5 warning signs that your MedTech QMS isn’t ready for the AI Act

22.06.2026

Artificial intelligence, Consulting, Future Healthcare, Healthcare and MedTech Consulting, Industries, Validation / Regulatory Affairs

Anyone in the medical technology industry who develops software as a medical device (SaMD) with AI components knows the feeling. You have implemented the ISO 13485 quality management system (QMS), ensured compliance with the Medical Device Regulation (MDR), and then the EU AI Act appears on the horizon. Well, you think, the QMS is up and running. But is that enough?

The honest answer is almost always: only partially. This is because, with the “Digital Omnibus Act on AI,” the Council of the EU has revised the deadlines: For high-risk AI integrated into products, such as SaMD, the requirements of Articles 9 through 17 will apply starting August 2, 2028. Many AI-based SaMDs in Classes IIa through III fall under this category. While an existing MDR-compliant QMS provides a solid foundation for this, it does not guarantee compliance.

5 common blind spots

The following list highlights patterns that regularly emerge in practice. This is not intended as criticism, but rather as a guide. Which of these apply to you?

Your risk management only covers clinical risks.
Bias in training data, model drift over the product lifecycle and misclassifications in borderline cases are not covered by your risk management. These are AI-specific risks that are not fully covered by either ISO 14971 or MDR Annex I. If these risks are missing from your analysis, you have a documented gap.
Training data is available, but its quality has not yet been verified.
Article 10 of the AI Act requires training data to be demonstrably representative, complete and free of errors. The origin, preprocessing and selection criteria must be documented in a way that can withstand audit scrutiny. Simply storing a data set on a network drive is not sufficient.
“Human oversight” is not mentioned anywhere in a standard operating procedure (SOP).
Article 14 requires that AI systems be designed in such a way that human oversight is both possible and effective. If your QMS does not specify a role that can intervene in AI decisions and lacks escalation paths, this will be noticed by auditors.
Your logging records errors, but not decisions.
Error logs are standard. Article 12 of the AI Act also requires automatic logging to enable retrospective review of system decisions. Anyone who already has their SaMD on the market should verify that their logging concept meets this requirement.
No one has coordinated the process with the Notified Body.
This may be surprising to many. The “Digital Omnibus on AI” introduces a single, coordinated notification and assessment procedure for the MDR/IVDR and the AI Act, with a transition period during which MDR/IVDR notification is sufficient. Anyone who fails to clarify responsibilities and timelines with the Notified Body early on risks avoidable delays in the certification process.

Why this is more than just a technicality

One might argue that these are merely documentation gaps that can be resolved quickly. This is true for some aspects, but not all.

For example, missing data governance cannot be retrofitted overnight once the data has already been collected. Delayed coordination with the Notified Body is not merely a bureaucratic formality, but a process that can significantly prolong an ongoing recertification cycle. Risk management SOPs that do not provide a methodology for AI-specific risks must be written and implemented. That takes time.

We know this from real-world experience. Gaps that seem manageable during an internal review become real problems during an audited under time pressure. Each week that your readiness status remains unclear reduces your ability to adapt as the deadline approaches.

5 warning signs that your MedTech QMS isn’t ready for the AI Act

5 common blind spots

5 common blind spots

Why this is more than just a technicality

FAQ

Sources

Get in touch with us!