Medical devices incorporating AI – Navigating roles and responsibilities of manufacturers/providers and users/deployers under the MDR and AIA

Key economic operators: Manufacturer and provider

Under current legislation, the regulatory frameworks of the MDR and the AIA apply in parallel to AIMDs that are a medical device and at the same time are (or incorporate) an AI system. Moreover, most AIMDs will be classified as high-risk AI systems under the AIA, meaning they will be subject to the most rigorous compliance requirements of the AIA.

Like the MDR, the AIA assigns the regulatory responsibilities applying to an AI system to certain economic operators (called “operators” under the AIA, cf. Article 3(8)). However, the roles of the key economic operators under the MDR and the AIA are not completely aligned.

The key economic operator under the MDR is the (legal) manufacturer as defined in Article 2(30) MDR:

‘manufacturer’ means a natural or legal person who manufactures or fully refurbishes a device or has a device designed, manufactured or fully refurbished, and markets that device under its name or trade mark;

The AIA does not provide for the definition and role of a manufacturer. However, it provides for an operator with similar responsibilities, the so-called “provider” (Article 3(3) AI Act).

‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge;

Despite some differences in the definitions, the (legal) manufacturer of an AIMD and its provider are usually going to be the same person. Of course, medical device companies will rarely develop entirely new AI models but rather collaborate with software companies to adapt existing AI models for use in their devices. Nevertheless, such software company will not be considered the “provider” of an AIMD, even if it will do most of the actual development work on the AI system. It is the medical device manufacturer who steers the development and takes on the ultimate responsibility for the final product that incorporates the AI system by marketing the AIMD under its brand. Recital 79 of the AIA expressly states that the provider role depends on who takes responsibility, regardless of whether that person designed or developed the system. This is no different from the MDR where the OEM of a medical device is also not considered the (legal) manufacturer as defined in Art. 2(30) MDR.

For medical devices that incorporate an AI system as a safety component, there is a specific stipulation in Art. 25(3) AIA, pursuant to which the product manufacturer (i.e. the manufacturer of the non-AI medical device) will also be considered the provider of the AI system when the product is placed on the market together with the AI system under the trademark of the product manufacturer. Thus, if the manufacturer of e.g. an ultrasound device would offer its device together with an AI system that is able to support diagnostic decisions, that manufacturer would also be considered the provider of the AI system.

Users and deployers: Distinct roles

While the concepts and roles of the manufacturer and the provider are largely aligned and will usually overlap, the MDR and AIA are different when it comes to the role of the person using a medical device, respectively an AI system.

The MDR provides for the role of the “user” that is defined as any healthcare professional or lay person who uses a device; The AIA, in contrast, does not contain a definition of “user”. However, it provides for the role of the “deployer”, defined as a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity.

The “user” under the MDR simply is the natural person using a medical device. In practice, the “user” of a medical device is a doctor, nurse or the patient. The “user” is not subject to regulatory obligations under the MDR (certain obligations may, however, apply to professional users under national law, e.g. the German Ordinance for Medical Device Operators (Medizinprodukte-Betreiberverordnung)).

In contrast, the “deployer” under the AIA is not necessarily a natural person. The definition explicitly includes legal persons and public or other bodies. Moreover, it does not depend on the actual act of using an AI system but on under whose authority the use is happening. I.e., the deployer role rather depends on having a superior role and decision-making authority as to the “if” and “how” an AI system will be used. The role of the deployer is a particularity of the AIA that does not exist in other Union legislation.

This means that the “user” of an AIMD under the MDR and the “deployer” under the AIA will in most cases not be the same person. Specifically, where an AIMD is used within a larger organization like a hospital, the legal person operating the health institution will usually be the “deployer” of the AI system under the AIA while individual physicians or nurses will be “users” under the MDR. In smaller practices where the physicians operating the device are also the ones having a supervisory and decision-making rule as to the use of the AI system, deployers and users will however be the same person.

Latest legislative proposal and impact on economic operator roles

On 16 December 2025, the EC published its proposal for a regulation amending and simplifying the MDR and IVDR. If enacted, this would heavily impact the interplay between the MDR and AIA.

In essence, the draft provides that the AIA would no longer apply to AIMDs, except for the risk-classification rule in Article 6(1). Instead, AIMDs would only follow the rules of the MDR. It is envisaged that the European Commission would then publish delegated and implementing acts under the MDR that further address the use of AI in medical devices, taking into account the key safety requirements as set out in Articles 8 through Article 15 of the AIA.

Removing AIMDs from the scope of the AIA would also mean that there would no longer be dual regulatory roles under the MDR and AIA with regard to such products. Instead, they product responsibility for AIMDs would be solely with the manufacturer as defined in the MDR. It is likely, that certain AI-specific obligations would still apply to manufacturers of AIMDs pursuant to implementing and delegated acts by the European Commission. It remains to be seen whether these acts will also introduce obligations on the “user-side” of AIMDs (similar to the obligations today foreseen in the AIA for deployers) or whether the use of AIMDs will remain largely unregulated, as is the case for non-AI medical devices under the current MDR framework.

As of the date of this article, the fate of the EC’s proposal is still unclear. The European Parliament generally agreed with the approach to remove products regulated under sectoral EU legislation, such as medical devices, from the scope of the AI Act and proposed to even extend this concept beyond medical devices. The Council, in contrast, favours to continued application of the AI Act to products subject to sector-specific legislation. In the Trilogue on 28 April 2026, the EC, the European Parliament, and the Council failed to reach an agreement, mainly over this crucial point determining the interplay between the AI Act and sector-specific legislation. Discussions will likely resume in May 2026.

Key takeaways

• Although the definitions of the manufacturer under the MDR and the provider under the AIA are not identical, the MDR manufacturer of an AIMD will usually also be the provider of the device under the AIA.
• MDR “users” are individuals such as clinicians or patients, whereas AIA “deployers” will in many cases be clinics or similar organizations deciding how and under whose authority an AI system is used. Deployers have regulatory duties under AIA, whereas MDR users generally do not.
• The European Commission's December 2025 proposal would subject AIMDs only to MDR, meaning that product responsibility would be solely with the MDR manufacturer who would no longer have an operator role under the AIA.
• New MDR delegated/implementing acts would very likely incorporate AI‑specific requirements into the MDR framework and manufacturers should, therefore, expect AI‑related duties to remain, in particular principles of human oversight, data governance, or transparency.
• Whether certain obligations similar to those applicable to AIA deployers will be introduced for users of AIMDs or the organizations having authority over such use, remains to be seen.

On 13-14 May, Hogan Lovells and the AI Healthcare Coalition will host their fifth annual AI Health Law & Policy Summit in Washington, D.C., registration for which is available online here. In this forward-looking program, thought leaders and policymakers will discuss rapidly evolving global health care AI regulatory frameworks, legislative developments, AI ethics, privacy issues, novel reimbursement concepts, and more.

Authored by Arne Thiermann and Benjamin Goehl.