A hospital buys cloud software that reads head CT scans and moves cases with a suspected bleed to the top of the radiologist’s worklist. The radiologist still reads the scan. After an update, the tool misses a case and the report is delayed. The same tool raises different regulatory questions in the EU, Great Britain, Northern Ireland and the United States. If a patient is harmed, the team also needs to establish where the delay occurred and whether it contributed to the injury.
How each market treats the same tool
| Market | First question for this CT tool |
|---|---|
| European Union | What is its class under the Medical Devices Regulation? If the AI is itself a device or a safety component of one, and the product requires third-party conformity assessment, it also meets the AI Act’s Annex I high-risk test. |
| Great Britain | Which route under the UK Medical Devices Regulations 2002 covers the exact function and intended use? Check the relevant UKCA or accepted CE route, and the MHRA registration. |
| United States | What FDA device pathway covers the function and intended use? A tool that analyses CT images falls outside the statutory exclusion for certain clinical decision support functions, even with radiologist review. |
In Northern Ireland, EU medical device rules already apply. Its planned application of the AI Act under the Windsor Framework is narrower than in the EU. The same standalone CT tool can therefore be a medical device in Northern Ireland without falling within the planned local AI Act scope. EU AI Act, Articles 2 and 6 and Annex I, MHRA guidance on regulating medical devices in the UK, FDA clinical decision support guidance, UK guidance on partial AI Act application in Northern Ireland
The EU device rules and AI Act run on different timelines
The Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR) already govern software with the relevant intended medical purpose. For the CT tool, the MDR is the starting point. Under its Rule 11, software intended to inform diagnostic or therapeutic decisions is generally Class IIa, rising to IIb or III depending on the possible consequences of those decisions. Those classes require notified-body involvement. Software with an intended in vitro diagnostic purpose follows the IVDR and its own classification rules. EU MDR, Article 52 and Annex VIII, EU IVDR
The enacted Digital Omnibus entered into force on 27 July 2026. It moved the application of the main AI Act high-risk provisions to 2 August 2028 for Article 6(1) and Annex I products. The date for Article 6(2) and Annex III systems is 2 December 2027. Annex III separately lists uses such as emergency healthcare patient triage. A system that assigns priority to patients arriving at an emergency department calls for that separate analysis. A tool that reorders scans should be assessed on what it actually does and how its manufacturer intends it to be used. Digital Omnibus on AI, Regulation (EU) 2026/1744, EU AI Act, Article 113 and Annex III
Where the high-risk requirements apply, AI providers should plan for requirements on risk management, data governance, logging and human oversight. Healthcare organisations deploying the system must follow the instructions for use and assign oversight to people with appropriate competence, training and authority. The Omnibus allows specific overlapping obligations to be limited by delegated acts where other EU rules provide equivalent or stronger protection. The separate proposal to revise the MDR and IVDR remains in the legislative process. EU AI Act, Articles 2, 9–15 and 26, European Parliament tracker for the MDR and IVDR proposal
What changes in the UK and US
In Great Britain, check the device’s intended purpose, conformity route and MHRA registration. The UK government confirmed in October 2026 that it intends to recognise eligible CE-marked devices indefinitely. Check the current route and any transition conditions while that policy is implemented. In Northern Ireland, check the EU MDR or IVDR route. The UK government has scheduled limited AI Act application under Windsor from 10 November 2026, with phased duties for placing physical products with closely integrated AI on the market. MHRA guidance on regulating medical devices in the UK, MHRA on CE recognition in Great Britain, UK government guidance on the AI Act in Northern Ireland
In the US, the FDA’s 29 January 2026 final guidance applies the clinical decision support exclusion to individual software functions. It can cover a function that uses clinical information to provide recommendations to a healthcare professional who can independently review the basis, if all statutory criteria are met. Analysing the CT image fails the image and signal criterion. Check the actual FDA record for the marketed function and intended use. Depending on the device, its pathway may be 510(k) clearance, De Novo classification or premarket approval. FDA final guidance on clinical decision support, FDA on AI-enabled devices and marketing pathways
If a missed case causes harm
Did the software process the scan and produce the intended output? Did the integration deliver it to the worklist? What did the reporting team see, and when? The version, timestamps and fallback arrangements can help distinguish a product defect from a problem in deployment or care. NHS Resolution guidance on AI and clinical negligence
The EU’s revised Product Liability Directive expressly includes software, including commercially supplied AI, in its framework for harm caused by defective products. It provides for evidence disclosure and rebuttable presumptions in specified cases, including certain cases where technical complexity makes proof excessively difficult. Clinical negligence remains a separate route under Member State law. EU Member States must transpose the directive by 9 December 2026. It covers products placed on the market or put into service after 9 December 2026. UK guidance says the directive will also cover relevant products placed on the market or put into service in Northern Ireland after that date. EU Product Liability Directive, Articles 2, 4, 9–10 and 21–22, UK guidance on Northern Ireland product liability
In Great Britain, the Consumer Protection Act 1987 provides the existing statutory route for defective products. The Law Commission has proposed expressly including software and AI. In the US, malpractice and product claims generally arise under state law. Federal law can pre-empt certain state claims that would impose different or additional safety requirements on a device with FDA premarket approval. The effect depends on the FDA pathway and the claim. Consumer Protection Act 1987, Law Commission consultation, California Judicial Council civil jury instructions, Nos. 500–501, US Supreme Court, Riegel v. Medtronic
What to ask the supplier before deployment
Ask for the market-specific paperwork for the exact version and use, then run an end-to-end test with the radiology team. Check that an urgent flag reaches the right worklist, that staff can tell when processing fails, and that someone owns the fallback. Agree who will repeat the test after an update and who can retrieve the relevant logs if a case is delayed. NHS Resolution guidance on oversight, records and contracts