AI Act's Digital Omnibus is now law: AI medical devices get until 2 August 2028, but notified bodies face a 28 January 2028 deadline

Written By Rado Milkov

Standfirst: Regulation (EU) 2026/1744 entered into force on 27 July 2026, deferring the AI Act's high-risk requirements for AI-enabled medical devices to 2 August 2028. Five days later the AI Act's general application date arrived. For manufacturers, the deferral is narrower — and the notified-body timetable tighter — than the headlines suggest.


Date of development: 27 July 2026 (entry into force) and 2 August 2026 (AI Act general application) Date of publication: 3 August 2026

Key takeaways

  • Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on 8 July 2026, published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026.

  • For AI systems classified as high-risk under Article 6(1) and Annex I of the AI Act — the route by which most AI-enabled medical devices and IVDs are captured — Chapter III, Sections 1, 2 and 3 now apply from 2 August 2028, one year later than the previous 2 August 2027 date. The dates are fixed, not conditional on standards being ready.

  • Medical devices were not moved out of Annex I Section A. Machinery was. The proposal to move the MDR and IVDR to Section B sits in a separate, unadopted legislative file.

  • Notified bodies already designated under the MDR or IVDR must apply for AI Act designation by 28 January 2028 if they intend to assess AI Act conformity. This is a capacity question for manufacturers, not just for the bodies themselves.

  • The 2 August 2026 general application date was left untouched. Transparency obligations, the EU database, the innovation-support chapter and the entire market-surveillance apparatus are now enforceable.

What happened

Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amends Regulation (EU) 2024/1689 (the Artificial Intelligence Act, or "AI Act"), Regulation (EU) 2018/1139 (civil aviation) and Regulation (EU) 2023/1230 (machinery). It was signed at Strasbourg, published in the Official Journal of the European Union on 24 July 2026 and, under its Article 4, entered into force on the third day following publication — 27 July 2026.


Five days later, on 2 August 2026, the AI Act's general date of application arrived. That date is set by the second paragraph of Article 113 of Regulation (EU) 2024/1689. The Digital Omnibus rewrote the third paragraph of Article 113 — the list of exceptions. It did not touch the second paragraph. The general rule therefore stands.


The central change for the medical device sector sits in Article 1, point 40 of the amending regulation, which replaces point (c) of the third paragraph of Article 113. Chapter III, Sections 1, 2 and 3 of the AI Act — high-risk classification, the requirements for high-risk systems, and the obligations of providers and deployers — now apply from:


  • 2 December 2027 for AI systems classified as high-risk under Article 6(2) and Annex III (stand-alone use cases such as employment, education and biometrics); and

  • 2 August 2028 for AI systems classified as high-risk under Article 6(1) and Annex I (AI that is, or is a safety component of, a product regulated under EU sectoral harmonisation legislation).


Medical devices and in vitro diagnostics reach the AI Act through the second route. Regulations (EU) 2017/745 (MDR) and (EU) 2017/746 (IVDR) are listed in Section A of Annex I to the AI Act. In broad terms, an AI-enabled device is caught by Article 6(1) where it is subject to third-party conformity assessment under the MDR or IVDR — which covers most devices from Class IIa upwards and most IVDs from Class B upwards.

What is new compared with the previous position

Item Position before 27 July 2026 Position from 27 July 2026
High-risk requirements, Art. 6(1)/Annex I (medical devices, IVDs) Applied from 2 August 2027 Apply from 2 August 2028
High-risk requirements, Art. 6(2)/Annex III Applied from 2 August 2026 Apply from 2 December 2027
Nature of the deadline Commission had proposed a conditional trigger tied to the availability of harmonised standards Fixed calendar dates. The conditional mechanism was abandoned in negotiation
Machinery in AI Act Annex I Section A, point 1 Deleted from Section A; added to Section B (point 21)
MDR / IVDR in AI Act Annex I Section A Unchanged — still Section A
Notified-body designation under the AI Act No specific deadline for bodies already notified under Annex I Section A legislation Must apply for designation under Chapter III, Section 4 by 28 January 2028
Commission guidelines on avoiding duplication with sectoral law Not scheduled To be published by 1 August 2027
Delegated acts limiting requirements where sectoral law gives equivalent protection Not scheduled To be adopted by 2 August 2027 (Art. 2(13))

Two points deserve emphasis because they are frequently misreported.



