Our Expert in Austria

GOLD

Sabine Alvarez Privado

GOLD

AI Act vs MDR in Austria (2026): Which Rules Apply to Healthcare AI and What Procurement Teams Must Do

By Global Law Experts

– posted 1 hour ago

AI Act vs MDR Austria is the question every contracting authority, hospital procurement team and health-technology supplier now has to answer before a single tender is issued. The quick decision rule is this: if a product has an intended medical purpose, diagnosis, prevention, monitoring or treatment, the Medical Device Regulation (MDR, Regulation (EU) 2017/745) governs its market access, while the EU AI Act (Regulation (EU) 2024/1689) governs the product as an “AI system”, with its heaviest obligations reserved for high-risk use cases such as clinical decision support. In most real-world healthcare deployments both regimes apply at once, and that is where Austrian procurement teams get caught out.

This 2026 guide takes a clear position, gives you a dimension-by-dimension comparison table, a procurement checklist and a decision framework so you can act rather than deliberate.

Regulatory scope and applicability: AI Act vs MDR Austria at a glance

The starting point for any analysis of AI Act vs MDR Austria is to separate two different legal tests. The MDR asks a product question: does this thing have an intended medical purpose? The AI Act asks a technology-and-risk question: is this an AI system, and if so, is it high-risk? These two tests are independent. A product can pass one, the other, or both, and procurement obligations flow differently in each case.

MDR, when it applies

The MDR applies to any product with an “intended medical purpose” as defined in Regulation (EU) 2017/745. That intended purpose is set by the manufacturer through labelling, instructions for use and promotional claims, but it can also be driven by how your clinical team actually deploys the tool. The definition of “medical device” expressly captures software, and under the MDR’s classification rules (notably Rule 11 for software that provides information used to take decisions for diagnostic or therapeutic purposes) a great deal of clinical software sits in a higher risk class than suppliers initially assume.

Typical examples that fall squarely within the MDR include diagnostic software that interprets symptoms, triage systems that prioritise patients, and image-analysis tools that flag suspected pathology on radiology scans where a medical claim is attached. If a vendor markets any of these with a clinical benefit, treat the product as a medical device first and require full MDR conformity evidence. The intended-purpose test is the single most important filter in the entire AI Act vs MDR Austria decision, because once it is met, MDR market-access obligations are non-negotiable.

EU AI Act, when it applies

The EU AI Act applies to “AI systems” as defined in the Act and operates on a risk-based structure that distinguishes prohibited AI, high-risk AI and lower-risk AI. For healthcare, the critical category is high-risk. Under Article 6 of the AI Act, an AI system that is a safety component of a product already subject to third-party conformity assessment under EU harmonisation legislation, which includes MDR medical devices, is generally treated as high-risk, and high-risk status pulls in the Act’s most demanding obligations: a risk-management system, data governance and dataset documentation, technical documentation, logging, transparency, human oversight by design and post-market monitoring (European Commission, EU approach on Artificial Intelligence; Council of the EU, EU Artificial Intelligence Act).

Crucially, where a product is already a medical device requiring third-party conformity assessment under the MDR, the AI Act dovetails with that sectoral regime rather than duplicating the entire process. But the AI Act still adds AI-specific requirements, particularly around training data, bias and transparency, that the MDR does not prescribe. For procurement teams in Austria, that means a high-risk AI medical device generates two overlapping evidence sets, not one.

Overlap and interaction, when both could apply

When both regimes could apply, test for MDR “medical purpose” first. The MDR is the sectoral safety regime, so if it bites, market-access conformity follows the MDR route. The AI Act then layers additional obligations, data governance, transparency, human oversight and model-change management, on top. The practical position for Austrian procurement is unambiguous: build a dual-compliance workflow, demand both sets of evidence, and do not let a supplier treat AI Act conformity as a substitute for MDR clinical evaluation, or vice versa. Treat any legal interpretation here as general guidance and confirm device-specific classification with counsel.

Side-by-side comparison: AI Act vs MDR Austria dimension by dimension

The table below is the centrepiece of this AI Act vs MDR Austria analysis. It compares the two regimes across the dimensions that actually matter to a tender, scope, conformity, evidence, post-market duties and enforcement, so you can see at a glance which obligations attach to a given product and where they overlap.

