EU AI Act
Navigating the EU AI Act: Is Your Documentation Software a High-Risk Device?
Most clinical documentation software is not high-risk AI under the EU AI Act. It becomes high-risk when it is a medical device that needs a notified body under the MDR, or when it serves a purpose listed in Annex III. How to check, which dates apply after the Digital Omnibus, and what Article 50 really requires.
Author: Kryštof Olík, Founder of OllsoftPublished Updated 5 min read
Short answer
An AI system in healthcare is high-risk in two cases. First, under Art. 6(1) of the AI Act: it is a medical device, or a safety component of one, and the MDR requires a notified body to assess its conformity. Second, under Art. 6(2): its purpose is listed in Annex III, for example emergency patient triage, or public authorities deciding who is eligible for public healthcare services. Software that only records, transcribes or structures what clinicians dictate is usually neither.
When is documentation software a medical device?
Under the MDR, software is a medical device when the manufacturer intends it for a medical purpose such as diagnosis, monitoring or treatment decisions. Software that only stores, archives, transmits or searches data is not (MDCG 2019-11). Medical device software that informs diagnostic or therapeutic decisions is class IIa or higher under classification rule 11, and from class IIa up a notified body is involved. That is the point where the AI Act's high-risk rules attach.
- Speech-to-text of a ward round, written into the hospital information system: usually not a medical device, so not high-risk under Art. 6(1).
- A draft discharge summary that the physician reviews and signs: usually documentation, but check the intended purpose your vendor states.
- Software that suggests a diagnosis, flags deteriorating patients or recommends treatment: a medical device, typically class IIa or higher, and then high-risk AI.
- ICD or DRG coding suggestions for billing: not in Annex III and not a medical purpose by itself; check how the output is used.
How the AI Act and the MDR fit together
Guidance MDCG 2025-6, published in June 2025 by the Medical Device Coordination Group together with the AI Board, explains the interplay. A high-risk AI medical device is assessed in the MDR conformity assessment, by a notified body that is also competent under the AI Act (Art. 43(3)). Manufacturers can build the AI Act requirements into the quality management system and technical documentation they already keep for the MDR instead of running a second system. High-risk status under the AI Act does not change the device's MDR class.
What the AI Act adds for providers of high-risk systems:
- risk management across the life cycle (Art. 9)
- training, validation and test data that are relevant, representative and as far as possible free of errors, with an examination of possible bias (Art. 10)
- technical documentation (Art. 11) and automatic logs (Art. 12)
- instructions for use (Art. 13) and human oversight (Art. 14)
- accuracy, robustness and cybersecurity (Art. 15)
Hospitals that use a high-risk system are deployers. They must use it according to the instructions, assign trained staff to oversight, keep the logs for at least six months and inform employees before it is used at the workplace (Art. 26).
Which dates apply?
The Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, postponed the high-risk deadlines that the AI Act originally set for 2 August 2026.
| Date | What applies |
|---|---|
| 2 Feb 2025 | Prohibited practices (Art. 5) |
| 2 Aug 2026 | Transparency obligations (Art. 50) |
| 2 Dec 2027 | High-risk systems listed in Annex III |
| 2 Aug 2028 | High-risk AI in products under Annex I legislation, including medical devices under the MDR |
What Article 50 requires, and what it does not
Article 50 is about telling people when AI is involved, not about documenting the system. A chatbot or voice assistant that talks to patients must say it is an AI unless that is obvious. Providers of systems that generate text, audio or images must mark the output as machine-generated in a machine-readable way, unless the system only assists with standard editing or does not substantially change the input. Deepfakes must be labelled. Technical documentation, accuracy figures and human oversight are high-risk duties under Articles 9 to 15, not Article 50.
Where on-premise deployment helps
Running the model on the hospital's own servers does not change the AI Act risk class. It helps with the data protection and security questions around it: patient data stays in the hospital network, there is no transfer to a third country to justify, and access control and logs stay with hospital IT. It does not make a system compliant by itself.
Olingo Medical, which we built, turns dictation and documents into clinical documentation; more than 10 hospitals and clinics use it, and in two university hospitals it runs entirely on their own servers with no cloud connection. Building it, we had to work out when documentation software becomes a high-risk AI system. See the Olingo Medical case study.
Check your own system
The free AI Act risk check shows in a few minutes which risk class and duties are likely to apply. For a written assessment of your AI systems within 48 hours, see EU AI Act compliance or write to info@ollsoft.ai. We are engineers, not a law firm; legal sign-off stays with your counsel.
Frequently asked questions
- Is AI documentation software high-risk under the EU AI Act?
- Usually not. It is high-risk when it is a medical device that needs a notified body under the MDR, or when it serves a purpose listed in Annex III.
- When do the high-risk rules apply to medical AI?
- From 2 August 2028 for AI in medical devices (Annex I) and from 2 December 2027 for Annex III uses, after Regulation (EU) 2026/1744 postponed the original date.
- Does Article 50 require technical documentation?
- No. Article 50 covers disclosure and labelling: chatbots must say they are AI, and generated content must be marked. Documentation duties belong to high-risk systems.