AI Act High-Risk Systems in Healthcare 2026: What Hospitals and MedTech Must Do

The EU AI Act's August 2026 deadline for high-risk AI systems is no longer a distant regulatory abstraction — it is a compliance crisis arriving on hospital IT departments' doorsteps right now. Annex III, point 5 of Regulation (EU) 2024/1689 places AI systems used in the management, operation and supply of healthcare services squarely in the high-risk category. That means diagnostic support tools, AI-assisted radiology platforms, clinical decision algorithms, predictive sepsis monitors, and any software meeting the definition of a medical device under the EU MDR — all of them carry eight distinct legal obligations that must be satisfied before deployment or continued use after the grace period expires.

This article unpacks each of those eight obligations with precision, maps them against the EU Medical Device Regulation (MDR 2017/745) device class framework, walks through a real Dutch hospital case study, and gives you a concrete compliance timeline. If your organisation builds, procures, or deploys AI in a clinical environment, these are the rules you need to satisfy — and the August 2026 deadline is not negotiable.

Why Healthcare AI Is Almost Always High-Risk

The AI Act uses a risk-based approach structured across four tiers: unacceptable, high, limited, and minimal. Healthcare sits at the sharp end. The legislation defines high-risk systems through two lenses: AI used as a safety component in a product already subject to EU harmonisation legislation (such as the MDR or IVDR), and stand-alone AI listed explicitly in Annex III.

Annex III, point 5 covers AI systems intended to be used in: (a) the provision of clinical care, including diagnosis, treatment, and patient monitoring; (b) operational management of hospitals; and (c) deployment by health insurance providers for risk assessment and pricing — though that last category falls under a slightly different obligations framework.

In practical terms, if your hospital is running an AI tool that flags deteriorating patients in the ICU, suggests antibiotic choices based on lab results, or auto-segments CT scans for oncology review, that system is almost certainly high-risk under both the MDR and the AI Act simultaneously. Dual compliance is not optional — it is the baseline.

The 8 Obligations for High-Risk Healthcare AI

Articles 8 through 15 of the AI Act lay out the substantive requirements. Here is what each demands in a hospital or MedTech context.

1. Risk Management System (Article 9)

Providers must establish, document, implement, and continuously update a risk management system throughout the AI system's entire lifecycle. This is not a one-off exercise. It requires identification and analysis of known and reasonably foreseeable risks to health and safety; estimation and evaluation of those risks; and adoption of appropriate risk management measures. For a hospital deploying a sepsis prediction tool, this means documenting what happens when the model produces false negatives at 3 a.m. with a single physician on duty.

2. Technical Documentation (Article 11 + Annex IV)

Annex IV specifies 14 categories of technical information that must be compiled and kept current, including: a general system description; a detailed description of the design specifications and training methodology; information on monitoring, functioning, and control of the system; and the metrics used to measure accuracy, robustness, and cybersecurity. For commercial MedTech vendors, this documentation must be handed over to deploying hospitals in a format that enables them to conduct their own assessment. A PDF marketing brochure does not qualify.

3. Conformity Assessment (Article 43)

High-risk AI systems covered by Annex III generally require a conformity assessment. For healthcare AI that simultaneously qualifies as a medical device or IVD under existing EU law, the AI Act allows the conformity assessment to be integrated into the existing MDR/IVDR process (Article 43(3)), provided the relevant notified body has the necessary competence. This is significant: organisations that already have Class IIb or Class III CE marking processes underway should proactively check whether their notified body is prepared to assess AI components.

4. CE Mark Alignment and Registration (Article 49)

All high-risk AI systems must bear the CE marking before being placed on the EU market or put into service. When the AI system is also a medical device, the CE mark for the MDR and the AI Act compliance declaration must be coordinated — they cannot contradict each other. Additionally, providers must register the system in the EU database on high-risk AI systems (EUAI database), which became operational in early 2026 and is managed by the European AI Office.

5. Human Oversight System (Article 14)

This is the obligation most frequently underestimated by MedTech developers. Article 14 requires that high-risk AI systems be designed and developed in ways that allow natural persons to effectively oversee them during the period of use. The system must enable operators to: understand the system's capabilities and limitations; monitor its operation; intervene or interrupt via a stop button or equivalent; and not solely rely on the AI output without their own assessment. In a radiology context, this means the radiologist must see not just the AI's prediction but also the confidence score, the source data used, and the option to flag the output as potentially unreliable — before signing any report.

6. Post-Market Monitoring (Article 72)

Providers must proactively collect and review data on the performance of the AI system in real-world deployment. This includes creating a post-market monitoring plan before launch, not after. For medical device-linked AI, this mirrors the MDR's Post-Market Surveillance (PMS) requirements under Article 83 of MDR 2017/745. The practical implication: hospitals and vendors need shared data agreements specifying who collects performance data, at what intervals, and how findings are fed back into the risk management system.

7. Serious Incident Reporting (Article 73)

When a high-risk AI system causes or could have caused a serious incident — defined as any incident that directly or indirectly leads to death, serious harm to health, or significant property damage — the provider must report to the relevant national competent authority without undue delay. Timelines mirror those in the MDR: 15 days for serious incidents, 10 days for deaths or unexpected serious deterioration of health. Hospitals that are deployers (not providers) still carry an obligation to notify providers of incidents they become aware of, under Article 74.

8. Bias Testing and GDPR Article 22 Alignment

Article 10 of the AI Act requires training, validation, and test datasets to be subject to data governance practices that include examination for possible biases. For healthcare AI, this is particularly acute: a diagnostic model trained predominantly on data from Northern European male patients aged 40–70 may perform poorly on female patients, elderly populations, or ethnic minorities — with life-threatening consequences. Providers must document bias testing results as part of their technical documentation. The GDPR Article 22 link is explicit in Recital 47: where an AI system makes or significantly contributes to individual healthcare decisions, data subjects may have the right not to be subject solely to automated decision-making. Providers must assess whether their deployment triggers this right and implement appropriate safeguards.