Dimension	EU AI Act, Reg. (EU) 2024/1689	Medical Device Regulation (MDR), Reg. (EU) 2017/745
Scope / trigger	Applies to “AI systems”; distinguishes prohibited, high-risk and other AI. AI that is a safety component of an MDR device requiring third-party assessment is generally high-risk.	Applies to products with an “intended medical purpose” (diagnosis, prevention, monitoring, treatment). Software with medical claims is a device.
Primary legal nature	Horizontal EU regulation on risk, transparency, data governance and human oversight for AI.	Sectoral EU regulation on safety, performance, clinical evaluation and conformity for medical devices.
Classification test	Risk-based; high-risk obligations attach under Article 6 and Annex III, including AI in regulated products.	Intended purpose plus software rules (Rule 11 and others). Class I–III governs conformity route.
Pre-market conformity	High-risk AI: mandatory conformity procedures, risk-management system, technical documentation; assessment may be integrated with the applicable sectoral procedure.	CE conformity: class-based, Notified Body for classes above I, clinical evaluation and performance evidence required.
Notified Body / third party	For high-risk AI embedded in MDR devices, conformity is generally assessed through the MDR Notified Body procedure.	Notified Body required for class IIa/IIb/III devices and certain software.
Technical documentation	Focused on risk management, training data, performance, human oversight and post-market monitoring.	Comprehensive technical file: design, manufacturing, clinical evaluation, risk management, labelling, IFU, PMS plan.
Clinical / safety evidence	Performance evaluation and monitoring; does not substitute clinical evaluation where the purpose is medical.	Clinical evaluation (literature, clinical investigations), proportional to risk class.
Labelling & user information	Transparency obligations and human-oversight information for certain AI systems.	Detailed labelling and instructions-for-use obligations, clinical instructions and safety warnings.
Post-market surveillance	Post-market monitoring and serious-incident reporting on AI performance; model updates must be managed.	Formal PMS and vigilance reporting, PSURs for higher classes, corrective actions, recalls.
Data governance & training data	Requirements for datasets, data governance, bias assessment and documentation for high-risk AI.	Clinical data supporting performance and safety; less prescriptive on ML training-data specifics.
Transparency & human oversight	Specific transparency and human-oversight-by-design obligations for high-risk AI.	Safety-related user information and instructions; no AI-specific transparency rules.
Liability implications	Strengthens governance; does not replace product-liability rules; affects conformity evidence and standards of care.	Interacts with product liability; established framework for defective devices; contractual allocation is critical.
Enforcement authorities	Market surveillance across Member States; AI Office and AI Board coordination at EU level; national enforcement and administrative fines.	National competent authorities enforce (market surveillance, device safety); can withdraw devices and issue penalties.
Timing / transitional rules	Obligations phased in; prohibitions and AI-literacy duties applied from 2 February 2025; high-risk obligations apply on a later staggered timeline, check current scope and national implementation.	In force; devices must comply with MDR CE rules; transitional provisions under strict conditions.
Practical takeaway	If it is a high-risk AI system, expect AI Act obligations in addition to MDR where the device falls under MDR.	If it has an intended medical purpose, MDR conformity is mandatory for market access, prioritise that evidence.

Three procurement implications follow directly from the table:

Intended purpose decides first. If the product has an intended medical purpose, treat it as a medical device and require MDR conformity before anything else.
High-risk AI adds a second evidence layer. If the system is an AI system, and especially a high-risk one, demand AI Act artefacts (risk management, dataset documentation, transparency) in the tender.
Both regimes usually apply together. Most clinical AI is dual-regulated; demand both MDR and AI Act evidence and allocate the responsibilities contractually.

Conformity assessment and pre-market obligations

Understanding the conformity routes is essential before you can score an offer, because the AI Act vs MDR Austria evidence burden differs sharply between a low-risk tool and a high-risk clinical device.

MDR conformity path

The MDR conformity path is driven by device class. Class I devices can, in many cases, be self-declared by the manufacturer, who issues a Declaration of Conformity and affixes the CE mark. For classes IIa, IIb and III, a Notified Body must be involved in the conformity assessment, reviewing the technical file and, depending on class, auditing the quality management system. Across every class, the MDR requires a clinical evaluation, a structured appraisal of clinical data from literature, equivalent devices or dedicated clinical investigations, with the depth of evidence rising in proportion to the risk class (Regulation (EU) 2017/745).

