On 27 July 2026, Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force. It amends Regulation (EU) 2024/1689, the Artificial Intelligence Act (the “AI Act“), delaying the date on which the AI Act’s strictest rules apply to artificial intelligence inside regulated products, medical devices among them, from 2 August 2027 to 2 August 2028.
A second reform runs alongside it: on 16 December 2025 the European Commission (the “Commission“) proposed COM(2025) 1023, a revision of the Medical Devices Regulation (EU) 2017/745 (the “MDR“) and the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (the “IVDR“), still under negotiation. Both respond to a certification system that has produced long delays and withdrawals.
Why is the EU Reopening Rules it has only just Implemented?
- There are too few assessors. Most devices cannot carry the CE mark, which allows sale anywhere in the EU, unless an independent organisation called a notified body has assessed them first. Only 51 are designated for medical devices. The Commission’s survey to October 2025 records 33,175 applications against 17,549 certificates issued, and assessments take 13 to 18 months.
- Extending deadlines has only bought time. Regulation (EU) 2023/607 let devices approved under the older rules stay on sale until the end of 2027 or 2028, which the Commission accepts reduced the risk of shortages without fixing the underlying problem.
- The cost falls hardest on small companies, which make up around 90% of Europe’s 38,000 medical technology firms. The European Parliament’s research service estimates the revision would save roughly EUR 3.3 billion a year, EUR 2.4 billion of it administrative.
What did the Digital Omnibus Change?
- It set new deadlines. The AI Act sorts systems it calls high-risk, the tier carrying the heaviest obligations, into two groups. Those in Annex III, covering standalone uses such as recruitment or credit scoring, must comply by 2 December 2027. Those in Annex I, which lists existing EU product safety laws including the MDR and IVDR, have until 2 August 2028. The Council of the European Union gave final approval on 29 June 2026.
- Not everything moved. The AI Act’s transparency duties in its Article 50, requiring people to be told when they are dealing with artificial intelligence, applied from 2 August 2026 as planned, and the outright bans in its Article 5 are unchanged. Only one chapter has been delayed.
Why did Medical Devices not get the Exemption Machinery did?
Annex I of the AI Act is split in two. Laws in Section A bring the full set of high-risk obligations; those in Section B bring only a small part. The MDR and IVDR sit in Section A, which is why AI-enabled devices carry both sets of rules at once.
- The Commission’s device proposal would have moved the MDR and IVDR into Section B, reasoning that two regimes at once creates duplication and holds back innovation.
- The European Parliament and the Council refused. Products under the Machinery Regulation (EU) 2023/1230 obtained the move; medical devices did not. Instead, the Commission was given power to switch off individual AI Act requirements where the MDR or IVDR already achieves the same result, a power not yet used.
- Double compliance therefore continues. Article 6(1) of the AI Act treats a device as high-risk whenever it needs a notified body, broadly Class IIa and above on the MDR’s scale running from Class I to Class III. The relief is procedural: Article 43(3) folds the AI Act’s requirements into the MDR assessment, so manufacturers face one assessment covering more ground, not two.
What would the MDR Revision do for AI Devices?
- It would reclassify software. Rule 11 in Annex VIII to the MDR sets the risk class of medical software, and as drafted it means almost none can be self-certified. The proposal makes Class I the starting point, rising only as the clinical stakes rise. Much software would fall outside notified body assessment and, because the AI Act’s high-risk test turns on notified body involvement, would stop being high-risk at the same moment. It is the most significant provision in the package and the most likely to be watered down.
- It would allow model changes to be planned in advance. Manufacturers and notified bodies could agree a predetermined change control plan setting out which future changes need no fresh approval. That matters where a model improves precisely by being retrained, something a system built to certify fixed products handles badly.
- It would ease other pressure points. The five-year expiry on certificates would give way to periodic risk-based review, and breakthrough or orphan devices, meaning those for very small patient groups, would get priority review.
Does any of this fix the Delays?
- Partly, and one piece is already law. Implementing Regulation (EU) 2026/977 sets binding maximum times for notified bodies: 30 days from a complete application to contract, 120 days for the quality system audit and 90 days for checking the product. It also requires itemised quotes and annual reporting on how long assessments take and what they cost.
- But a deadline only governs an assessment once it has begun. It creates no extra assessors and does nothing about the queue before the clock starts. The structural fix is Rule 11, which takes devices out of the queue instead of moving them through faster. That is also why it is contested: it means less independent scrutiny of clinical software.
What is the Law, and What is still only Proposed?
- The MDR and IVDR apply unchanged. COM(2025) 1023 is still moving through the legislative process, and Cyprus, chairing the Council, reported on progress to health ministers on 16 June 2026. Adoption before 2027 would be optimistic, and the text will change.
- Regulations (EU) 2026/1744 and 2026/977 are in force. MDCG 2025-6, guidance from the Medical Device Coordination Group, the EU body coordinating national device regulators, remains the working reference on how the two regimes fit together. Deadlines for older devices have not moved.
What should Manufacturers do now?
- Classify software against Rule 11 as it stands, and model the proposed version separately. Choosing a lower class to avoid a notified body remains a serious risk.
- Build one technical file satisfying both the MDR and the AI Act, and one quality system covering how training data is versioned, how bias is tested and how model changes are controlled.
- Ask your notified body how it handles AI Act requirements during an MDR audit. Practice still varies widely, and the answer shapes how documentation should be organised.
Conclusion
The EU has done the easy part. Delaying a deadline cost nothing politically, and setting time limits for notified bodies was uncontroversial once the delays became undeniable. Double compliance survives, and the one change that would genuinely clear the backlog for AI-driven devices, reclassifying most medical software, is the one most likely to be diluted. For anyone building or funding these products in Europe, the main question now is which risk class the device ends up in.
Authors: Shantanu Mukherjee, Varun Alase