First, the deferral is confined to three sections of one chapter. Section 5 of Chapter III — which covers standards, conformity assessment, certificates and registration, including the rewritten Article 43(3) and a new cybersecurity presumption of conformity in Article 42(3) — was not deferred. It applies from 2 August 2026. In practical terms much of Section 5 has limited object until the substantive requirements bite, because a conformity assessment presupposes requirements to assess against. But the standardisation regime in Articles 40 and 41 operates upstream of classification and is already running.



Second, medical devices did not get the Section B treatment. Article 1, point 41 of the Digital Omnibus deletes point 1 from Section A of Annex I and adds the Machinery Regulation to Section B. Where legislation sits in Section B, Article 2(2) of the AI Act substantially disapplies the Act's high-risk requirements and leaves the sectoral regime in charge. Machinery received that treatment. The MDR and IVDR did not. A separate Commission proposal of 16 December 2025 to revise the MDR and IVDR would move them to Section B, but that file remains in negotiation and nothing in this week's regulation pre-empts it.

Why this matters in practice

The most commercially significant provision for the device sector is not the deferral. It is the second subparagraph of the amended Article 43(3).



Notified bodies notified under Union harmonisation legislation listed in Section A of Annex I — which includes MDR and IVDR notified bodies — may assess the conformity of high-risk AI systems against the Section 2 requirements, provided their compliance with Article 31(4), (5), (10) and (11) has already been assessed as part of the existing notification. But those bodies must apply for designation in accordance with Chapter III, Section 4 by 28 January 2028.



That date sits roughly six months before the 2 August 2028 application date. It creates a narrow window in which the supply of notified bodies competent to assess AI Act conformity will become visible. The regulation also introduces a new Annex XIV setting out codes, categories and corresponding types of AI systems that define the scope of a designation, using "AIP codes" that map to the Section A legislation and "AIB codes" for biometric systems. Designation scope will therefore be granular. A manufacturer's existing notified body being AI Act-designated in general will not necessarily mean it is designated for the relevant code.



The European notified-body system has spent five years working through MDR and IVDR capacity constraints. Layering an additional designation process onto the same bodies, with an application deadline in January 2028, is a foreseeable pressure point.



Separately, the arrival of 2 August 2026 matters for AI-device manufacturers in ways unrelated to the high-risk chapter. From that date the transparency obligations in Article 50 are enforceable — including the duty to inform natural persons that they are interacting with an AI system, and the machine-readable marking duty for synthetic content in Article 50(2). Providers of systems generating synthetic audio, image, video or text placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2), under a new Article 111(4). Systems placed on the market on or after 2 August 2026 have no transition. Chapter IX on market surveillance is also fully operational from 2 August 2026.

Who is affected

  • Manufacturers of AI-enabled medical devices and IVDs subject to notified-body conformity assessment under the MDR or IVDR

  • Manufacturers of medical device software with AI or machine-learning components, including adaptive systems

  • Notified bodies designated under the MDR or IVDR that intend to assess AI Act conformity

  • EU authorised representatives, importers and distributors of AI-enabled devices

  • Persons responsible for regulatory compliance (PRRCs) with AI-enabled devices in their portfolio

  • Deployers of AI systems in clinical settings, including hospitals and laboratories, in respect of the Article 50 information duties

Key dates

Date What applies
27 July 2026 Regulation (EU) 2026/1744 enters into force. Articles 102–110 of the AI Act (amendments to Union sectoral acts) apply. Amended Article 3(14) definition of “safety component” takes effect
2 August 2026 AI Act general application: Article 50 transparency, Chapter VIII (EU database), Chapter IX (market surveillance), Chapter III Section 5, Chapter X, Chapter XI, Article 101
2 December 2026 New Article 5 prohibitions apply. Deadline for Article 50(2) compliance for synthetic-content systems placed on the market before 2 August 2026
1 August 2027 Commission guidelines due on Articles 8(2), 9(10) and 17(3) as mechanisms to minimise duplication with Annex I Section A legislation
2 August 2027 Commission delegated acts due under Article 2(13) specifying where requirements may be limited because sectoral legislation provides equivalent protection. National AI regulatory sandboxes to be operational
2 December 2027 Chapter III Sections 1–3 apply to Article 6(2) / Annex III systems
28 January 2028 Notified bodies already notified under Annex I Section A legislation must have applied for AI Act designation
2 August 2028 Chapter III Sections 1–3 apply to Article 6(1) / Annex I systems, including AI-enabled medical devices and IVDs

Note the grace provision in the amended Article 111(2): high-risk AI systems placed on the market or put into service before the relevant application date fall outside the requirements unless they are subject to significant changes in design. Recital 39 indicates this operates at the level of type and model rather than the individual unit — a point of real consequence for serially produced devices, though its interaction with MDR significant-change concepts is untested.

