What Is the EU AI Act? Requirements, Timeline, and Compliance

What is the EU AI Act?

The EU AI Act is the world's first comprehensive legal framework for artificial intelligence. It entered into force on August 1, 2024, and establishes legally binding obligations for organizations that develop, place on the market, distribute, import, or use AI systems in the European Union. Its requirements apply not only to organizations based in the EU, but also to companies outside the EU when their AI systems are made available in the EU market or affect individuals located in the EU.

The importance of the regulation is particularly evident in MedTech, where AI is increasingly being used to support diagnostics, clinical decision-making, connected devices, and software-driven medical products. Because many of these applications can directly influence patient outcomes, manufacturers must be prepared to meet new requirements for risk management, traceability, transparency, and oversight.

Who does the EU AI Act apply to?

The regulation targets a few main categories of organizations. Each carries distinct compliance responsibilities.

Providers: Organizations that develop an AI system or general-purpose AI model, or have one developed on their behalf, and place it on the market under their own name or trademark.

Deployers: Organizations that use AI systems under their authority in a professional context. For medical device manufacturers, this can include hospitals, healthcare providers, and organizations using AI-enabled systems in clinical workflows.

Authorized Representatives: Organizations established in the EU that act on behalf of providers located outside the EU and carry out certain obligations required by the regulation.

Importers: Entities that bring AI systems from outside the EU into the EU Market

Distributor: Organizations in the supply chain that make AI systems available on the EU market but are not the provider or importer.

How does the EU AI Act classify AI systems?

The regulation organizes AI systems into four risk tiers. Classification determines which obligations apply.

Unacceptable-risk AI systems

These systems are banned outright. They include AI that manipulates human behavior through subliminal techniques, uses real-time biometric surveillance in public spaces for law enforcement (with narrow exceptions), or enables social scoring by governments. No commercial path exists for these applications.

High-risk AI systems

This is the most consequential category for most enterprises. High-risk systems include AI used in critical infrastructure, employment decisions, education, essential services, law enforcement, migration, and notably, medical devices and in vitro diagnostics. Organizations placing high-risk AI systems on the market must satisfy a demanding set of requirements before deployment.

Limited-risk AI systems

These systems face transparency obligations. Organizations must disclose when users are interacting with AI, particularly in contexts like chatbots, deepfakes, or AI-generated content. The obligations are narrower than for high-risk systems, but non-compliance still carries penalties.

Minimal-risk AI systems

The vast majority of AI applications fall here: spam filters, recommendation engines, and basic automation tools. These face no mandatory requirements under the regulation, though voluntary codes of conduct are encouraged.

What are the key requirements of the EU AI Act?

For high-risk systems, the regulation imposes six core requirement categories.

Risk management and governance

Organizations must maintain a documented risk management process throughout the AI system lifecycle. Risks must be identified, evaluated, mitigated, and monitored through established governance processes.

Data quality and data governance

Training, validation, and testing data must be relevant, representative, and appropriately governed. Organizations must document how data is collected, managed, and assessed for potential bias and quality issues.

Technical documentation requirements

Providers of high-risk AI systems must maintain technical documentation that demonstrates compliance and supports conformity assessments throughout the product lifecycle.

Record keeping and logging

High-risk AI systems must support automated logging to enable monitoring, incident investigation, auditing, and regulatory review throughout the system's operational life.

Transparency and disclosure obligations

Organizations must provide sufficient information to help users understand how the system should be used and interpret its outputs appropriately.

Human oversight requirements

High-risk AI systems must support meaningful human oversight, including the ability to interpret outputs, identify issues, and intervene when necessary.

Accuracy, robustness, and cybersecurity requirements

AI systems must achieve appropriate levels of accuracy, remain resilient under expected conditions, and protect against security threats that could affect system performance or outputs.

What are general-purpose AI models under the EU AI Act?

