Artificial Intelligence-enabled medical devices are encountering markedly different regulatory pathways depending on the market. An offering that clears in the US within months may take years to navigate European conformity assessments, while the UK is moving toward a middle ground. Across jurisdictions, compliance rests on three pillars: core medical device regulations that define classification, safety, performance and clinical evidence; Artificial Intelligence-specific obligations covering data governance, transparency, bias and human oversight; and cybersecurity, data privacy and post-market monitoring. Knowing how these elements align and diverge is now essential to strategy, not just compliance.
In the US, the Food and Drug Administration has advanced guidance for software-based devices and introduced the Predetermined Change Control Plan to accommodate adaptive machine learning technologies. The guidance recommends that a plan outline anticipated device modifications, the methods to develop, validate and implement those changes, and an assessment of their impact. Developers are encouraged to use the Q-Submission pathway to engage the agency on proposed change plans, offering a structured route to iterate models responsibly post-clearance.
In the EU, the Medical Devices Regulation and In Vitro Diagnostic Medical Devices Regulation are overlaid by the EU Artificial Intelligence Act for most high-risk Artificial Intelligence systems, which includes many Artificial Intelligence medical devices. The act imposes horizontal obligations on data governance, risk management, robustness, transparency and human oversight. It entered into force on 1 August 2024 and is phasing in: broader provisions and prohibitions have applied since early 2025, most Artificial Intelligence rules will apply by 2 August 2026, and targeted requirements for high-risk Artificial Intelligence systems will follow a year later.
The UK has no formal Artificial Intelligence-specific law yet, but the Medicines and Healthcare products Regulatory Agency is pursuing a pro-innovation, principles-based approach as it revamps the UK Medical Device Regulations to include provisions for Artificial Intelligence-enabled devices. Through its Software and Artificial Intelligence as a Medical Device Change Programme, the regulator is converging on a Predetermined Change Control Plan-style mechanism. The stated goal is to reduce friction across jurisdictions and strengthen international convergence and consensus on software and Artificial Intelligence medical devices.
Turning rules into execution requires leveraging points of convergence. International standards such as ISO 14971 for risk management, IEC 62304 for software lifecycle, IEC 81001-5-1 for secure lifecycle of health software, ISO/IEC 27001 for information security and ISO/IEC 23894 for Artificial Intelligence risk management can underpin quality systems and technical documentation across markets. The FDA and MHRA draw on IMDRF guidance and Good Machine Learning Practice principles, which should inform design and development. A single technical file can be structured to satisfy FDA, EU MDR or IVDR and UK MDR submissions, with Artificial Intelligence Act obligations integrated. Strong clinical evaluation with representative datasets, clinically meaningful endpoints and subgroup analyses, alongside robust cybersecurity and privacy programs, builds regulator confidence. Mastering these differences can make compliance manageable and help bring safer, more reliable products to patients faster.
