As a few, particularly committed commentators (and of course people who work in the field) have noticed, the Digital Omnibus that the European Commission presented on November 19 is not all there is to simplifying the EU AI Act. It isn’t, because another Directorate-General of the Commission, DG SANTE, came up this week with its own Health package, that among other things also amends the AI Act.
What it basically does is it moves the Medical Devices and In Vitro Diagnostics Regulations from Annex I A to Annex I B of the AI Act. This would entail that, instead of having the requirements of the AI Act apply directly to the sector in August 2027 (pending whatever is decided on the AI Act Omnibus), the Commission would intervene directly in those two sectoral regulations to incorporate AI-related provisions (unclear how extensive). Just as is the case for autonomous vehicles, planes, trains.
It would seem a minor, innocuous amendment, barely noticeable even for many experts and practitioners working on AI. Yet, it creates a dangerous precedent, while also weakening the logic of the AI Act. It has been flagged by a couple of sectoral experts and journalists so far, but I am writing this to further spread awareness on the problems it might create.
To recapitulate, Annex I A of the Act lists all the new legislative framework legislation that falls within the scope of the AI Act (i.e. when embedding AI as a safety component or being an AI system itself): lifts, machinery, connected devices, toys, medical devices, and so on. To these, the whole set of requirements of the AI Act directly apply, although with some flexibility to integrate them into similar existing requirements in that sectoral legislation.
What does this mean in practice? A medical device embedding an AI system (for robotics, diagnostics, immagery etc.) already has to have a quality management system (QMS) because of the Medical Devices Regulation. Since the AI Act also introduces it as its own obligation (for the AI component), then the medical devices provider would in theory have two QMS in place, one for the device, and one for the AI component. The AI Act acknowledges this problem and provides for the possibility to just embed the AI “layer” into the existing QMS (Article 17, paragraph 3). This is just an example. More generally, the AI Act also allows for a certain flexibility to integrate potentially duplicating requirements into the existing sectoral law (again, lifts, machinery, toys etc.). It does so in Article 8 paragraph 2, very important for the EPP and the liberals in particular, but fair for anybody just wanting this to be an efficient, not overly burdensome framework. The crux of this is in its second sentence:
“In ensuring the compliance of high-risk AI systems referred to in paragraph 1 with the requirements set out in this Section, and in order to ensure consistency, avoid duplication and minimise additional burdens, providers shall have a choice of integrating, as appropriate, the necessary testing and reporting processes, information and documentation they provide with regard to their product into documentation and procedures that already exist and are required under the Union harmonisation legislation listed in Section A of Annex I”.
It is important to note that this very paragraph was written with the med-tech industry in mind in the first place, because we all knew how strictly regulated the sector (rightly) is, and how adding anything on top of it would complicate an already very complex regulatory framework, that has been heavily debated over the past few years, with calls for simplification even coming from the European Parliament itself. It is also why the Parliament itself requested during the last AI Act trilogue to set the application date for Annex I the farthest possible, i.e. August 2027, precisely having medical devices in mind.
This solution has also been acknowledged by this document on the interplay between the AI Act and the Medical Devices Regulation by the Joint Artificial Intelligence Board and Medical Device Coordination Group just last June.
The document also reiterates something important: the AI Act leaves the sectoral enforcement and conformity assessment procedures untouched (i.e. medical devices with AI would still follow the Medical Devices Regulation procedures), precisely to keep the current system in place and to avoid introducing further complexities.
A few reasons why this amendment is problematic (preliminary):
In drafting the AI Act, as well as throughout the entire negotiating process, the Commission was always very careful to keep legislation from the New Legislative Framework (NLF) (Annex IA) separate from the Old Approach (Annex IB). Essentially, whereas the Old Approach legislation details the technical requirements directly in the legal text, the NLF provides high level requirements and then relies on harmonised standards for the operational details. Moving two NLF regulations in the Old Approach list is in and of itself legally questionable, mixing their respective structures, functioning and enforcement.
This amendment has been proposed by DG SANTE as part of its own Health package. If this reasoning is accepted, what will stop DG GROW from deciding to do exactly the same with, say, machinery? This amendment is basically paving the way for the AI Act to be emptied from within, by each of the sectoral units, making it less controllable centrally by DG CNECT. Just think about it: CNECT proposes a simplification package and, one month later, another Directorate-General of the Commission basically sneaks another tricky amendment to it, through another legislative measure. Also, possibly because of heavy industry lobbying towards that specific Directorate-General (after heavily lobbying AI Act negotiators themselves). Again, what message does it give?
This ease in transforming medical devices from having to comply with the AI Act to having one day specific AI-related measures integrated in its own sectoral legislation, could mean that, if other sectors go the same way, basically the AI Act will hardly be considered “horizontal” anymore, apart from systems impacting fundamental rights. This would basically pave the way for Europe to abandon its own direction in regulating AI and rather move to the UK or US approaches.
As has been flagged by Adam Leon Smith, project leader for the QMS standard in CEN/CENELEC JTC21 (the committee drafting the future harmonised standards for the AI Act), this amendment might render protections related to AI in medical devices much less incisive than an AI-specific regulation:
“The AI Act’s requirements for human oversight (Article 14), transparency (Article 13), and robustness (Article 15) are specifically designed for AI systems. MDR/IVDR general safety requirements cannot substitute for these AI-specific obligations, particularly as medical AI grows more sophisticated”.
I would highly encourage every reader of this post to also read his in its entirety, as it contains a host of other insightful elements about this and about the modular nature of the New Legislative Framework (already allowing for more than one sectoral regulation applying to the same product).
5. Since the amendment is part of a health-related package, it will not be negotiated by CNECT, digital experts from the Member States and the Members of Parliament involved in the AI Act Omnibus negotiations (IMCO-LIBE Committees, with some of the same members who originally negotiated the AI Act), BUT by DG SANTE, experts from health ministries and, for the European Parliament, by the newly established SANTE Committee members. It is also very possible that these experts will attach a very different interest in considering this amendment than the AI Act negotiators. This will break the integrity of the AI Act and can result in anomalies, if the respective negotiating teams operate in isolation. Also, it can produce different majorities compared to the AI Act (and Omnibus) negotiations.
In sum, this is definitely something not to overlook in the Omnibus negotiations, and a topic worth debating further once we all get back from holidays. For now, happy holidays to everyone brave enough to read this post right at the onset of the Christmas break.