GAWEL LEGAL

Medical-AI readiness assessment

The medical-AI readiness assessment reviews what the AI Act adds to a device's existing MDR or IVDR documentation, requirement by requirement. It is for manufacturers whose AI medical device or in vitro diagnostic is already in a notified-body procedure: it confirms the high-risk determination, rates the existing file against each requirement of Art. 9 to 15 AI Act and sets out when each obligation applies, for a capped fee.

Request a medical-AI readiness assessment View scope
Reviewing the existing device file
Starting point
MDR or IVDR documentation
Additional requirements
EU AI Act review
Result
Readiness rating and gap register

A readiness assessment, not a conformity assessment

Who this is for

  • Manufacturers of an AI device or IVD already in a notified-body procedure, who need to establish the additional AI Act work required beyond their existing documentation
  • Companies whose device was certified before the AI feature was added, or whose model has been retrained since the certificate issued
  • SaMD companies seeking a review of the scope of a proposed AI Act project and its relationship to the existing conformity procedure
  • Hospitals, health systems and service providers putting a CE-marked diagnostic into use, whose duties are the deployer's rather than the provider's
  • Investors and acquirers who need a reasoned view of an AI device's readiness under the combined requirements before a transaction closes

Scope

  • The high-risk determination, with its route:
    whether the AI system is, or is a safety component of, a product covered by Annex I AI Act that needs third-party conformity assessment (Art. 6(1) AI Act), assessed under the carve-out that the Digital Omnibus on AI (Regulation (EU) 2026/1744) added for AI used solely for convenience, performance or quality control and the health-and-safety limb that puts it back (Art. 6(1a) and Art. 6(1b) AI Act). The device class is an input, never re-derived here.
  • The single-assessment position:
    that the AI Act requirements are assessed inside the MDR or IVDR procedure rather than beside it (Art. 43(3) AI Act), and whether the notified body already engaged is one that may take the work
  • Comparison with existing documentation:
    each of the seven requirements of Art. 9 to 15 AI Act set against the technical documentation and quality system the manufacturer already maintains, saying what is satisfied, what is partly satisfied and what is absent. This comparison requires the existing device documentation.
  • The provider and deployer duties that sit outside the seven:
    the provider obligations and quality-management system (Art. 16 and Art. 17 AI Act), registration and post-market monitoring (Art. 49 and Art. 72 AI Act), the deployer duties where the client also deploys (Art. 26 AI Act), and the AI-literacy duty that binds both, in the terms the Digital Omnibus left it (Art. 4 AI Act)
  • The data-governance position:
    what Art. 10 AI Act requires of training, validation and testing data, and the narrow permission to process special-category data for bias detection and correction (Art. 4a AI Act), which runs to the client and never to GAWEL Legal
  • Obligation calendar and Swiss position:
    the dated duties on the limb that applies, and the fact that Switzerland has not adopted the AI Act, so the overlay is EU-market-only while the Swiss device track runs in parallel under the MepV or, for an in vitro diagnostic, the IvDV

The assessment in detail

The scope of the work depends on high-risk classification, the conformity procedure and what the existing documentation already covers.

High-risk classification

Where an AI system is, or is a safety component of, a product covered by the Union harmonization legislation in Annex I AI Act, and that product must undergo third-party conformity assessment, the system is high-risk (Art. 6(1) AI Act). The MDR is point 11 and the IVDR point 12 of Annex I, Section A AI Act, so a device above the self-certified classes is caught by operation of law. Since the Digital Omnibus, the assessment must also consider the following provisions: AI used solely for non-safety-related user assistance, performance optimization, service efficiency, automation, convenience or quality control is not a safety component (Art. 6(1a) AI Act), and AI whose failure or malfunctioning would endanger health and safety is one regardless (Art. 6(1b) AI Act). The assessment states which provision applies.

The conformity procedure

For a device the provider follows the conformity assessment procedure the MDR or the IVDR already requires, and the AI Act requirements are part of that assessment (Art. 43(3) AI Act). There is no separate AI Act CE marking, no second technical file and no parallel audit. The readiness plan therefore addresses additional requirements within the existing procedure. The same article conditions which notified bodies may assess those requirements, so whether the body already engaged can take the work is checked rather than assumed, and any gap in designation is recorded with the time needed to resolve it.

What the existing documentation covers

All seven requirements apply: risk management, data and data governance, technical documentation, record-keeping, transparency to deployers, human oversight, and accuracy, robustness and cybersecurity (Art. 9 to 15 AI Act). A manufacturer in a notified-body procedure already satisfies part of each through the MDR or IVDR technical documentation, the quality system and the post-market file. The assessment identifies what is already covered. Existing risk management and technical documentation usually cover more of the requirements than data governance and human oversight. Record-keeping depends on what the software already logs. The assessment distinguishes requirements already met from those needing further work.

