Conformity assessment of continuously learning AI-based medical devices in the EU

Baseline: Conformity assessment required under both MDR and AIA

Pursuant to the AI Act (Regulation (EU) 2024/1689, “AIA”), high-risk AI systems must undergo a conformity assessment, within which compliance with the safety requirements pursuant to Chapter III, Section 2 of the AIA must be confirmed.

At the same time, AI systems that are medical devices or safety components of medical devices are fully subject to the MDR or IVDR^[1] (Regulations (EU) 2017/745 and 2017/746). As outlined in more detail in the first article of this series, most AIMDs will be classified as risk class IIa or higher under the MDR and, therefore, will qualify as high-risk AI systems under the AIA. Consequently, they will require a conformity assessment under both the MDR and the AIA.

To avoid duplicating work, Art. 43(3) AIA provides that the conformity assessment under the AIA shall be conducted within the conformity assessment procedure carried out under the MDR. In practice, this means that not only the requirements of the MDR but also the requirements pursuant to Chapter III, Section 2 AIA will be assessed within the conformity assessment procedure under the MDR.

Do Learning AIMDs require continuous reassessment of their conformity?

Despite the integration of the AIA conformity assessment into the respective procedure under the MDR, the scope and applicability of conformity assessment requirements under the AIA and MDR are not clear when it comes to AIMDs that continue to learn after being placed on the market (“Learning AIMDs”). The core question in this respect is whether the intrinsic modifications associated with a self-learning and continuously adapting AIMD that has already undergone a conformity assessment trigger the need for conducting a new conformity assessment.

The AIA addresses this question in Article Art. 43(4). It provides that, in principle, an AI system needs to undergo a new conformity assessment procedure in case of a substantial modification. However, changes to a high-risk AI system and its performance that have been pre-determined by the provider of the system at the time of the initial conformity assessment shall explicitly not be considered a substantial modification. Thus, the AIA generally acknowledges that repeated conformity assessments for learning AI systems would be impractical and hinder the innovative potential of such systems.

However, it is questionable whether this regulatory relief also extends to the medical device sector. In contrast to the AIA, the MDR does not provide for an exemption from conformity assessment requirements for learning devices. Under Section 4.10 of Annex IX MDR, manufacturers of medical devices are required to inform the notified body of any changes to an approved product that may affect its safety or performance. The notified body subsequently assesses the proposed modification and determines whether a new conformity assessment pursuant to Article 52 MDR is required or whether an addendum to the EU certificate for the assessment of the technical documentation may be issued. In the latter case, the notified body limits its review to the proposed modification, informs the manufacturer of its decision, and issues the corresponding addendum. Therefore, under the MDR any modification with relevance for the safety and performance of a device in principle triggers a renewed conformity assessment, either limited to the specific modification or even a complete reassessment.

Fulfilling the safety requirements that Annex I MDR places on software is also a particular challenge for Learning AIMDs. According to Annex I Section 17.1 MDR, software must especially ensure “repeatability, reliability, and performance according to its intended use.” However, if repeatability were understood as the system consistently producing identical outputs under the same conditions, the requirement would be unattainable for learning systems, as their defining feature is continuous development which obviously can result in varying outcomes under the same conditions.

Despite the misalignment between the AIA and MDR with regard to conformity assessments of Learning AIMDs, the EU’s Medical Device Coordination Group (MDCG) and Joint Artificial Intelligence Board (AIB) are of the opinion that the exemption pursuant to Art. 43(4) of the AIA can also be applied to medical devices. A joint guidance document recommends interpreting Section 4.10 of Annex IX MDR in such way that pre-determined changes that are not considered substantial modifications under the AIA pursuant to its Art. 43(4) should also not be interpreted as changes within the meaning of Annex IX MDR.^[2]

This innovation-friendly interpretation of the MDR by the AIB and MDCG is to be welcomed. Nevertheless, there continue to be practical challenges: notified bodies tend to take a strict approach with regard to conformity assessment requirements, also driven by an increased liability risks for notified bodies under case law by the Europea Court of Justice. The guidance issued by the MDCG and AIB is not legally binding. Therefore, it is questionable whether all notified bodies will follow it and thereby take the risk of later allegations that they have omitted the assessment and certification of changes to a device that they should have assessed under the legal rule of Section 4.10 of Annex IX MDR.

Another challenge is the unclear scope of Art. 43(4) AIA and a lack of guidance as to how the pre-determination of changes needs to look like in order to satisfy the requirements of the law and notified bodies. The MDCG and AIB indicated that such guidance is to be expected and will likely be based on guidance on Predetermined Change Control Plans (PCCP) issued by the International Medical Device Regulators Forum (IMDRF); however, so far no specific EU guidance has been made available. In any event, it is likely that the exemption under Art. 43(4) AIA will only be applied to pre-determined gradual changes that do not substantially change the functionality or intended use of the Learning AIMD.

Overall, the concept of exempting pre-determined changes of Learning AIMDs from conformity assessment requirements is a step in the right direction and indicates that the European legislator acknowledges that new technologies require adaptations to the regulatory framework. Nevertheless, to ensure certainty and reliability for medical device manufacturers and notified bodies, issuance of specific guidance on PCCPs is required.

What manufacturers should do now

The current regulatory environment is challenging for manufacturers developing Learning AIMDs for commercialization in the EU. While the AIA introduced a legal anchor for continuously learning and changing devices, as of now, there is no certainty as to how a practical concept for the conformity assessment of Learning AIMDs will look like.

Nevertheless, there are good reasons to expect that the European regulators will continue pursuing the path to alleviating conformity assessment requirements for Learning AIMDs under the condition that they are subject to a PCCP. Considering that both the US FDA as well as the IMDRF have issued specific guidance on PCCPs, it appears likely that future guidance by the European Commission or other relevant EU stakeholders will provide for a similar framework.

It is, therefore, recommended that manufacturers consider the scope and requirements of pre-determined changes early in the development process. In accordance with IMDRF guidance, there should be a clear description of what the planned changes are, how new data will inform such changes, how performance of the Learning AIMDs will be continuously evaluated and how the risks of continuous learning will be addressed throughout the product lifecycle.

Key takeaways

• AIMDs are typically regulated simultaneously under the MDR and the AIA, with AIA requirements assessed as part of the MDR conformity assessment.
• Continuously learning AIMDs pose challenges for conformity assessments. The AIA allows certain pre‑determined changes to AI systems without re‑assessment of conformity; however, the MDR contains no such general exemption for safety‑ or performance‑relevant changes.
• Guidance by EU regulatory indicates that the exemptions under the AIA should also be applied within the medical device regulatory framework. However, there is a lack of guidance as to how pre-determined change control plans need to look like to satisfy regulatory requirements.
• Despite the evolving regulatory landscape, early regulatory planning is and remains essential. Manufacturers should define and document the scope of permissible learning behaviour of AIMDs early, as future market access will likely depend on how well learning‑related changes are anticipated, constrained, and justified.
• Taking into account the guidance by the IMDRF on PCCPs is recommended until more specific guidelines are available for the EU.

Authored by Benjamin Goehl and Arne Thiermann.