Much AI-enabled diagnostic and decision-support software falls under Rule 11 into class IIa or higher, which means a Notified Body certificate and a substantive clinical evaluation are the baseline, not the exception. Procurement teams should therefore expect, and insist on, Notified Body certificates for anything above class I.

AI Act risk management for high-risk AI systems

For high-risk AI systems, the AI Act imposes requirements that run alongside the MDR. The core obligations include an operating risk-management system across the lifecycle, data governance covering the quality and representativeness of training, validation and test datasets, detailed technical documentation, record-keeping and logging, transparency toward users, human oversight designed into the system, and post-market monitoring of performance (European Commission, EU approach on Artificial Intelligence). Where a device already undergoes MDR third-party conformity assessment, the AI Act is designed to integrate with that process rather than duplicate it, but the AI-specific dataset, bias and transparency documentation remains additional to anything the MDR demands.

Evidence layers procurement must require

Across both regimes, require four evidence layers at pre-award: technical documentation, clinical and performance evidence, risk assessments (MDR risk management plus AI Act risk management), and explicit training-data and data-governance statements for any AI component.

Procurement checks and tender requirements in Austria

This is where the AI Act vs MDR Austria question becomes operational. Austrian contracting authorities act under the Federal Public Procurement Act 2018 (Bundesvergabegesetz 2018, BVergG 2018), which implements the EU procurement directives (Directive 2014/24/EU; RIS). Those rules allow you to set technical specifications, selection criteria and award criteria, and to require conformity evidence such as certificates and declarations. Use that latitude deliberately: regulatory compliance should be baked into mandatory technical specifications and pass/fail selection criteria, not left as an afterthought in the contract.

Pre-award due diligence should establish, for each product, whether MDR applies, whether the AI Act applies, and whether both apply. Run your decision flowchart per device before the tender is drafted, then translate the outcome into mandatory documentation requirements. The table below sets out the must-have documents to demand from suppliers.

Document	Regime	Why procurement needs it
MDR Declaration of Conformity	MDR	Confirms the manufacturer’s self-certified or assessed conformity and CE marking.
Notified Body certificate	MDR	Required for class IIa/IIb/III devices and certain software; proves third-party assessment.
Technical documentation summary	MDR + AI Act	Evidences design, risk management and performance for both regimes.
Clinical evaluation summary	MDR	Demonstrates clinical safety and performance proportional to risk class.
AI risk-management file	AI Act	Shows lifecycle risk management for a high-risk AI system.
Dataset / training-data statement	AI Act	Evidences data governance, representativeness and bias assessment.
Post-market surveillance plan	MDR + AI Act	Covers vigilance reporting, incident handling and model-update monitoring.
Cybersecurity evidence	MDR + AI Act	Demonstrates resilience, logging and security-by-design.
Data protection DPIA	GDPR	Required where health data processing is likely to result in a high risk (Art. 35 GDPR; EDPB guidance).
Insurance / liability proof	Contractual	Confirms financial backing for defect and recall liability.

How to evaluate dual-regulated offers

For dual-regulated offers, split your evaluation into a mandatory compliance gate and a qualitative score. Treat MDR conformity evidence (Declaration of Conformity, Notified Body certificate where applicable, clinical evaluation) as a pass/fail minimum: an offer lacking it for a device that plainly has a medical purpose cannot be compliant. Then score AI Act maturity, quality of the risk-management file, dataset documentation, transparency and update governance, as weighted award criteria. This keeps you within Directive 2014/24/EU and the BVergG 2018 while rewarding genuinely compliant, well-documented suppliers.

Sample procurement language

Use clear, demand-led tender clauses. Examples (template language, not legal advice):

“The tenderer shall provide a valid MDR Declaration of Conformity and, where the device is class IIa or above, the relevant Notified Body certificate. Offers failing to supply these for a product with an intended medical purpose will be rejected as non-compliant.”
“Where the system constitutes a high-risk AI system, the tenderer shall provide its AI risk-management file, dataset governance statement and documentation of human-oversight measures.”
“The tenderer shall submit a post-market surveillance plan covering vigilance reporting and the management of model updates and retraining.”

