AI Act Deadlines for Medical Devices: Current Status

Status (updated 25 July 2026). Next scheduled review: 1 October 2026, or immediately on any material development, whichever is sooner.

In short: The Digital Omnibus package that postpones the AI Act's high-risk deadlines was published in the Official Journal on 24 July 2026 as Regulation (EU) 2026/1744 and enters into force on 27 July 2026. From entry into force, the deferred dates are the legally binding ones: 2 December 2027 for Annex III stand-alone high-risk systems, and 2 August 2028 for high-risk AI in regulated products — including medical devices under Article 6(1). The original 2 August 2026 and 2 August 2027 dates are superseded. Plan against the deferred dates. Article 4's AI literacy obligation is unaffected by any of this: it has applied since 2 February 2025.

Why this page exists, and why it's dated so precisely

This is the page in our content set we update most often, on purpose, and it carries the current dates for the obligations set out in the EU AI Act founder's handbook. AI Act timing for medical devices has moved twice in the life of this article alone, and both times the change mattered enough to affect real submission plans. Rather than write a single static explainer that goes stale the next time the legislative process moves, we maintain this as a living page with an explicit status line, so anyone linking to it, or reading it months from now, can tell at a glance whether the content in front of them reflects the current legal position.

The dates that stand today

The table below separates the dates that are already in force from the deferred dates that the Digital Omnibus makes legally binding from its entry into force on 27 July 2026.

The deferred dates are the ones to plan against: from 27 July 2026 they are the legally binding ones, and the original dates are superseded. Keep evidence-generation moving regardless — a programme built for the earlier dates automatically satisfies the later ones.

Why medical devices got the extended runway

Medical devices already sit inside a mature, sector-specific conformity assessment system: Notified Bodies, technical documentation requirements, post-market surveillance, and an established audit cadence, all under MDR and IVDR. The AI Act's drafters recognised that forcing high-risk AI obligations to land on the same date as the general Annex III timeline would ask an already-stretched Notified Body system to absorb a second, simultaneous compliance wave, with device manufacturers given little lead time to adapt technical files that, in many cases, were built before AI-specific requirements existed.

The extended timeline to 2 August 2028 gives manufacturers and Notified Bodies more room to build AI Act content into the MDR conformity assessment process as an extension of existing work, rather than a rushed parallel track assembled under deadline pressure. One Notified Body for MDR and the AI Act covers the mechanics in detail.

What happened, and what changed: the Digital Omnibus timeline in full

The European Commission proposed the Digital Omnibus package intended, in part, to sequence and simplify obligations for products where AI is embedded within hardware or safety systems rather than deployed as a standalone system, a category medical devices fall squarely into. Through the spring of 2026, the package moved through negotiation between the European Parliament, the Council, and the Commission, and for a period its fate, and the specific dates it would land on, were genuinely uncertain.

Where it stands now: the package completed its final step. It was formally adopted by the European Parliament and the Council, the final act was signed on 8 July 2026, and it was published in the Official Journal on 24 July 2026, entering into force on 27 July 2026 — the third day following publication. Publication was the step that makes the deferred dates law: from entry into force, the deferred dates in the table above are the legally binding ones, and the original AI Act dates (Annex III 2 August 2026; Article 6(1) 2 August 2027) are superseded.

The practical upshot: the extended dates are now law. Plan against them — 2 December 2027 for Annex III, 2 August 2028 for Article 6(1) medical devices — and the planning guidance below treats them exactly that way.

What is not moving, and never was: Article 4 AI literacy

This applies to every organisation in scope of the Act, not only those building high-risk systems, and it has been a live obligation for well over a year as of this review, not a future deadline. If your organisation deploys any AI system today and hasn't addressed this, it's not a compliance item on the horizon; it's a gap that already exists.

A worked scenario: sequencing against the new dates

Consider a startup with a Class IIa diagnostic AI product, planning a Notified Body submission in the second half of 2028. Working from the now-binding deferred date of 2 August 2028 changes the sequencing math, but not the underlying discipline required.

AI Act evidence, particularly data governance documentation, still needs to be substantially complete before submission, not added afterward, because it's reviewed as part of the same technical file your Notified Body assesses. The extra year of runway is genuinely useful, but it's easy to misuse: a team that treats it as license to defer AI Act work until 2028 approaches will face the same crunch the original 2027 date would have created, just a year later. The teams getting real value from the extended timeline are the ones using the additional time to build data governance and logging infrastructure properly during ordinary development, rather than compressing it into a pre-submission scramble either way.

The safer sequencing, regardless of how much runway the calendar shows, is to build AI Act content into the technical file on the same timeline as the rest of the MDR submission, treating the extended date as a buffer against unforeseen delay rather than as the actual target to build toward.

How to talk about this timeline with investors

Founders raising during this transition period are often asked directly whether AI Act compliance is "handled." The accurate answer, and the one that holds up under diligence, distinguishes between the components on this page: AI literacy training, which has been due since February 2025 and should already be closed out, and full Article 6(1) conformity — due 2 August 2028 under the Digital Omnibus deferral, in force from 27 July 2026 — integrated into your MDR submission timeline.

Two framings to avoid. Describing AI literacy as a "future" obligation is simply wrong at this point and is an easy thing for a diligence-minded investor's counsel to catch. Describing the 2028 date as generous headroom that removes urgency is also a weaker position than it sounds, since sophisticated investors increasingly ask not just "what's your deadline" but "what are you doing with the time before it." The more credible position states the current position accurately — the deferred dates are the legally binding ones from 27 July 2026, superseding the original dates — shows a development plan that treats data governance and logging as ongoing engineering work rather than a pre-deadline sprint, and names the extended timeline as reduced execution risk rather than reduced obligation.

