The European Commission’s proposed Health Innovation Package would retain the high-risk classification of artificial intelligence–enabled medical devices while removing most associated safeguards provided for under the European Union’s Artificial Intelligence Act, according to a narrative review published in BMJ Digital Health & AI. 

The review examined European Union (EU) legislation, policy proposals, regulatory guidance, and academic literature concerning artificial intelligence (AI) in medical devices. The authors focused on the Health Innovation Package and related developments under the Commission’s regulatory simplification agenda. 

“It would be more prudent to simplify existing procedures and administrative processes while preserving important safeguards that already exist for high-risk AI systems,” wrote lead author Hannah Van Kolfschooten, PhD, of the Center for Life Sciences Law at the University of Basel in Switzerland, and colleagues. 

Although the proposal concerns EU regulation, its implications for AI oversight raise broader questions for US clinicians using AI-enabled tools for diagnosis, risk prediction, and treatment decisions, according to Vishnu Priya Pulipati, MD, FACE, FNLA, deputy editor of AACE Endocrine AI.  

Commenting on the review, Dr. Pulipati said that a high-risk designation for medical AI should reflect meaningful patient protection, not merely a regulatory label. “Real-world validation, continuous monitoring, and meaningful human oversight remain essential to patient safety.”  

High-risk classification, fewer obligations 

The review authors explained that the Artificial Intelligence Act (AI Act) complements the Medical Devices Regulation and the In Vitro Diagnostic Medical Devices Regulation by addressing risks associated with AI across development, deployment, and clinical use. These safeguards include requirements for data governance, risk management, transparency, human oversight, and postmarket monitoring. 

The Health Innovation Package, proposed in December 2025, would move AI-enabled medical devices from Section A to Section B of Annex I of the AI Act. According to the review authors, that change would preserve their high-risk classification but exclude them from most of the act’s substantive high-risk requirements. The remaining provisions would largely concern procedural matters rather than substantive obligations governing the development and deployment of AI systems. 

The proposal would also remove AI Act obligations for organizations deploying these systems, including health care institutions integrating them into clinical workflows. The authors identified this narrowing of responsibility as a concern distinct from changes to manufacturers’ requirements. 

The authors also noted that the AI Act explicitly addresses risks to fundamental rights, including risks relating to nondiscrimination, privacy, and access to health care, extending beyond the primary focus of medical device requirements on safety and performance. 

Although the Commission framed the proposal as a response to regulatory overlap, the authors noted that the AI Act already integrates its requirements into existing medical device conformity assessments and permits a single set of technical documentation. They attributed many administrative burdens to medical device regulation itself, including stricter clinical evidence requirements, limited assessment capacity, and complex procedures. 

Implications for clinical use 

Under the AI Act framework described in the review, deployers of high-risk AI systems have obligations concerning the use of systems in accordance with instructions, the assignment of human oversight, input-data quality control, monitoring, log retention, and incident reporting. The authors noted that the deployer is often the health care institution using the system, rather than an individual physician. 

The authors identified training, performance monitoring, and mechanisms to detect and respond to errors as necessary organizational measures. Without these, they cautioned, physicians could rely excessively on automated outputs or fail to detect system errors. 

Removing these AI Act-specific obligations would leave responsibility for these aspects of clinical use primarily to other applicable legal frameworks, including national health law and professional standards, potentially producing uneven oversight across EU member states, the authors wrote. 

They also distinguished technical bias from risks arising during deployment. Unrepresentative training data can affect diagnostic accuracy or risk prediction across patient groups, while differences in access, digital literacy, and health care infrastructure can influence how systems function in practice. 

The authors cautioned that serious-incident reporting under medical device legislation is largely reactive and limited to safety events. Gradual harms, including biased performance across patient groups, could remain undetected without obligations to record AI use and monitor outcomes. 

Accountability was another concern. Citing a World Health Organization Regional Office for Europe report on AI readiness, the review noted that 86% of responding states identified legal uncertainty as a constraint on AI adoption in health care. The authors wrote that retaining a high-risk label while removing associated duties could further obscure what compliance requires and who bears responsibility when harm occurs. 

A separate compromise and an uncertain path

The review distinguished the pending Health Innovation Package from the separate Digital Omnibus compromise reached in July 2026. As described by the authors, the latter retained AI-enabled medical devices within Section A of Annex I of the AI Act while allowing the application of specific obligations to be limited through delegated acts where relevant EU sectoral legislation provides equivalent or greater protection for health, safety and fundamental rights. Those limitations must preserve the overall protection guaranteed by the AI Act. 

At the time of writing, the Health Innovation Package remained before the European Parliament and Council. Its eventual approach was uncertain, as was the future classification of AI-enabled software under parallel medical device reforms. 

The authors favored simplifying documentation, submissions, and coordination while preserving substantive safeguards. They supported retaining AI-enabled medical devices within the AI Act’s high-risk framework, with targeted adjustments to specific obligations only where medical device legislation provides an equivalent or higher level of protection. They also questioned whether a shift toward manufacturer-focused regulation would adequately preserve fundamental-rights safeguards and obligations for health care institutions deploying AI. 

“A high-risk label that no longer carries high-risk duties is not a simplified version of the original regulation. It is a different regulation altogether,” wrote Dr. Van Kolfschooten, and colleagues.   

The authors declared no competing interests.