Liability, warranties and contractual allocation

Regulatory compliance decides market access; the contract decides who pays when something goes wrong. In the AI Act vs MDR Austria context, allocating that risk precisely is the difference between a clean procurement and a dispute.

Who bears regulatory responsibility and liability

Under the MDR, the manufacturer carries the primary regulatory burden, conformity, clinical evidence, technical documentation and vigilance, and remains the principal party liable for a defective device under established product-liability law (in Austria, the Produkthaftungsgesetz, implementing the EU product-liability regime). Importers and distributors carry defined verification and traceability duties. The AI Act strengthens governance obligations on providers of high-risk AI systems but does not replace product-liability rules; rather, its conformity evidence and standards feed into the broader liability picture. For a public buyer, the key point is that regulatory responsibility sits with the manufacturer, so your contract must verify those manufacturer obligations and then allocate residual commercial risk.

Contract clauses for allocation of conformity, recalls, updates and audit rights

Build the following into the contract (sample clause bullets, template language, confirm with counsel):

Conformity warranty. The supplier warrants continuing MDR conformity and, where applicable, AI Act compliance for the contract term, and will notify the authority of any change affecting conformity.
Recall and corrective action. The supplier bears the cost of recalls, field safety corrective actions and remediation arising from non-conformity or defect.
Updates and model-change governance. Material model changes or retraining require prior notice, revalidation and documentation; the supplier confirms that updates do not invalidate conformity.
Indemnity. The supplier indemnifies the authority against third-party claims, including patient-harm claims, arising from defect or non-conformity.
Audit rights. The authority may audit, or appoint an auditor to review, conformity documentation, dataset governance and post-market records.

Insurance and financial remedies for public contracts in Austria

Require evidence of adequate product-liability insurance sized to the clinical risk, and reinforce it with financial remedies available under Austrian public contracts, performance guarantees, retention or liquidated damages for conformity failures, so that remedies do not depend solely on the supplier’s solvency.

Timing, enforcement and penalties

Timelines diverge between the regimes. The MDR is in force, so a device with a medical purpose needs valid CE conformity now; clinical evaluation and Notified Body assessment can take many months, and transitional provisions apply only under strict conditions.

The AI Act’s obligations are phased: prohibitions on certain AI practices and AI-literacy duties applied from 2 February 2025, obligations for general-purpose AI models from 2 August 2025, and the main high-risk obligations following on a later staggered timeline, with those tied to products subject to existing EU harmonisation legislation (such as MDR devices) applying from 2 August 2027 (European Commission; Council of the EU), so build AI Act compliance into a programme rather than expecting instant readiness, and confirm the exact dates applicable to your product.

Enforcement is shared: in Austria, the Federal Office for Safety in Health Care (Bundesamt für Sicherheit im Gesundheitswesen, BASG), operated by AGES Medizinmarktaufsicht, handles medical-device market surveillance and vigilance, with powers to withdraw devices and impose penalties, while AI Act enforcement relies on designated national market-surveillance authorities coordinated by the EU-level AI Office and AI Board, backed by administrative fines. For suppliers, non-compliance risks more than fines, it can mean suspension, exclusion from award, or termination of a public contract.

Practical procurement checklist

Use this checklist to operationalise the AI Act vs MDR Austria analysis across the procurement lifecycle.

Pre-award, Clinical/Procurement: Classify each product: does it have an intended medical purpose? Run the decision flowchart.
Pre-award, Legal: Determine whether the AI Act applies and whether the system is high-risk.
Pre-award, Procurement: Add mandatory MDR and AI Act documentation to the technical specifications.
Pre-award, Legal/Clinical: Require Declaration of Conformity, Notified Body certificate (where applicable) and clinical evaluation summary.
Pre-award, IT/Security: Require cybersecurity evidence and dataset/training-data statements.
Pre-award, Legal (DPO): Require a DPIA for health-data processing.
Award, Procurement: Apply a mandatory MDR compliance gate (pass/fail) before qualitative scoring.
Award, Procurement/Legal: Score AI Act maturity (risk file, data governance, transparency) as weighted award criteria.
Award, Legal: Verify certificates against issuing Notified Bodies and confirm validity.
Post-award, Legal: Embed conformity warranty, recall, indemnity and audit clauses.
Post-award, IT/Clinical: Agree model-update and revalidation governance.
Post-award, Clinical/Procurement: Confirm the post-market surveillance and incident-reporting plan and name responsible contacts.
Post-award, Finance/Legal: Confirm insurance, performance guarantees and financial remedies.