Practical actions to consider

  1. Establish your Article 6(1) position now, and document the reasoning. The amended definition of "safety component" in Article 3(14) took effect on 27 July 2026, while the refinements in Article 6 that qualify its application sit in the deferred Section 1. Any classification assessment written in the interim should address that gap expressly rather than assume it away.

  2. Ask your notified body, in writing, about its AI Act designation intentions and target scope codes. Given the 28 January 2028 application deadline and the granularity of the new Annex XIV, this is a supplier-capability question that belongs in your 2026 planning, not your 2028 planning.

  3. Integrate rather than duplicate. Articles 8(2), 9(10) and 17(3) exist precisely to let operators fold AI-specific risk assessment into existing ISO 14971 risk management and ISO 13485 quality management systems. Building a parallel AI compliance programme is likely to be both more expensive and harder to defend at audit. Commission guidelines are due by 1 August 2027.

  4. Do not defer Article 50 work. Transparency obligations are enforceable now. Where a device or its associated software interacts directly with patients or clinicians, or generates synthetic content, assess whether Article 50(3) and (4) deployer duties fall on your customers and whether your instructions for use support them.

  5. Track the MDR/IVDR revision separately. If the Section A to Section B move survives negotiation, the AI Act analysis for devices changes materially. It has not happened yet.

  6. Re-check the Article 111(2) grace position for legacy AI devices, in particular what your organisation treats as a significant change in design.

Open questions

  • Whether the MDR and IVDR will ultimately move to Section B of Annex I through the pending revision, and if so, on what timeline relative to 2 August 2028.

  • The content and scope of the Article 2(13) delegated acts due by 2 August 2027. These could materially narrow what applies to devices, but nothing has been proposed.

  • Whether harmonised standards from CEN-CENELEC JTC 21 will be available in time, and how they will be reconciled with MDR and IVDR harmonised standards under Article 40.

  • How many MDR and IVDR notified bodies will in fact seek AI Act designation, and across which Annex XIV codes. There is no published indication yet.

  • How the Article 111(2) type-and-model grace period interacts with MDR significant-change assessment for AI-enabled devices under continuous development.

QLE perspective

The framing of this reform as "the AI Act has been delayed" is, in our view, the most likely source of poor planning decisions over the next eighteen months. Three sections of one chapter moved. Everything else kept its original date, and 2 August 2026 was the largest single expansion of the AI Act's practical application to date.


For AI-enabled device manufacturers specifically, we would draw attention to the asymmetry the reform creates: from 2 August 2026 the enforcement machinery is fully operational, while the substantive high-risk obligations it exists to supervise arrive two years later. Authorities will have powers, resources and a mandate before manufacturers have obligations. Historically that combination tends to produce interpretive activity — guidance, questions at audit, informal expectations — well ahead of the formal deadline.

The 28 January 2028 notified-body date is where we would concentrate near-term attention. Manufacturers cannot control it, cannot easily substitute around it, and will feel it first. It is a reasonable question to raise at your next notified-body review meeting.

We would not, on the current text, advise treating the additional year as slack. The requirements themselves are unchanged, and the Commission has abandoned the conditional mechanism that could have moved the dates again. Recital 40 commits the Commission to putting supporting measures in place in time; if they do not arrive, there is no automatic second extension.

Conclusion

Does the Digital Omnibus give AI-enabled medical device manufacturers more time? Yes — one additional year, to 2 August 2028, and on a fixed date rather than a conditional one. But it does not reduce what must eventually be done, it does not remove medical devices from the AI Act's high-risk framework, and it does not defer the transparency, market-surveillance and conformity-assessment provisions that became enforceable on 2 August 2026. The binding constraint for most manufacturers will not be their own timeline. It will be whether their notified body is designated under the AI Act in time, and for the right scope.

Sources

Rado Milkov
Previous

FDA human factors expectations take effect: submissions received from 1 August 2026 should follow the new risk-based framework
Next

Notified body fees under EU MDR & IVD R: what certification really costs