--- title: "The double-classification trap. · AI SaMD Playbook" description: "An AI-enabled SaMD that is Class IIa or above under the MDR is, in almost every case, a high-risk AI system under the EU AI Act. That means two parallel…" lang: en json-ld: | [ { "@context": "https://schema.org", "@graph": [ { "@type": "WebSite", "@id": "https://ai-samd.com/#website", "url": "https://ai-samd.com/", "name": "AI SaMD Playbook", "description": "Working reference for regulating AI/ML Software as a Medical Device: FDA, EU AI Act, MHRA, Health Canada and NMPA guidance, model risks, and cybersecurity for RA/QA teams.", "inLanguage": "en" }, { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com" } ] }, [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://ai-samd.lovable.app/" }, { "@type": "ListItem", "position": 2, "name": "Crosswalk", "item": "https://ai-samd.lovable.app/crosswalk" }, { "@type": "ListItem", "position": 3, "name": "The double-classification trap.", "item": "https://ai-samd.lovable.app/regulators/eu-ai-act" } ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "The double-classification trap.", "description": "An AI-enabled SaMD that is Class IIa or above under the MDR is, in almost every case, a high-risk AI system under the EU AI Act. That means two parallel conformity assessments, two technical files, and two sets of post-market obligations · all stitched onto one product.", "about": "European Union · AI Act + MDR", "mainEntityOfPage": "https://ai-samd.lovable.app/regulators/eu-ai-act", "publisher": { "@type": "Organization", "name": "Blue Goat Cyber", "url": "https://bluegoatcyber.com" } } ] ] --- [AI SaMD Playbook ](/) Sections[Crosswalk](/#crosswalk)Tools Search Ctrl K[Talk to us →](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session) [← Back to crosswalk](/#crosswalk) EU European Union · AI Act + MDR # The double-classification trap. An AI-enabled SaMD that is Class IIa or above under the MDR is, in almost every case, a high-risk AI system under the EU AI Act. That means two parallel conformity assessments, two technical files, and two sets of post-market obligations · all stitched onto one product. Posture · Statutory · two regulations, one device Last reviewed · April 2026 Key facts AI Act high-risk obligations apply Aug 2026 GPAI obligations apply Aug 2025 Maximum penalty €35M / 7% turnover Aligned with MDR · IVDR · NIS2 §01 ## How the AI Act classifies medical AI Article 6 designates AI systems as high-risk where they are safety components of products covered by EU harmonisation legislation listed in Annex I · which includes the MDR and IVDR. In practice, almost any AI-enabled medical device with a notified-body route under MDR is high-risk under the AI Act. - Risk management system covering AI-specific harms across the lifecycle. - Data and data governance with documented quality, bias, and representativeness measures. - Technical documentation per Annex IV · additive to the MDR technical file. - Logging, transparency, human oversight, accuracy, robustness, and cybersecurity by design. §02 ## Conformity assessment, twice For high-risk medical AI, the AI Act conformity assessment is integrated into the MDR notified-body route · but it is not absorbed by it. Manufacturers still need an AI-specific quality management system, an AI-specific risk management process, and AI-specific post-market monitoring. §03 ## General-purpose AI and foundation models If your SaMD is built on top of a general-purpose AI model (GPAI) · including most LLMs and large vision models · you inherit obligations that flow from the GPAI provider, plus your own as a downstream deployer or provider. Contractually pinning the model and its documentation is no longer optional. - Provider documentation, training data summaries, and copyright disclosures must flow to you. - GPAI models with systemic risk trigger additional model-evaluation and incident-reporting duties. - Substantial modification of a GPAI for medical use can make you the provider in the eyes of the Act. §04 ## Cybersecurity & the CRA overlap Cybersecurity expectations come from MDR Annex I (security by design), the AI Act (robustness against adversarial inputs, model integrity), and · for products with digital elements · the Cyber Resilience Act from 2027. Build the control set once and map it across all three. Key takeaways 1. 01 Assume your AI SaMD is high-risk under the AI Act unless legal counsel proves otherwise. 2. 02 Plan one control set; produce two technical files · MDR Annex II + AI Act Annex IV. 3. 03 Pin every foundation model contractually and capture provider documentation as evidence. 4. 04 Treat August 2026 as the real deadline; notified-body capacity will not wait until then. References - [Regulation (EU) 2024/1689 (AI Act) ↗](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) - [MDCG 2025-6 / AIB 2025-1 · MDR/IVDR ↔ AI Act interplay (Jun 2025) ↗](https://health.ec.europa.eu/document/download/b78a17d7-e3cd-4943-851d-e02a2f22bbb4_en?filename=mdcg_2025-6_en.pdf) - [MDCG guidance documents ↗](https://health.ec.europa.eu/medical-devices-sector/new-regulations/guidance-mdcg-endorsed-documents-and-other-guidance_en) [ ← Previous United States · FDA ](/regulators/fda)[ Next → United Kingdom · MHRA ](/regulators/mhra) © 2026 AI SaMD Playbook · Sponsored by Blue Goat Cyber [Crosswalk](/crosswalk)[Colophon](/colophon) Editorial reference only. Not legal or regulatory advice.