# When Software Is Both a Medical Device and a High-Risk AI System: How Health Tech Growth Companies Reconcile MDR and the AI Act > The AI Act and MDR apply to health tech software at the same time. Here is how growth companies merge CE marking and AI Act compliance into one process. - Published: 2026-09-27 - Author: Master Mind - Canonical: https://aimaster.fi/en/artikkelit/ai-act-ja-mdr-terveysteknologian-kasvuyritykselle Finnish health tech product exports grew 8% in 2025 and hit a record 2.79 billion euros (Terveysteknologia ry / Teknologiateollisuus, 2026). One issue threatens to slow growth for exactly the companies whose product is software: the same product can be both a medical device and a high-risk AI system under the AI Act at the same time. Many Finnish health tech growth companies build diagnostic or decision-support software that uses machine learning. The product already goes through CE marking under the Medical Device Regulation (MDR). What many don't realize: the same software can automatically meet the AI Act's definition of a high-risk AI system. The AI Act does not replace MDR — both apply simultaneously, and both sets of requirements must be met in parallel. ## When is health tech software automatically a high-risk AI system under the AI Act? The AI Act (Regulation 2024/1689) lists in Annex I the Union harmonisation legislation covered by the regulation, which includes the Medical Device Regulation (EU) 2017/745 (MDR) and the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746 (IVDR). Under Article 6(1), an AI system is classified as high-risk when it is a product, or the safety component of a product, covered by this legislation and requires third-party conformity assessment. This applies directly to machine-learning-based diagnostic software, imaging support software, and decision-support systems already classified as medical devices under MDR or IVDR. The requirement becomes applicable on 2 August 2028 (AI Act, Article 113), but preparation should start now: notified body queues are long, and product development timelines typically run 12–24 months. ## What does the AI Act require on top of MDR compliance? The AI Act doesn't replace MDR — it adds a risk management system, data governance requirements, technical documentation, logging, human oversight, and accuracy requirements (Articles 9–15). In practice, the same notified body can assess both sets of requirements in one process, but the documentation must cover each regulation separately and in detail. - A risk management system across the full lifecycle (Article 9) - Data governance: quality, representativeness, and error-freedom of training, validation, and test data (Article 10) - Technical documentation meeting the AI Act's Annex IV requirements in addition to MDR documentation (Article 11) - Automatic logging for the entire operational lifetime (Article 12) - Human oversight and the ability to pause or override the system's decision (Article 14) - Accuracy, robustness, and cybersecurity proven through testing (Article 15) ## How does a growth company merge CE marking and AI Act compliance in practice? This works best as one project in three phases, not two separate ones. The first phase maps exactly which products and software components carry the dual obligation — many companies are surprised to find four or five affected products, not one. We've productized this phase as Master Plan. [Master Plan](https://aimaster.fi/tuotteet/master-plan) is an AI strategy sprint that maps where AI creates the most value for your company — measured in euros. For a health tech company, that also means mapping where AI creates the biggest regulatory exposure. The second phase is building a data governance layer. Article 10 of the AI Act requires provable data quality, representativeness, and error-freedom throughout training and validation. [Master Layer](https://aimaster.fi/tuotteet/master-layer) is a data foundation layer that connects your existing systems (CRM, ERP, documents) securely for AI use — for a health tech company, that also means traceability: who handled the data, when, and which model version was trained on it. The third phase is merging documentation into one package a notified body can assess in a single pass. The same technical file can cover MDR's Annex II requirements and the AI Act's Annex IV requirements, provided the structure is designed for both from the start. This is a different regulatory route than the [AI Act's Annex III high-risk classification](https://aimaster.fi/artikkelit/ai-act-korkean-riskin-tekoalyjarjestelma-annex-iii), which covers systems like recruitment or credit-scoring tools: on the Annex I route, a notified body is already part of the process because of MDR, which speeds up the AI Act assessment when documentation is prepared correctly from the outset. ## Who does the conformity assessment — one notified body or two? The same notified body that assesses MDR or IVDR compliance typically also assesses AI Act requirements on the Annex I route, provided it is designated for both tasks. In practice this shortens the overall timeline, but it requires the technical documentation to cover both regulations from the start — retrofitting it afterward is slower than designing it jointly. Health tech is one of Finland's most important export sectors, and managing this regulatory overlap is a competitive advantage, not just an obligation. Health tech product exports grew 8% in 2025 to a record 2.79 billion euros, with a third going to the United States (Terveysteknologia ry / Teknologiateollisuus, 2026). A growth company that masters the MDR-AI Act merge at home can demonstrate the same maturity in export markets, where customers increasingly ask how AI is governed before they buy. Regulation isn't a roadblock when it's designed into product development from day one. Companies that start mapping years ahead of the deadline reach the market first — not last, once the notified body queue is full. Start by mapping which of your products carry the dual obligation and where AI creates the most value relative to the risk. [Book a free Master Mind analysis](https://aimaster.fi/analyysi) for a concrete view of your next step. ## Frequently asked questions ### Does the AI Act apply to all health tech software? No. The AI Act only applies to software that meets the definition of an AI system (Article 3) and is classified as a medical device or in vitro diagnostic device under MDR or IVDR. Rule-based software that doesn't use machine learning or other AI techniques falls outside the AI Act, even if it is a medical device. ### When do AI Act requirements take effect for Annex I systems? The high-risk requirements under Article 6(1) of the AI Act for systems covered by Annex I legislation, including MDR and IVDR, become applicable on 2 August 2028 (AI Act, Article 113). Preparation should start well in advance because notified body capacity is limited. ### Can the same technical documentation cover both MDR and the AI Act? Yes, if the documentation is designed for both from the start. The MDR Annex II technical file and the AI Act Annex IV technical documentation can be merged into one package assessed by the same notified body. Separating them after the fact is slower and more expensive than joint design from the outset. ### What does data governance mean in practice for health tech AI? Article 10 of the AI Act requires training, validation, and test data to be relevant, sufficiently representative, and as free of errors as possible for the intended purpose. A health tech company must be able to show where its data comes from, how it was handled, and how model versions are traceable throughout the development cycle. ### Should a small health tech company start preparing now? Yes. By 2028, notified body queues will lengthen as more Annex I products also need AI Act assessment. A company that maps requirements and builds its data governance layer early reaches the market ahead of competitors whose documentation is finished at the last minute.