Diagnosing the Medical AI Crisis

In January 2024, the EU AI Office and the European Commission published a joint guidance document addressing the interaction between the EU AI Act and the Medical Device Regulation. The document was 47 pages long and resolved almost nothing. The key question — when does a medical AI system need conformity assessment under the AI Act, the MDR, or both — was answered with a framework that required “case-by-case determination” and explicitly noted that the agencies were “continuing to develop interpretive guidance.”

Twenty months later, that interpretive guidance has been updated three times. Each update has clarified some things and created new ambiguities about others. The fundamental overlap problem remains unresolved. And in the interval, somewhere between 60 and 120 European medical AI companies — nobody has the exact count, because many just quietly pivoted or shut down rather than making public announcements — have altered, shelved, or abandoned products that were in development.

This is perhaps the most concrete harm the EU AI Act has produced in its early enforcement period, and it’s the one getting the least attention.

Two Regulatory Frameworks, One Product

The MDR — Regulation 2017/745 — governs medical devices, including software intended for medical purposes. An AI system that analyzes medical images to detect cancer, or that processes patient data to predict deterioration, or that assists in diagnosis or treatment selection is almost certainly a “medical device” under the MDR’s expansive software definition. It faces classification as a Class IIa or IIb device (the two middle tiers of the MDR’s four-tier system), requiring conformity assessment by a Notified Body.

The EU AI Act independently classifies AI systems used in healthcare as high-risk under Annex III. They face their own conformity assessment requirements. The Act contains a provision — Article 9, technically — that attempts to avoid “double compliance” by allowing AI systems already certified under other EU harmonized legislation to use that certification as partial evidence for AI Act compliance. This provision was designed to solve the overlap problem. It doesn’t quite work.

Related reading

The problem is that MDR conformity assessment and AI Act conformity assessment test different things. The MDR focuses on clinical safety and performance — does the device do what it claims to do without causing unacceptable harm? The AI Act focuses on transparency, explainability, human oversight, and data governance. A medical AI system can have excellent MDR certification — demonstrating clinical accuracy and safety — while lacking the AI Act requirements for transparency documentation, human oversight architecture, and training data provenance records. Conversely, it can have perfect AI Act compliance while still needing MDR conformity assessment for its medical performance claims.

The Article 9 provision reduces but doesn’t eliminate double compliance. The remaining AI Act requirements still need to be met even by MDR-certified systems. And the legal interpretive question of exactly which requirements are “satisfied” by MDR certification and which aren’t is, as of this writing, contested.

The Notified Body Shortage, Compounded

Medical AI faces the Notified Body shortage at double intensity. There are only 21 EU-designated Notified Bodies under the MDR with AI system competence. These are the same Notified Bodies handling general AI Act certification, but for medical devices the technical expertise requirements are even more specialized — auditors need clinical knowledge, understanding of medical AI performance metrics, and familiarity with both the MDR’s technical documentation requirements and the AI Act’s.

The wait times for medical AI conformity assessment are running longer than the general AI Act average. Twelve to eighteen months from submission to certification is now the stated timeline at TÜV SÜD and BSI (the British Standards Institution, which retained EU AI Act Notified Body status post-Brexit under a specific agreement). Some Notified Bodies have informally told companies they’re not accepting new medical AI submissions for 2026.

For a startup that has spent three years and €5 million developing a diagnostic AI system and needs Notified Body certification to commercialize in Europe, a twelve-month wait — combined with a certification cost of €100,000 to €250,000 — is potentially existential. Their runway doesn’t extend that far. Their investors don’t have patience for an indeterminate timeline. The temptation to launch in a non-EU market first, or to restructure the product to avoid medical device classification, is often irresistible.

The restructuring-to-avoid-classification approach is worth dwelling on. A system that is clearly a medical device — that makes or supports clinical decisions about specific patients — cannot ethically be redesigned away from that purpose. But a system that sits in a diagnostic support gray zone can be reframed. “This software provides population health analytics, not individual patient diagnoses” is a description that some diagnostic AI systems can legitimately adopt, particularly if they’re sold to hospital systems rather than directly to clinicians. The reframing reduces regulatory burden; it also reduces clinical utility, since population-level analytics aren’t the same as individual diagnostic support.

The regulator is, in effect, incentivizing companies to build slightly less useful clinical tools to avoid classification as medical devices.