Decision framework: choosing between AI Act and MDR in Austria

Here is the decision framework, this is the recommendation, not a hedge. Apply it product by product.

Choose MDR (treat as a medical device) when:

The supplier markets the product with an intended medical purpose, or your clinical team intends to use it that way; or
The software meets MDR classification rules (for example, Rule 11 for decision-driving software).
Procurement action: require the MDR Declaration of Conformity, Notified Body certificates where applicable, the clinical evaluation summary and full technical documentation.

Apply AI Act compliance as a procurement filter when:

The system is an AI system under the AI Act and falls within a high-risk category (for example, AI that is a safety component of a regulated medical device, or clinical decision support, triage and automated diagnostics); or
The AI processes personal data and raises bias or undue-risk concerns.
Procurement action: require the AI risk-management file, dataset statement, transparency and human-oversight documentation and AI Act conformity artefacts.

Treat as dual-regulated (both) when:

The product is a medical device under the MDR and contains AI functions meeting the AI Act definition, in practice, the common case.
Procurement action: demand MDR conformity as a minimum and add explicit contractual AI Act requirements, model-change governance, transparency, audit rights, or a documented compliance plan with timelines.

Immediate next steps: within 0–30 days, update tender templates to include mandatory MDR and AI Act artefacts and run the decision flowchart per device. Within 30–90 days, issue pre-qualification questionnaires requesting the specific documents and obtain legal review of high-risk candidates. Within 90–180 days, lock contractual obligations for updates, incident reporting and audits into awarded contracts and budget for post-market surveillance.

Need Legal Advice?

This article was produced by Global Law Experts. For specialist advice on this topic, contact Sabine Alvarez Privado at APS-LAW, a member of the Global Law Experts network.

Further resources and next steps

Resolving AI Act vs MDR Austria questions is a per-product, per-tender exercise, and the cost of getting classification wrong falls on the contracting authority. The practical message is consistent: test for medical purpose first, require both evidence sets where AI meets device, and allocate conformity, update and liability risk explicitly in the contract. Treat the legal interpretations here as general guidance and confirm device-specific classification with qualified counsel.

Sources

FAQs

Does the AI Act replace the MDR for AI-enabled medical devices?

No. The MDR remains the primary safety regime for any product with an intended medical purpose. Where both apply, contracting authorities must ensure suppliers meet MDR conformity and also provide AI Act artefacts, risk management and dataset statements, where the AI Act imposes obligations.

How can a procurement team quickly resolve the AI Act vs MDR Austria question for a given product?

Start with intended purpose. If the vendor markets the software for diagnosis, therapy or clinical decision support, the MDR likely applies. Then check whether the system is an AI system and whether it is high-risk under the AI Act. Require supplier declarations and documentation at pre-qualification so the classification is evidenced, not assumed.

What minimal documents should I ask for in the tender?

The MDR Declaration of Conformity, a Notified Body certificate where applicable, a technical documentation summary, a clinical evaluation summary, the AI risk-management plan, a dataset statement, a post-market surveillance plan, cybersecurity evidence, a data protection DPIA and proof of insurance.

Who is liable if an AI medical device causes patient harm?

The manufacturer remains primarily responsible under the MDR and product-liability law. Contracts should address indemnities, recall costs and responsibility for updates. Public buyers must verify manufacturer obligations and documentation before award.

Do I have to reject suppliers that do not yet comply with the AI Act?

Not automatically. Where AI Act compliance is already required for the product in question, for example, for a high-risk AI system whose obligations have become applicable, set it as a mandatory requirement and refuse offers lacking the required artefacts. For products still within a transitional period or transitioning to compliance, you may include remediation timelines and conditional award clauses rather than excluding the supplier outright.