Is my healthcare AI "high-risk" under the AI Act?

In short: Two routes make healthcare AI high-risk: Article 6(1), automatically capturing AI that is a Notified-Body-assessed medical device, or an Annex III listed use case (such as emergency triage). Most clinical AI is caught by the first route. Wellness and purely administrative AI generally is not high-risk.

Route 1: automatic, via your MDR classification

If your AI system is, or is a safety component of, a medical device requiring Notified Body conformity assessment under MDR — in practice, Class IIa and above — it is automatically high-risk under Article 6(1). No separate Annex III use-case analysis is needed; your existing MDR classification does the work. This route captures the large majority of clinical decision-support, diagnostic, and monitoring AI built for direct clinical use, since that's exactly the category Rule 11 already pushes into Class IIa or higher.

Route 2: Annex III listed use cases, even without MDR involvement

Separately, the AI Act's Annex III lists specific high-risk use cases that trigger high-risk status independent of any device classification — several of which sit adjacent to, but outside, direct clinical care. Emergency-service triage and dispatch AI is one; AI used in benefits eligibility determinations, employment or recruitment decisions within a healthcare organization, and certain biometric or law-enforcement-adjacent uses are others. This route surprises some founders who assumed AI Act exposure only comes through a medical device pathway — it's genuinely broader than that.

Where you're likely to sit

Direct-to-clinician or direct-to-patient software making diagnostic, monitoring, or treatment-decision claims is almost always Route 1, tied to whatever MDR class Rule 11 assigns it. Products adjacent to clinical care but not themselves a medical device — triage or dispatch tooling, healthcare-adjacent HR or eligibility systems — need a specific Annex III check, since MDR classification won't answer the question for them. Products that are dual-capture — an AI triage tool that's both an Annex III use case and, depending on its clinical claims, an MDR device — need both routes assessed, not just one.

Where next: Two Routes to High-Risk AI in Healthcare · Does the EU AI Act apply to my medical device?

Find out in minutes where your product likely sits. Start the MedTech Compass → — AI-generated first read, not a validated determination.