What the assessment does not cover

The assessment does not:

  • certify anything: it is not a conformity assessment and produces no statement that the device conforms, which only the notified body can give;
  • classify the device, which is its input rather than its output, and which GAWEL Legal's MDR and IVDR compliance work supplies;
  • perform technical, quality-system, clinical or model-evaluation work of any kind;
  • draft or revise the documents identified in the comparison; each of those is its own deliverable, priced separately;
  • correspond with a notified body or an authority;
  • receive patient data: the assessment uses the technical documentation and the governance documents, and training-data content is discussed structurally (Art. 5 lit. c DSG, Art. 9 GDPR).

The rating helps prioritize further work. It is not a reasoned legal opinion on any single question; that is a separate deliverable, and the assessment names it where one is needed.

Information for the review

  • The device's classification and the basis for it, and the notified body engaged, with the certificate if one has issued
  • The technical documentation index, the quality-system procedures relevant to software and risk management, and the post-market surveillance plan. The index matters more than the volume: the assessment reads what is there to establish what is covered.
  • A description of the AI component: what it does, whether it is trained or fixed, whether it is updated after release, and whether any part of it is a third-party model
  • One scoping call, usually under an hour, to clarify any questions remaining after the questionnaire
  • No patient data and no model weights. Nothing in the assessment requires either, and the intake is built so that neither is requested.

How the work proceeds

  1. Intake The questionnaire and a short scoping call establish the device, its class, the AI component and the conformity route already under way.
  2. Determination The high-risk conclusion is confirmed against Art. 6(1) AI Act with the Omnibus provisions considered, the role is fixed as provider, deployer or both, and any third-party model dependency is identified.
  3. Document review Each of the seven requirements is set against the existing file and rated, the duties outside the seven are assessed, and any uncertainty is recorded for review.
  4. Legal review Every determination and every rating is confirmed or corrected, the flagged points are resolved, and the order of work is set against the dates.
  5. Final checks and delivery Sources, citations and consistency between ratings are checked before delivery of the report, including the gap register and the method note.

Any follow-up work identified in the report is scoped separately under EU AI Act compliance work, or as an integrated mandate under digital health compliance where device, AI and data matters need to be coordinated. For a company that first needs to establish whether the AI Act applies, the broader regulatory posture audit provides an initial overview of the applicable rules.

An example report

The example below shows the readiness summary and the first entries in the gap register.

Illustrative excerpt based on fictional facts, not a client matter.

Scope. One product. A standalone software device that triages radiology studies, flagging those with suspected findings for earlier reporting. Class IIb, CE marked under the MDR through a notified body, with a certificate issued before the current model generation. The scoring model has been retrained twice since, on data the manufacturer holds, and the manufacturer is established in the European Union. No in vitro diagnostic function and no third-party foundation model are involved.

Readiness summary

  • 2 red
  • 3 orange
  • 2 green

The seven high-risk requirements of Art. 9 to 15 AI Act, each rated against the technical documentation and quality system already in place. The provider duties outside the seven are assessed separately and are not counted here.

  • The device is high-risk and falls outside the carve-out. The device is a product covered by Annex I AI Act and it needs third-party conformity assessment, so it is high-risk by operation of law. The Digital Omnibus exempts AI used solely for convenience, performance or quality control, but a function whose failure would delay the reporting of a suspected finding endangers health and safety and is a safety component regardless. The readiness plan must therefore treat the device as high-risk.
  • The notified body's designation may affect the timetable. The AI Act work belongs inside the conformity procedure the MDR already requires, so there is no second CE marking to plan for. But the notified body may assess those requirements only where its compliance with Art. 31(4), (5), (10) and (11) AI Act was established in its own notification, and the certificate here predates that question ever being asked. Confirming the designation, or finding a suitably designated body, is likely to take the most time.
  • The remaining work differs by requirement. The existing file covers risk management and technical documentation most extensively, because the MDR already demands both in a comparable form. Data governance and human oversight are less fully covered, because the MDR asks for clinical validation rather than for an account of how the training, validation and testing sets were assembled and checked. The assessment identifies these differences so that work focuses on the remaining gaps.

Recommended next steps. The order of work here follows the time needed for each task. The obligations on this route apply from 2 August 2028, which is far enough away that no single item is urgent on its own; what is not far away is the notified-body question, which has to be settled before the rest of the program can be scoped at all. The designation question comes first, followed by the data-governance record, which is the largest true gap and the slowest to build because it reaches back into work already done, then human oversight. The two green requirements are evidenced rather than rebuilt.

Gap register, first three entries

  1. Red

    Art. 43(3) AI Act

    Whether the notified body is authorized to assess the AI Act requirements

    For a device the provider follows the conformity assessment procedure the MDR already requires, and the AI Act requirements are part of that assessment rather than a separate one. The same provision conditions the body: it may assess those requirements only where its compliance with Art. 31(4), (5), (10) and (11) AI Act was assessed in the context of its notification. The body that issued this certificate was notified under the MDR alone, and nothing on file records that question being put. Although this duty belongs to the notified body, it is included because the answer may affect the manufacturer's timetable.

