The AI Act Was Delayed. For Your IVD With an AI Component, That Helps Less Than You Think

Since the summer I keep hearing the same sentence from founders and QM leads: the AI Act has been postponed, so we will deal with it later. I understand the reflex. It is still dangerous, for a reason that barely appears in the press coverage of the delay.

What was postponed, and what was not

Regulation (EU) 2026/1744, the Digital Omnibus on AI, moved the application dates of the high-risk obligations. For stand-alone systems under Annex III the date is now 2 December 2027 instead of 2 August 2026. For AI in regulated products under Annex I it is 2 August 2028 instead of 2 August 2027. Medical devices and IVDs sit in Annex I Section A, which brings them under Article 6(1). Unlike machinery, MDR and IVDR did not obtain a carve-out. Both frameworks will apply in parallel.

The classification logic is simple. Under Article 6(1), an AI system is high-risk if it is a safety component of an Annex I product, or is such a product itself, and that product requires third-party conformity assessment. For IVDs of class B, C and D a notified body is involved, so the condition is usually met. For class A IVDs without a notified body it usually is not. Check this boundary for your product case by case, against the Commission's guidelines on high-risk classification.

Why the deadline is not your timeline

The key point: the requirements did not change, only their date. Article 10 demands data governance for training, validation and test data, including representativeness and bias examination. Article 11 together with Annex IV requires technical documentation, Article 12 record-keeping, Article 14 human oversight, Article 15 accuracy, robustness and cybersecurity. Whoever trains an interpretation algorithm today is deciding on datasets, splits and documentation that must withstand review in two years. Training data whose provenance and legal basis were not documented cannot be repaired retroactively.

We know this from practice: data provenance in academic spin-offs is rarely documented to the standard a conformity assessor expects. A cohort dataset from a university hospital without clean versioning is already delicate for performance evaluation under IVDR Annex XIII, and even more so for Article 10 of the AI Act.

The notified body question

Manufacturers hope for synergies, and they are built in. Under Article 43(3), providers of Annex I Section A products follow the conformity assessment procedure of the sectoral legislation, with the Section 2 requirements of the AI Act and the quality management system under Article 17 assessed as part of it. This presupposes that the notified body meets the relevant AI Act requirements. The capacity bottlenecks of notified bodies under the IVDR are well known. If the same bodies must also build AI Act expertise, another bottleneck is more likely than a speed-up. Whoever starts in 2028 will be waiting in line.

What I recommend

Use the time you have gained for what you cannot reconstruct later. Build a data pipeline with traceability: provenance, consent or legal basis, versioning, documented splits. Integrate the Article 10 requirements into your design control procedure under ISO 13485 Section 7.3. And map the general safety and performance requirements (IVDR Annex I) against the AI Act requirements. That costs a manageable effort now. In 2028 it costs a redesign.

A side note on Article 4: the AI literacy duty was softened. It now requires measures to support literacy, but not a guaranteed level for individuals. It has not disappeared. Anyone deploying models should still be able to evidence training.

---

If your organization is integrating AI into an IVD or software as a medical device and needs a robust mapping between IVDR and the AI Act that does not start in 2028, get in touch. No theory for theory's sake.