General-purpose AI models (GPAI) are foundation models trained on large datasets and capable of performing a wide range of tasks. Large language models and multimodal AI systems fall into this category. The regulation introduces a separate compliance tier for GPAI providers, with heightened obligations for those deemed to pose systemic risk due to their scale or capability. Organizations integrating GPAI into product workflows must understand where provider obligations end and deployer obligations begin.

How the EU AI Act applies to medical devices

Medical devices represent one of the highest-stakes application areas under the regulation. Manufacturers entering this territory face overlapping obligations from multiple regulatory frameworks.

Why many AI-powered medical devices are considered high risk

AI embedded in medical devices typically influences clinical decision-making, diagnostic outputs, or treatment delivery. These functions carry direct patient safety implications. The regulation specifically lists medical devices regulated under EU MDR (2017/745) and in vitro diagnostic medical devices regulated under IVDR (2017/746) as high-risk AI applications when AI is a safety component of that device.

Examples of AI in medical devices

AI is already embedded in a wide range of medical products. Diagnostic imaging software that flags anomalies, clinical decision support tools that recommend treatment pathways, AI-assisted surgical systems, and remote patient monitoring platforms all qualify. As these systems become more prevalent, their regulatory classification becomes a central concern for product teams.

Medical device development is evolving

For a deeper look visit PTC's resources page

Visit Page

Relationship between the EU AI Act and the medical device regulation (MDR)

The AI regulation and EU MDR are complementary but distinct regulatory frameworks. MDR governs the safety and performance of medical devices broadly, while the EU AI Act introduces additional requirements focused specifically on the development and use of AI including risk management, transparency, human oversight, and governance.

The two frameworks also share important similarities. Both take a risk-based approach, with regulatory requirements increasing based on the level of risk associated with a medical device or AI system. For AI used as a safety component of a medical device, or when the AI system is itself a medical device, the AI system may be classified as high-risk under the EU AI Act when the device is also required to undergo a third-party conformity assessment. In these cases, the requirements of the AI Act become part of the conformity assessment required under the applicable medical device legislation.

What medical device manufacturers need to know

The regulation is not a future consideration. Obligations for high-risk AI systems have been phased in, with key deadlines already passed or approaching. Manufacturers who have not yet conducted an AI inventory or initiated a conformity assessment are operating with significant exposure.

EU AI Act requirements for medical device manufacturers

AI risk management throughout the product lifecycle

Manufacturers should integrate AI-specific risks, including dataset bias, model drift, and software updates, into existing risk management processes. Aligning AI governance with frameworks such as ISO 14971 helps support both MDR and AI Act compliance.

Data quality, validation, and clinical evidence

Manufacturers must demonstrate that AI models are trained, validated, and tested using data that is representative of the intended patient population and appropriate for the device's intended use.

Technical documentation and traceability requirements

Documentation must connect requirements, datasets, testing activities, risk controls, and validation evidence to support compliance and regulatory review.

Human oversight and explainability in clinical settings

Clinicians must be able to understand, assess, and appropriately act on AI-generated outputs. Explainability should support safe and effective clinical decision-making.

Post-market monitoring and continuous improvement

Manufacturers must monitor AI performance after deployment, investigate issues, and update risk assessments and documentation as new information becomes available.

Challenges medical device manufacturers face under the EU AI Act

Managing AI model changes after deployment

Model updates may alter system performance and require reassessment of risks, documentation, or regulatory obligations. Managing these changes requires strong change-control processes.

Maintaining compliance across product updates

Manufacturers must evaluate whether updates constitute substantial modifications under applicable regulations and determine whether additional assessments are required.

Ensuring data integrity and traceability

Organizations must maintain clear records of data sources, validation activities, and system changes to support compliance and regulatory review.

Demonstrating transparency and human oversight

Manufacturers must show that oversight mechanisms are effective in practice, not simply documented in technical files.

Coordinating engineering, quality, and regulatory teams

Meeting AI Act requirements requires consistent collaboration across engineering, quality, clinical, and regulatory functions throughout the product lifecycle.

What are the requirements for high-risk AI systems?

What qualifies a high-risk AI system?

