For health tech · Written by Yobel Tzegai · Last checked 3 November 2026

What will healthcare customers ask about the AI in your product?

By which route it is high-risk. AI that is a safety component of, or itself, a medical or in vitro diagnostic device needing third-party conformity assessment is high-risk under Article 6(1) from 2 August 2028; emergency triage AI, and eligibility AI used by or for public authorities, under Annex III from 2 December 2027 (Article 113, third paragraph, point (c)). Complipath (complipath.io) answers that per system, with the article behind it.

What it is for: when an enterprise customer's review asks about your AI, the answers are ready, each with its source, so the review need not hold up the deal.

Get my risk classes, freeBook a 20-min call20 minutes with the founder.

Why do your enterprise customers ask about your AI?

A hospital, clinic or insurer that buys your product is the deployer of the AI in it.
For a high-risk system it owes the Article 26 duties, among them use in line with your instructions, human oversight, monitoring and keeping logs.
For an Annex III system other than point 2 it may also owe a fundamental rights impact assessment before deployment, if it is a body governed by public law or a private entity providing public services, or deploys a point 5(b) or 5(c) system (Article 27(1)).

It also asks how the device route and the AI Act fit together.
Under Article 43(3), as replaced by Regulation (EU) 2026/1744 (the Digital Omnibus on AI), the AI Act requirements are assessed inside the conformity assessment the device regulation already requires, with the Article 17 quality management system assessed too, so your device file and your AI Act evidence have to line up.

A patient-facing assistant's provider owes disclosure already, unless it is obvious that the patient is talking to AI: Article 50(1) has applied since 2 August 2026 (Article 113, second paragraph; the later date in Article 111(4), 2 December 2026, is for Article 50(2) only).

Article 6(1) makes an AI system high-risk where both conditions are fulfilled: it "is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I", and that product "is required to undergo a third-party conformity assessment" under that legislation.
Section A of Annex I lists Regulation (EU) 2017/745 on medical devices as point 11 and Regulation (EU) 2017/746 on in vitro diagnostic medical devices as point 12; Regulation (EU) 2026/1744 deleted point 1 of Section A and left both in place.
Under Article 6(1c), as inserted by that act, a product required to undergo third-party conformity assessment solely due to risks other than risks to health and safety does not fulfil the second condition.
Under Article 43(3), as replaced, the provider follows the conformity assessment procedure of the device regulation, the Chapter III, Section 2 requirements are part of that assessment, and the Article 17 quality management system is assessed too.
Chapter III, Sections 1, 2 and 3, with the exception of Article 6(5), apply to these systems from 2 August 2028 (Article 113, third paragraph, point (c)(ii), as amended).
Article 2(13), as added, allows specific requirements or obligations in Articles 9 to 15 and 17 to 25 to be limited for Article 6(1) systems where the Section A act gives an equivalent or higher level of protection and the overall level of protection is not reduced; the Commission is to specify which by delegated acts by 2 August 2027, so the scope is not yet known.
Separately, Annex III catches point 5(a), eligibility for essential public assistance benefits and services, including healthcare services, when the system is used by or on behalf of public authorities; point 5(c), risk assessment and pricing for natural persons in life and health insurance; and point 5(d), evaluating and classifying emergency calls, dispatching emergency first response services or prioritising their dispatch, and emergency healthcare patient triage systems.
Those apply from 2 December 2027 (Article 113, third paragraph, point (c)(i), as amended).

Which questions and audits do they send?

Is the AI a medical device, or a safety component of one, and does Regulation (EU) 2017/745 or 2017/746 require a notified body for it?
Which route makes it high-risk, Article 6(1) or Annex III, and from which date?
How are the AI Act requirements covered in your device conformity assessment (Article 43(3))?
What do your instructions for use say about accuracy and about performance for specific groups of patients (Article 13(3), point (b))?
Can a clinician disregard, override or reverse the output (Article 14(4), point (d))?
Do you process special categories of personal data to detect bias, and on what basis (Article 4a)?
Does your patient-facing assistant tell people they are interacting with AI (Article 50(1))?
Which serious incidents would you report, and how fast (Article 73)?

What does Complipath do for you?

A register of your AI systems, each classified by fixed rules with the article behind it, and confirmed by you.
Requirements per system, each with an owner, a status and a date.
An evidence library, and Annex IV documentation part by part.
Customer questionnaires answered in the customer's own Excel, Word or PDF, each answer with its source; what it cannot answer is marked "needs your answer" (Starter and up).
GDPR basics and DPIA/FRIA applicability per system on every plan; DPIA and FRIA documents on Growth.
An audit room, an audit report in PDF or Word and an audit pack (Starter and up); on Growth, the audit room shared with your customer.
A Trust Center (Growth and up): files a customer requests go out only after your yes, on a seven-day link.

What one system looks like, as an example

Example · a fictional system, not a customer
AI system	What it does	Risk class	Article	What it owes
Wound Image Reader	Analyses photographs of wounds and suggests a healing stage to clinicians, sold as software that is itself a medical device.	High risk	Article 6(1); Section A, point 11, of Annex I	High-risk only if Regulation (EU) 2017/745 requires third-party conformity assessment for the device. If it does, the AI Act requirements are assessed within that procedure (Article 43(3), as replaced) and the Chapter III obligations apply from 2 August 2028 (Article 113, third paragraph, point (c)(ii), as amended).

A questionnaire already waiting?

Questionnaire waiting? We answer it in 48 working hours.

Starter

€499 a month

or €4,990 a year. Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
The Free plan is for one AI system and one user, with no end date

Get my risk classes, free

All plans

Questions

Is AI in a medical device high-risk under the EU AI Act?

When both Article 6(1) conditions hold: the AI is a safety component of, or itself, a device covered by Regulation (EU) 2017/745 or Regulation (EU) 2017/746, both listed in Section A of Annex I, and that device must undergo third-party conformity assessment under that regulation. The device regulation, not the AI Act, decides which devices need it.

When do the obligations apply to medical-device AI?

From 2 August 2028 for AI systems classified as high-risk pursuant to Article 6(1) and Annex I (Article 113, third paragraph, point (c)(ii), as amended by Regulation (EU) 2026/1744). Annex III uses such as emergency patient triage apply from 2 December 2027 under point (c)(i), and Article 50 disclosure already applies.

Do we need a separate AI Act conformity assessment for a device?

Not a separate procedure. Under Article 43(3), as replaced by Regulation (EU) 2026/1744, the provider follows the conformity assessment procedure the device regulation requires. The Chapter III, Section 2 requirements are part of that assessment, and the Article 17 quality management system is assessed too, together with the Annex VII points the paragraph names.

Does a patient-facing chatbot have to say it is AI?

As a rule, yes. Article 50(1) requires providers to design AI systems intended to interact directly with natural persons so that those persons are informed, unless that is obvious to a reasonably well-informed, observant and circumspect person. It already applies (Article 113, second paragraph); whether the chatbot is also a medical device is a separate question.