Since the last issue, what we have written shares one question: what does a file have to show when someone else reads it? The answer keeps coming out the same. Evidence holds when each requirement is shown once, in one place, and can be traced.
The EU AI Act high-risk dates moved, and the work behind them did not.
AI software that is a medical device answers to two regulations, and keeping two sets of records for it is the costly mistake.
A risk management system is not made robust by the number of methods, but by their traceable integration.
Lead Story: the date moved, the work did not
The EU AI Act's high-risk dates moved in July, and a later date is easy to read as a reason to wait. Regulation (EU) 2026/1744, the digital omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July. The obligations for high-risk AI in the Annex III use cases now apply from 2 December 2027, previously 2 August 2026. For AI that falls under the MDR or IVDR as a product or safety component via Article 6(1) and requires third-party conformity assessment, the date is now 2 August 2028, previously 2 August 2027. That second date applies only where third-party conformity assessment is required for the product, and not every AI-based medical device is subject to it.
So the first question is classification, and it is a step, not a label applied afterwards. Only once it is established whether a system is high-risk AI can you tell whether the obligations in Articles 8 to 15 apply at all. For systems already on the market, our post of 20 October put it this way: a high-risk system placed on the market or put into service before the applicable date is generally subject to the high-risk requirements only if its design undergoes significant changes after that date.
The extra year is room in the calendar, not a reason to wait. Classification, gap analysis and the build-up of the evidence required under Annex IV all need lead time. Our analysis of when AI counts as high-risk sets out the Article 6 test and the dates.
Where the AI Act does apply, the costly mistake is not the second regulation. It is running two worlds of documentation. Diana Hohage's piece on the MDR and the AI Act describes how it goes wrong: a risk recorded as mitigated in the MDR file appears unchanged and open in the AI Act file, and both versions are submitted to the notified body. The pivot is Article 6(1). Software that must be presented to a notified body as a medical device almost always falls into the high-risk category of the AI Act, so the product class decides the category.
Many AI Act requirements overlap with the MDR without being identical. Data governance under Article 10, with documented representativeness of the training, validation and test data and a bias review, has no direct counterpart in classic MDR technical documentation. And monitoring under Article 72 belongs inside MDR or IVDR post-market surveillance, so that model drift and field data come together in a single assessment.
The timing is not a buffer either: parts of the framework, such as harmonized standards and guidance, are not yet fully defined, and waiting for final clarity costs the time needed to integrate the work into ongoing development.
Capability Spotlight: one framework, not a third stack of records
The way out of two worlds of documentation is an integrated framework, and three steps carry it. Classify first, because the MDR or IVDR risk class determines the AI Act categorization via Article 6(1). Then map the obligations from Articles 8 to 15 onto the existing MDR technical documentation, the QMS and the software life cycle under IEC 62304 instead of duplicating them, so that each requirement is evidenced once and maintained consistently. Finally, embed the Article 72 monitoring in post-market surveillance.
Regulatory Affairs and Technology & AI Enablement: we do the classification under product law and the AI Act, map the requirements without duplicate documentation, and integrate the result into the QMS you already run. The whitepaper on AI Act, MDR and IVDR in interplay is free, and our AI regulation expertise starts at the classification.
Method Note: the hazard comes first
The last part of our FMEA series ends at the interface to the risk analysis under ISO 14971, and it starts from a definition that is often mixed up. A hazard is not an event that occurs or does not occur. It is not a failure mode. And it is not harm. It is a potential source of harm, typically tied to properties, states or functional characteristics of a product or its application.
For that reason a hazard is typically not first "created" from a failure mode. As the reference point of the risk analysis, it is conceptually upstream. A failure mode can help explain how an already relevant hazard contributes, through a sequence of events, to a hazardous situation. The whitepaper is open about the blur: the line between hazard and hazardous situation does not always appear fully clear-cut, often because example hazard descriptions in standards, guidance documents or internal company hazard lists already incorporate aspects of an exposure or use situation. The more helpful question is therefore not whether a failure mode is already a hazard. It is how an identified failure mode helps to better substantiate an already considered hazard, a sequence of events, a hazardous situation or required risk controls.
That is also where the series ends, and where this issue starts. In the whitepaper's words, "it is not the existence of multiple methods that makes a risk management system robust. It is their traceable integration." Chapter 6 covers the interface in full, and the whitepaper FMEA & Co. is an instant download.
Field Notes: Milan and Siena
CPhI Worldwide took place from 6 to 8 October at Fiera Milano, and Entourage was on site with a team. In our view, three themes shape the operational agenda: Annex 1 implementation, AI in the GMP environment and supply chain resilience. On Annex 1, many companies meet the technical requirements but have not yet set up their documented evidence and the PUPSIT assessment (Pre-Use Post-Sterilization Integrity Test) in a way that holds up to inspection. On AI, a clear answer is regularly missing to how AI systems are validated in an environment subject to CSV. And on supply chain resilience, dual sourcing has a price: a second supplier means a second qualification process and a second change control chain. The CPhI article has the detail.
A week later, on 15 and 16 October, Entourage Italy was at the PDA Italy Chapter conference Reimagining the Factory near Siena, with a table top. Our talk there was built as a playlist, with one track each for who we are, for what we do and for how we work. If we did not get to talk in Siena, the conversation is still open.
Looking Ahead: a webinar in German, and Barcelona
On Wednesday 4 November, 10:30 to 12:00 CET on Zoom, Diana Hohage (Principal Consultant, Entourage) and Lukas Poterpin (Co-Initiator Regulatory Affairs, Confideck) hold a webinar titled "Automate technical documentation without stopping operations". It is free of charge, registration is required, and it is held in German. It is for IVD manufacturers and companies with an IVD portfolio. The program covers how grown technical documentation becomes an automatable source instead of starting from zero, how a documentation project is rolled out in a planned and validated way alongside the day job, and where AI carries weight in technical documentation today and which controls keep the result defensible in an audit. Registration is on the webinar page.
The same week, on 5 and 6 November, the RAPS AI in Regulatory Conference takes place at the Novotel Barcelona City, with a preconference workshop on 4 November. It is developed and curated by the RAPS European Council and deliberately small: interactive breakout sessions instead of a trade fair floor. We are there on both conference days. We are not bringing a product. We are bringing the question of what your notified body will need to see, and what of your existing documentation already answers it. If you are going, tell us your topic, region, language and preferred day and we will propose a time.
Take one place where the same requirement lives in more than one file, whether it is the AI Act and the MDR or a method and the risk analysis, and send us how the pieces connect. We will tell you where the chain breaks and what evidence closes the gap, usually within one business day.
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.