Three places the regulations actually pinch.
“Our notified body wants AI Act conformity referenced in the MDR technical file.”
“We're a hospital deploying vendor radiology AI. What do we actually owe?”
“FRIA is new. We don't have a template, and our DPIA isn't a substitute.”
Built for the regulation that shares evidence with another.
MDR + AI Act overlap
Annex IV sections (training data, performance metrics, post-market surveillance) reusable as MDR technical-file annexes. Same hash, same trust.
Annex VII pathway support
Clinical AI usually reaches high-risk through the Annex I product route, so conformity assessment follows your MDR notified-body procedure rather than the Act's internal-control route. The Art. 43 step records which pathway applies and holds the evidence for it.
FRIA wizard
Fundamental Rights Impact Assessment for Annex III §5 deployers. Clinical context built into the prompts; auto-skipped on private deployments.
Deployer journey
Hospitals are deployers, not providers. The journey reflects that — IFU receipt, oversight plan, monitoring, worker notification — without provider-only obligations cluttering the dashboard.
Vendor → hospital IFU handoff
Vendors send a sealed IFU package; the hospital paste-imports it. Hash chain links the deployer's record back to the vendor's seal.
Periodic review for clinical safety
The Art. 9 review schedule integrates with clinical-governance review cycles. Annual, post-incident, on-substantial-change — all captured.
Three clinical contexts.
A medical-AI vendor selling diagnostic imaging software into EU hospitals.
- Annex I (MDR product) classification recorded; conformity assessment runs through the device's notified body.
- Annex IV technical doc reused as MDR technical-file annex — one source of truth, two regulators.
- Art. 13 IFU package built once, sealed, sent per hospital with a unique sharing token.
- Public verify URL on the dossier — procurement teams check the seal before raising a PO.
A 600-bed hospital deploying vendor AI for radiology and cardiology.
- Deployer role detected; provider-only obligations hidden from the dashboard.
- Each system's IFU paste-imported from the vendor; oversight plan auto-templated from the imported fields.
- FRIA runs because the system reaches end-users; clinical-governance committee is the assessor.
- Worker notification (Art. 26(7)) tracked for radiographers and cardiologists.
A lifesciences group with internal AI for drug-discovery + external AI deployed in clinical operations.
- Multi-org architecture separates the R&D provider obligations from the operational deployer obligations.
- Models used solely for scientific research sit outside the Regulation's scope; operational systems are classified on their own facts, most often under Annex III §5 where they touch access to essential services.
- AI literacy programme covers both research scientists and clinical operations, tracked separately.
- Group-level dossier rolls up to the audit committee; per-subsidiary dossiers used for inspections.
