AI Act and Medical Devices: What Irish Healthcare Providers Should Know

When an AI tool is also a medical device, two sets of EU rules meet: the Medical Device Regulation (MDR) or In Vitro Diagnostic Regulation (IVDR), and the AI Act. For an Irish hospital, nursing home, practice or home support provider, the practical question is usually not "how do we certify this?" but "what is this product, who carries which duties, and what do we have to do as the organisation using it?" This guide sets out what the official sources say about the AI Act and medical devices for healthcare providers in Ireland, including the HPRA's role. It is general information, not legal or clinical advice.

The AI Act sorts obligations by role, so begin with our guide to working out whether you are a provider or deployer under the AI Act. The label depends on what you actually do.

How an AI system becomes high-risk through product law

There are two routes to "high-risk" in the AI Act. One is a list of use cases (Annex III); the other runs through existing product legislation. The consolidated text of Regulation (EU) 2024/1689 on EUR-Lex (version of 27 July 2026) says, in Article 6(1), that an AI system is high-risk where both of the following are fulfilled: it is intended to be a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I; and that product must undergo a third-party conformity assessment before being placed on the market or put into service.

The Commission's AI Act Service Desk page on high-risk AI in regulated products (no date shown) repeats these two cumulative conditions and explains "safety component": something that performs a safety function, or whose failure or malfunction could endanger the health and safety of persons or property. That page does not mention medical devices, so for the medical device position we turned to a joint guidance document.

What the joint MDCG and AI Board guidance says

The Medical Device Coordination Group (MDCG) and the Artificial Intelligence Board (AIB) published MDCG 2025-6 / AIB 2025-1 in June 2025. It is described as a first set of answers that will be continuously developed, and it is not a Commission document and not legally binding. We read it on the European Commission's health site. Its main points are:

• When a medical device AI is high-risk. Both conditions in Article 6(1) must be met: the AI system is a safety component or itself a medical device, and it undergoes third-party conformity assessment by a notified body under the MDR or IVDR. Per the document's table, MDR Class IIa, IIb and III devices and IVDR Class B, C and D devices meet both conditions, while in-house devices under Article 5(5) of the MDR/IVDR do not.
• No automatic change to the device class. High-risk classification under the AI Act does not imply that the device falls in a higher risk class under the MDR/IVDR.
• Notified bodies. The MDR/IVDR conformity assessment route determines the process. The AI Act requirements in Articles 8 to 15 are assessed as part of it.
• One set of technical documentation. The AI Act requires a single set for high-risk medical device AI.
• Manufacturer as provider. References to the manufacturer under the MDR/IVDR should be understood as references to the "provider" under the AI Act.

The practical consequence for healthcare organisations is that the supplier of a certified product, not the hospital or practice using it, is normally the party carrying the conformity and documentation work. That is our reading of the guidance, and each product should be checked.

What the guidance says about the organisations using the product

The document is specific that "deployer" under the AI Act is not the same as "user" under the MDR/IVDR; the deployer concept cannot be understood as referring to the MDR/IVDR user. It says deployers should receive clear and comprehensible instructions for use, that human oversight mechanisms should be clearly defined and documented to allow appropriate supervision by healthcare professionals and institutions, and that manufacturers should provide training where appropriate. It also says issues should be reported to the manufacturer.

That lines up with what the AI Act requires of deployers of high-risk systems generally. Our guide to deployer obligations and human oversight under Article 26 walks through those duties. Article 26(2), as shown on the EUR-Lex consolidated text, requires deployers to assign human oversight to people with the necessary competence, training, authority and support.

Timing: check the current dates

Dates have moved. The MDCG/AIB document (June 2025) says obligations for Annex I high-risk systems apply from 2 August 2027. That date has since been overtaken: the Commission's AI Act page (last updated 3 August 2026) says the "AI Omnibus" entered into force on 27 July 2026 and lists 2 August 2028 for high-risk rules for systems embedded in regulated products (Annex I) and 2 December 2027 for Annex III use cases. EUR-Lex's Regulation (EU) 2026/1744, which we opened, is consistent with those dates according to its recitals. Our overview of EU AI Act key dates for employers in Ireland tracks the timetable. Treat all dates as subject to change and check the official pages.

The Commission page also gives robot-assisted surgery as an example of an AI-based safety component of a product. It does not otherwise address medical devices.

The HPRA's role

The Health Products Regulatory Authority is Ireland's competent authority for medical devices. Its guide to placing standalone medical device software on the market (reference SUR-G0040-2, dated 21 August 2020) says software can be a medical device in its own right depending on its manufacturer's stated intended purpose, that general health and wellbeing apps are generally not medical devices, that standalone software is classified in Class I, IIa, IIb or III, and that Class I software can self-declare conformity while other classes require a notified body. Software offered online to the Irish or EU market is treated as placed on the market.

That guide predates the AI Act and does not mention artificial intelligence or machine learning. The HPRA's qualification and classification page (no date shown) says software may meet the definition of a medical device and that manufacturers are responsible for qualifying and classifying their products; it also does not mention AI.

The AI Office of Ireland's national competent authorities page (no date shown) says Ireland uses a distributed model, and describes the HPRA as monitoring the safety and performance of medical devices and IVD devices. It does not say the HPRA has a role under the AI Act, and it does not list HIQA among the designated authorities. We therefore cannot say from the sources we read which Irish authority will supervise the AI Act for medical device AI; check the AI Office of Ireland and HPRA pages.

Questions to ask suppliers

Our suggestions, not legal requirements, for a health organisation buying or renewing an AI-enabled product:

• Is the product a medical device under the MDR or IVDR? If so, what is its intended purpose and class, and is a notified body involved?
• Does the supplier say the product is high-risk under the AI Act, and on what basis? The answer affects which role the supplier holds.
• What do the instructions for use say about intended users, limitations and the human oversight expected of your staff?
• What training does the supplier provide, and what do you need to add locally?
• How are problems reported to the supplier, and how will you record them internally?
• Have staff been told when output from the product is used in their work?

The HPRA guide says that general health and wellbeing apps are generally not considered medical devices; whether another tool is a medical device depends on its manufacturer's intended purpose.

Also consider in-house tools. The MDCG/AIB document says in-house devices under Article 5(5) MDR/IVDR do not meet both Article 6(1) conditions. This is a narrow point, so seek advice if your organisation builds its own tools.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Is every AI medical device high-risk under the AI Act?

No. According to the MDCG/AIB guidance, a medical device AI is high-risk when it is a safety component or itself a medical device and undergoes third-party conformity assessment by a notified body. The document says MDR Class IIa, IIb and III and IVDR Class B, C and D devices meet both conditions, and in-house devices do not.

Who is the provider of an AI-enabled medical device?

The MDCG/AIB document says references to the manufacturer under the MDR/IVDR should be understood as references to the provider under the AI Act.

Is a hospital a deployer?

The AI Act's deployer role depends on how the organisation uses the system; see the provider or deployer guide linked near the top of this post. The MDCG/AIB document stresses that deployer under the AI Act is not the same concept as user under the MDR/IVDR.

What does the HPRA do?

The HPRA is Ireland's competent authority for medical devices. We did not find a page confirming an HPRA role under the AI Act.

When do the high-risk rules apply?

The Commission's page (last updated 3 August 2026) lists 2 December 2027 for Annex III and 2 August 2028 for Annex I products. Check the current position.

Product law and the AI Act overlap, so ask suppliers early and record their answers.