    Follow-up service: EU AI Act compliance

  2. Red

    Art. 10 AI Act, in particular Art. 10(3) AI Act

    Data and data governance over the training, validation and testing sets

    The technical documentation carries a clinical validation report and a performance study, which is what the MDR asks for. It does not carry an account of how the training, validation and testing sets were assembled, what populations they represent, or what was done about the gaps between them. The requirement is that those sets be relevant, sufficiently representative and, to the best extent possible, free of errors and complete in view of the intended purpose. Two retrainings have happened since the certificate issued, so the record has to be built for the current generation and for what preceded it.

    Follow-up service: EU AI Act compliance

  3. Orange

    Art. 14 AI Act

    Human oversight in the product design

    The instructions for use tell the radiologist that the triage output is not a diagnosis, which is a statement to the user. The requirement reaches further, into what the system itself provides so that a person can oversee it in use. The interface displays an ordering of studies and no indication of the confidence behind it, and the quality system records no decision about what a reviewer should be able to see or override. The gap is a design and documentation gap rather than a missing document, which is why it is sequenced third and not first.

    Follow-up service: Digital health compliance

A full report also includes the determination in full, the remaining four requirements, the provider duties outside the seven, the deployer position where the client also deploys, the obligation calendar and the attorney's sign-off.

Fees

Capped fee

The fee is set by how many devices or AI components are in scope, by whether the client is provider, deployer or both, and by the state of the existing file. If priority handling is expressly agreed, a 50 percent uplift applies.

Questions

What does the assessment produce?
A single rated report in five parts: the high-risk determination with the provision it rests on and the route it came in by; a gap register covering each of the seven requirements of Art. 9 to 15 AI Act, stating what the existing MDR or IVDR technical documentation already satisfies and what it does not; a rating of each requirement with the gap and the action that closes it; the dated obligation calendar set against the conformity timeline; and a short note on what was done and why. It is delivered in English or in German.
Does the AI Act mean a second CE marking?
No. For a device the provider follows the conformity assessment procedure the MDR or the IVDR already requires, and the AI Act requirements are part of that assessment (Art. 43(3) AI Act). There is one conformity assessment, one CE marking and one notified-body procedure. Art. 43(3) AI Act does add a condition on that body: it may assess the AI Act requirements only where its compliance with Art. 31(4), (5), (10) and (11) AI Act was assessed in its notification, so the readiness assessment checks early whether the client's existing notified body can carry out the work.
Does the assessment decide whether a device is high-risk?
It confirms the AI Act high-risk classification and explains its legal basis. High-risk follows by operation of law where the AI system is, or is a safety component of, a product covered by the legislation in Annex I AI Act and that product needs third-party conformity assessment (Art. 6(1) AI Act); the MDR is point 11 and the IVDR point 12 of Annex I, Section A AI Act. The Digital Omnibus added a carve-out for AI used solely for convenience, performance or quality control (Art. 6(1a) AI Act) and put back AI whose failure would endanger health and safety (Art. 6(1b) AI Act), so the assessment addresses both provisions expressly. The device class itself is an input, taken from the classification work and never re-derived here.
Does the pending proposal to move the MDR and the IVDR within Annex I AI Act change this?
Not while it is a proposal: the assessment applies the law in force. The Commission's proposal to simplify the MDR and the IVDR would move both from Section A to Section B of Annex I AI Act (Art. 4 COM(2025) 1023). For a product under Annex I, Section B AI Act, only Art. 6(1), Art. 60a and Art. 102 to 112 AI Act apply (Art. 2(2) AI Act), so the requirements of Art. 8 to 15 AI Act would no longer apply to a device directly; the Commission would take them into account instead when it adopts implementing acts, delegated acts and common specifications for such devices under the MDR and the IVDR (Art. 1(5) and Art. 2(5) COM(2025) 1023). The proposal is before Parliament and Council and may change on the way, and GAWEL Legal's analysis of the proposal sets out what else it would change.
Is this a conformity assessment?
No. It is a reasoned assessment of readiness under the combined requirements and of the gaps to close, and it produces no statement that the device conforms. Only the notified body can certify conformity, and the report states this expressly. GAWEL Legal also performs no technical, quality-system or clinical work: what is read is the documentation.
Is the assessment useful for a company that deploys an AI device rather than making one?
Yes. A hospital or health system putting a CE-marked diagnostic into use is a deployer, with its own duties: use in accordance with the instructions, human oversight by competent people, input-data relevance, log-keeping and monitoring (Art. 26 AI Act). The AI-literacy duty binds provider and deployer alike (Art. 4 AI Act), and since the Digital Omnibus a deployer of a high-risk system may also process special-category data for bias detection and correction on the narrower conditions of Art. 4a(2) AI Act, where the predecessor provision ran to providers alone.

Related articles

Last updated: 4 October 2026

Discuss your matter

Briefly describe the matter and the legal advice you need.

Request a medical-AI readiness assessment