A system qualifies as high risk if it falls within one of the regulated domains listed in Annex III of the regulation, or if it is a safety component of a product already regulated under EU harmonization legislation. For most MedTech manufacturers, AI embedded in or influencing device performance meets this threshold.

Assessments

High-risk AI systems require a conformity assessment before market entry. Depending on the system type, this may be conducted internally or by a third-party notified body. The assessment must verify that all applicable requirements are met and must be documented in a way that supports regulatory review.

Technical documentation and monitoring requirements

Post-assessment, organizations must maintain technical documentation that reflects the current state of the system. This includes a logging capability that captures system behavior in operation, enabling post-market monitoring and incident investigation.

EU AI Act timeline and key dates

The regulation entered into force in August 2024. Key compliance milestones include:

• February 2025: Prohibitions on unacceptable-risk AI systems took effect.
• August 2025: Obligations for GPAI model providers and governance rules became applicable.
• August 2026: Requirements for high-risk AI systems in Annex III take full effect.
• August 2028: Requirements for AI systems that are safety components of regulated products, including medical devices under EU MDR and IVDR, become fully applicable.

Medical Device organizations should treat August 2028 as a hard operational deadline, not a distant target.

What are the penalties for non-compliance?

The regulation establishes a tiered penalty structure. Violations involving prohibited AI practices can result in fines of up to 35 million euros or 7% of global annual turnover, whichever is higher. Non-compliance with other obligations carries fines up to 15 million euros or 3% of turnover. Providing incorrect or misleading information to authorities can result in fines up to 7.5 million euros or 1.5% of turnover. For large global enterprises, these figures represent both material financial risk in addition to reputational risk.

How to prepare for EU AI Act compliance

Inventory existing AI systems

Start by identifying AI systems in development, in use, or planned and classifying them according to the AI Act's risk framework.

Identify high-risk use cases

Prioritize systems involved in clinical decision-making, diagnostics, treatment support, or regulated medical devices.

Establish AI governance processes

Define ownership, review processes, and accountability for AI-related compliance decisions.

Build an AI risk management framework

Extend existing quality and risk management processes to address AI-specific risks.

Create and maintain technical documentation

Develop documentation early and keep it aligned with the system's current design, data, testing, and risk controls.

Prepare for ongoing monitoring and audits

Establish processes to monitor performance, investigate incidents, and demonstrate compliance after market entry.

PTC Recommendations for EU AI Act Readiness

While the specific requirements of the EU AI Act vary based on system classification and organizational role, PTC recommends focusing on the foundational capabilities that support compliance across the product lifecycle. For medical device manufacturers, this includes establishing clear governance and accountability, maintaining end-to-end traceability, managing change in a controlled manner, and ensuring compliance evidence remains accessible as products evolve.

Organizations that begin with a connected foundation for requirements, risk, quality, product data, and regulatory documentation will be better positioned to address emerging AI compliance requirements while supporting innovation at scale.

Explore PTC’s Intelligent Product Lifecycle

This lifecycle-based approach aligns with the principles of PTC's IPL strategy

Read the E-book

Focus on governance before regulatory deadlines

As manufacturers evaluate their readiness, PTC recommends establishing clear ownership for AI-related decisions, defining review and approval processes, and creating a framework for ongoing monitoring and oversight. Taking these steps early can help organizations improve audit readiness, strengthen traceability, and prepare for evolving regulatory expectations as AI adoption continues to expand across the MedTech industry.

Key Take-away

The EU AI Act adds new requirements, but it also reinforces principles medical device manufacturers already know well: risk management, traceability, validation, and continuous oversight. By building these capabilities into the product lifecycle, manufacturers can support compliance while accelerating trusted AI innovation. As AI regulation evolves globally, the EU AI Act and emerging efforts such as the FDA and EMA’s common principles for good AI practice also point toward greater international alignment. Manufacturers that establish this foundation now will be better positioned to adapt to evolving requirements and bring AI-enabled products to market with confidence.

Explore PTC's MedTech compliance resources to learn how organizations build this infrastructure with purpose-built tools for the medical technology sector.