Get notified when this changes

Because this page has changed twice in ways that mattered to real submission plans, we'd rather make it easy to track than ask you to keep re-checking manually. If you want to be notified if any further legislative development affects these dates, get in touch and ask to be added to our AI Act timeline alerts. We send an update only when something on this specific page changes, not a general newsletter.

Planning rule: plan against the deferred dates, now binding

The practical guidance we give clients is straightforward. AI literacy should be addressed immediately, since it's already overdue if untouched. For the high-risk dates, plan against the deferred dates that the Digital Omnibus makes legally binding from 27 July 2026 — Annex III 2 December 2027 and Article 6(1) 2 August 2028; the original dates are superseded. The extra runway is not a reason to pause: keep evidence-generation moving, because data governance and logging documentation is far cheaper to produce during ordinary development than to reconstruct before a submission, and a programme built for the earlier dates automatically satisfies the later ones. Publication has landed, so the deferred dates are the binding baseline — this page now says so explicitly.

How this compares to the timeline the AI Act originally shipped with

It's worth remembering how far the effective date for medical devices has moved since the AI Act was first adopted, because the direction of travel tells you something useful about how to treat future changes. When the Act entered into force in August 2024, the working assumption in most legal commentary was that high-risk obligations for embedded AI in regulated products, medical devices included, would land on a broadly similar schedule to the general Annex III timeline. Two rounds of sequencing work later, first establishing the original 2 August 2027 date specifically for Article 6(1), then the Digital Omnibus extension to 2 August 2028 (in force from 27 July 2026), the effective date for medical devices has moved a full year later than where early readings of the Act suggested it would land, and it has consistently moved later rather than earlier.

We flag this pattern deliberately, not to suggest further delay is likely, but because it explains why we treat "monitor and confirm" as the right posture rather than "assume the current date is the last word." Nothing in the legislative record suggests another shift is coming. But a page with this article's history of revision earns a healthy dose of its own caution.

What a further delay, if one ever happened, would and wouldn't change

Because this page has moved before, it's worth being explicit about what a hypothetical future shift would and wouldn't affect, so you're not left guessing if it ever comes up. A further delay to the Article 6(1) date would extend the runway before Notified Body assessment of AI Act content becomes mandatory. It would not touch Article 4's AI literacy obligation, which sits entirely outside this timeline and has already been binding since February 2025. It would also not retroactively excuse work already completed. Teams who build data governance and logging practices into their development process now aren't at risk of having "wasted" that effort if a date moves again; that evidence is exactly what a Notified Body will eventually want to see, regardless of which exact date it's assessed against.

Frequently asked questions

Is the 2 August 2028 date now legally final? Yes. The Digital Omnibus was published in the Official Journal on 24 July 2026 and enters into force on 27 July 2026. From entry into force, the 2 August 2028 date for Article 6(1) is the legally binding one, and the original 2 August 2027 date is superseded. Only a further legislative act could move it again, and none is on the table.

What happens if I already built a compliance plan around the original 2 August 2027 date? You're in a good position. Work done against the earlier, tighter deadline satisfies the later one; nothing about the extension requires you to redo anything. The extra time is available to use for deeper data governance and logging work, or simply as schedule margin, rather than being work you now need to unwind.

Does the extended timeline apply to devices already CE marked under MDR without AI Act consideration? The extended date affects when Article 6(1) obligations become applicable, not whether they apply. An existing CE-marked device with an AI system integral to its function will need to meet AI Act requirements once the applicable date arrives, regardless of when the underlying MDR certificate was originally issued.

Why does the general Annex III date move to December 2027 rather than staying at August 2026? The Digital Omnibus package addressed sequencing across several AI Act obligations together, not just the medical-device-specific date. The general Annex III shift to 2 December 2027 is part of the same agreed package as the medical-device shift to 2028, reflecting a broader recalibration of the Act's rollout timeline rather than a medical-device-specific concession — and, like the medical-device date, it is legally binding from the Omnibus's entry into force on 27 July 2026.

Should I still monitor this page if my product's obligations are years away? Yes, particularly if your product is early-stage. Regulatory timelines that look distant have a way of arriving during exactly the development phase where retrofitting compliance evidence is most expensive. Checking this page periodically, or requesting an alert as described above, costs little and avoids being caught by a date you stopped tracking.

Does the extended timeline affect products that are already in active Notified Body review? Not directly. A device already partway through Notified Body assessment continues under whatever scope was agreed with that Notified Body at the outset. If AI Act content wasn't part of the original scope, the extended date gives both sides more time to agree how and when to fold it in, rather than forcing a mid-review scramble against the earlier deadline.

Where does Article 4 AI literacy fit if my organisation isn't building a high-risk system at all? It still applies. Article 4 attaches to any organisation providing or deploying AI systems, not just those building or operating high-risk ones. If your organisation uses AI tools anywhere in its operations, this obligation has applied since 2 February 2025 regardless of what you're building.

Status line and next review

This page is maintained as a living policy summary specifically because these dates have been moving targets, twice, over the course of this content set's life. Status (updated 25 July 2026): the Digital Omnibus was published in the Official Journal on 24 July 2026 and enters into force on 27 July 2026, so the deferred dates — 2 December 2027 (Annex III) and 2 August 2028 (Article 6(1) medical devices) — are the legally binding ones, and the original dates are superseded. We'll revise this page on any further legislative development affecting these dates, or by 1 October 2026 at the latest, whichever comes first. When Medical Device AI Becomes High-Risk covers the substantive obligations that attach once these dates apply, not just the dates themselves.

---

Where next: When Medical Device AI Becomes High-Risk · One Notified Body for MDR and the AI Act

Which deadline applies to your product? Start the MedTech Compass →