The Competitive Context

US medical AI companies are not dealing with this situation. The FDA’s regulation of AI-based medical devices — operating under the Software as a Medical Device guidance framework and the AI/ML-Based Software as a Medical Device Action Plan — has its own compliance requirements. But the FDA’s De Novo authorization pathway for novel AI devices and its Predetermined Change Control Plan framework for iteratively updated AI have been repeatedly cited by European medical AI founders as dramatically more workable than the combined MDR/AI Act framework.

Related reading

IDx Technologies’ diabetic retinopathy detection AI was authorized by the FDA in April 2018 — a landmark autonomous diagnostic AI approval — in a process that took approximately 18 months from submission. The clinical evidence bar was high. The authorization was meaningful. But it was completed. Companies could reach the market.

The equivalent European pathway for a diagnostic AI in 2026 involves MDR conformity assessment, AI Act compliance, potential double certification, a Notified Body queue running 12+ months at an estimated cost of €200,000-€400,000, and interpretive uncertainty about what exactly needs to be certified. Several US medical AI companies with FDA authorization have explicitly stated that they’re deferring EU market entry until the regulatory picture clarifies.

This means European patients may have delayed access to AI diagnostic tools that are being widely deployed in the US. The mammography AI systems from companies like iCAD and Therapixel, the retinal disease detection tools from Google Health’s DeepMind unit — tools with demonstrable clinical benefits — are commercially available and actively deployed in US healthcare systems. Their EU availability is either delayed or limited by the certification complexity.

The public health cost of this delay is real but invisible in the compliance debate. Nobody has a count of the cancers detected three months later because a diagnostic AI was still in the Notified Body queue. The compliance costs are concrete and measurable; the health outcomes forgone are diffuse and hypothetical. Regulatory debates that operate in this information environment will systematically underweight the harm done by over-regulation relative to the harm done by under-regulation.

What Resolution Would Look Like

Several organizations — the European Association for Medical Informatics, the Digital Health Working Group of the European Commission — have proposed harmonized assessment pathways that would allow MDR conformity assessment and AI Act requirements to be evaluated in a single coordinated process by a single Notified Body audit. This is technically achievable; it requires the EU AI Office and the EMA (European Medicines Agency, which oversees MDR) to agree on a shared technical standard.

The agencies announced a joint working group on this question in April 2026. Working groups are not solutions. They are indicators that a solution has not been found.

The most likely near-term development is an update to the EU AI Office’s guidance that specifies, with more precision than current documentation provides, which AI Act requirements are satisfied by MDR conformity and which require additional AI Act-specific assessment. This won’t solve the Notified Body capacity problem, but it will reduce the interpretive uncertainty that is currently parallelizing medical AI companies in unnecessary compliance work.

The capacity problem will take years to resolve through Notified Body accreditation, auditor training, and market development. In the interval, European medical AI development will continue to lag American, and the companies most affected won’t be the large hospital systems or the medical device incumbents. They’ll be the startups building the genuinely novel tools — the ones the regulation, in its stated purpose, was designed to get to market safely, not to prevent from reaching market at all.

The Incumbents’ Quiet Advantage

There is one set of actors that the MDR/AI Act intersection actively benefits: established medical device companies with existing Notified Body relationships.

Related reading

Medtronic, Philips Healthcare, Siemens Healthineers, GE HealthCare — these companies have maintained continuous Notified Body relationships for decades. Their conformity assessment submissions are familiar to specific auditors. Their quality management systems are mature and documented. When they add AI capabilities to existing product lines, the incremental compliance work is substantially reduced compared to a startup bringing a standalone AI product to market.

This isn’t coincidental. The MDR’s transition from the older Medical Device Directive created similar dynamics in 2021-2022, when established device manufacturers retained market authorization while hundreds of smaller manufacturers struggled with the new conformity assessment requirements and some products were temporarily pulled from the European market. Medical device regulation has a documented track record of concentrating market access in established players during transition periods.

The specific companies that built their competitive positions on software-based clinical AI before the MDR/AI Act overlap became fully enforced are now in an enviable position. Their legacy regulatory relationships ease the path. Their clinical histories — years of real-world performance data — satisfy post-market monitoring requirements more easily than a startup’s months of pilot data. Their balance sheets fund compliance without diverting engineering resources.

For patients, this may mean continuity of access to familiar tools during the transition period. What it doesn’t mean is that the most innovative new diagnostic AI reaches European markets quickly. Innovation in medical AI is happening disproportionately in startups — small companies building novel architectures for imaging analysis, genomic interpretation, and treatment planning that established players are years behind. If those startups can’t navigate the conformity maze, European healthcare adopts the next generation of diagnostic AI later than it should. The incumbents’ advantage is patients’ disadvantage, delayed by the length of the regulatory queue.