 AI Act for 2028 may be building to a requirement that a 2027 delegated act narrows, that a later MDR amendment removes, or that survives both.
The classification change compounds it from the other side. Art. 6(1)(b) AI Act attaches high-risk status only where the product must undergo third-party conformity assessment. Clinical software that the proposed Rule 11 moves to class I is self-declared under Art. 52(7) MDR, so an AI system inside it fails the second limb of Art. 6(1) AI Act and is not high-risk on the Annex I route at all, whichever Section the MDR sits in, unless it separately falls within Annex III AI Act, whose point 5(d) reaches emergency-healthcare patient triage systems and little else in medicine.14 The same reclassification therefore removes the notified body from the device and the AI Act from the model in one step, for software whose intended purpose has not changed. Conversely, a device that keeps its class and its notified body and is certified in 2027 with the AI Act's requirements built into that assessment under Art. 43(3) AI Act is reassessed only on a substantial modification. Art. 111(2) AI Act, as amended by the Digital Omnibus on AI, brings systems already on the market into the AI Act only on a significant change in design after 2 August 2028.15 Which version of the interface a device certified in 2027 lives under is thus a question of its certification date, its change history and two acts whose relationship to each other neither text describes.
4. Switzerland: The Copy That Does Not Move With Brussels
Switzerland is not an EU Member State, and the MDR has no direct effect there. The Swiss device ordinance, the MepV, incorporates the MDR rather than restating it, and the mechanism of incorporation decides everything that follows. Art. 4(1)(f) MepV defines the EU-MDR, in a footnote, as Regulation (EU) 2017/745 as last amended by Regulation (EU) 2024/1860, and Art. 5(2) MepV provides that references to the EU-MDR are references to the version fixed in that footnote. Only the Commission acts adopted under the EU-MDR provisions listed in Annex 4 MepV apply in Switzerland in their EU version, and Art. 95(1) MepV directs Swissmedic to take the Commission's implementing acts into account in enforcement.16Medizinprodukteverordnung (MepV) (SR 812.213), Art. 4(1)(f), 5(2), 15, 23, 25(4), 26, 51, 95, 101, 108, Annex 4; Swissmedic notice of 1 July 2026. An amending regulation of the Parliament and the Council is neither. It reaches Switzerland when the Federal Council amends the MepV and its footnote, as it did on 29 September 2023, with effect from 1 November 2023, when Art. 101 MepV received the same 31 December 2027 and 2028 dates as Art. 120(3a) MDR.16 Until that happens for the simplification regulation, whenever it is adopted, the Swiss text is the MDR of 2024.
Three divergences follow for a US manufacturer that sells into both markets, and each opens on the day the EU text changes. Art. 26(1) MepV states that certificates are valid for a maximum of five years, extendable by at most five years at a time on re-assessment, a Swiss rule that does not depend on Art. 56(2) MDR and would not fall with it. Certificates of EU-designated notified bodies are accepted in Switzerland under Art. 25(4) MepV on the condition, to be credibly shown, that the procedures applied satisfy the Swiss requirements and that the body's qualification is equivalent. The Swiss requirements are, under Art. 23 MepV, Art. 52 and 54 and Annexes IX to XI MDR in the incorporated version.16 A certificate without an end date, or one issued after a procedure with a single representative device for a portfolio, remote audits and surveillance every twenty-four months, would have to be shown equivalent to a text that still assumes five years and annual audits. Nothing published by July 2026 said how Swissmedic would read that. Classification is the sharpest of the three. Art. 15 MepV classifies devices by Annex VIII of the incorporated EU-MDR, so software that the proposed Rule 11 moves to class I in the EU would remain class IIa in Switzerland, and the Swiss market would go on asking for the notified-body certificate the EU market had stopped asking for.16
The Swiss constants remain. A manufacturer without a seat in Switzerland needs a Swiss authorized representative under Art. 51 MepV, whose mandate must be in writing and whose rights and duties follow Art. 11 MDR. From 1 July 2026 devices placed on the Swiss market must be registered in swissdamed, Swissmedic's database, no later than 31 December 2026 and at once where a serious incident, a field safety corrective action or a trend has to be reported. And the medical-devices chapter of the Swiss-EU mutual recognition agreement, which stopped delivering recognition on 26 May 2021, is not restored by the protocols signed on 2 March 2026, whose realignment of that chapter is left to an undated decision of the agreement's Committee, a matter Insight 53 takes up.17Swiss-EU MRA (SR 0.946.526.81), Annex 1, ch 4; protocols signed 2 March 2026; Botschaft of 13 March 2026. A US group whose European entry runs through a Swiss subsidiary, or whose CH-REP is the same entity as its EU authorized representative, will hold two files that were identical in 2024 and stop being identical on the day the EU text changes, on an interval set by a Federal Council calendar that nobody in Brussels controls.
5. Strategic Considerations
The questions that decide exposure are not the ones a simplification headline answers. Whether to lodge the next notified-body application before or after the amending regulation applies, and whether to elect under the proposed Art. 120(15) MDR to finish a pending assessment under the old text, turns on the notified body's capacity, its willingness to agree and the device's position on the transition ladder. Whether a software product changes class under the proposed Rule 11 depends on how its intended purpose describes the situation, critical, serious or non-serious, and whether its output informs or drives clinical management. The same words then decide whether the product keeps its notified body, whether the AI Act reaches its model and whether Switzerland classifies it differently from the EU. Whether a competitor may build a clinical evaluation on a manufacturer's own device without a contract, and what the manufacturer can do about it, is a question of trade-secret law and of what a notified body will accept as clear evidence, and the proposal supplies neither.
Behind those sit questions that depend on facts only the company holds. What the distribution and supply agreements assume about certificate renewals, and whether a certificate that never expires but carries conditions is a certificate for their purposes. What the group's Swiss file says that the EU file will stop saying, and which entity signs the CH-REP mandate. What the risk factors of a US-listed parent describe when they describe EU regulatory simplification as relief, given that the deadlines of 2027 and 2028 are unmoved and that the AI Act obligations on the device route are set, for the moment, by an act written for a Section A in which medical devices still sit.
Whether a given device sits on the right side of each of these lines depends on its class as written, its certificate dates, its notified body's designation and appetite, the contracts around its clinical evidence and the group's Swiss footprint. Those are questions of fact and of drafting, and they require analysis tailored to the device, the entities involved and the commercial context.