If you are located outside of the European Union, the United Kingdom and or Switzerland, then you need an authorized representative. So, I have a good news. You have find it with Easy Medical Device. And if you are also in need of an importer in Europe and in Switzerland, then contact us definitely at info at EasyMedicalDivise.com.
And I'm sure we can help you. Welcome to the Medical Device made Easy Podcast. I am Monir El Azzouzi, a medical device expert specialized on quality and regulatory aspects. My mission is to help you learn how to place a compliant medical device on the market. For that, I share with you my experience and the one of others on this podcast. Are you ready for your dose of regulation and standards today? Ok, so let the show begin. Welcome to the Medical Device made Easy Podcast.
Here is Monir El Azzouzi from EasyMedicalDivise.com. And today we'll talk about AI Act. So, there are a lot of AI episodes actually within the podcast. So today we'll talk about the challenges that will be happening within the AI Act. And for that, I have with me Fabian Roa from Hogan Lovers. Fabian, welcome to the Medical Device made Easy Podcast. Thank you Monir. Very good to be here with you.
Great. Happy for you to be here and thank you again for coming to explain to us about those challenges that we have with AI Act. But first, can you maybe introduce yourself and also your company? Sure. So, my name is Fabian. I'm working for Hogan Lovers, you know, an international low-fium with 45, you know, offices around the globe. I'm based in Brussels and I'm helped for marketing their products in Europe. So, these, all the issues around pre-market, marketing authorization,
sea marking and post-market questions, you know, I can address. I'm also helping with transactions, you know, privacy, a consideration. So, I'm like a consultant, you know, being a lawyer and I'm also a quality management system monitor for ISO-1345 and for MDSAB. Great. So, you have a lot of knowledge that also medical devices, which is, I hope, helping a lot about this topic of today.
So, can we just maybe as an introduction for this topic, remind to people what is AI Act. We have made a previous episode with Eric Volbrecht, where we have talked about AI Act as it was already announced in general. AI Act was, if I can say, existing, but it's not officially published. So, can we again explain AI Act and many of this timeline, when will this be officially, if I can say?
Yeah, sure. So, the AI Act has been, you know, adopted, you know, by the parliament and the council, you know, the parliament adopted the voted on the AI Act in March and the council finally also adopted, you know, the AI Act on the 21st of May. So, now what we are waiting is simply the publication of the AI Act in the official journal of the European Union and there are some delays. We understand and its publication is currently scheduled for mid July.
And what is important to also consider is that application of the AI Act will not be made yet. You know, it will only enter into force, you know, 20 days after its publication. Okay, so as soon as it is published, you said it's really under for into force 20 days after. So, does it mean that 20 days after everybody should follow what is written on the AI Act or there is a transition like the MDR, we said three years to adopt it or to implement it?
Yeah, there are some transition period, let's say, you know, so six months, you know, after the entry into force of the AI Act, the first rules, you know, will start to apply. It's it relates to prohibit it, you know, AI practices. So, it's very important, you know, even for manufacturer to look at the AI Act now. And for I think, you know, most of the rules for medical device software regulated under the AI Act, it will be three years after the entry into force of the AI Act.
I'm not telling you or whether I'm on here that manufacturing should wait, you know, as we will discussing this period, I think there is a need, you know, to look at this act now. So, when we say three years, it means that it's three years to understand, modify the practices of the company, maybe change some or provide some evidences that your device is working correctly, etc.
or not in compliance with the AI Act. So, it can take all the, it can take time for manufacturers to gather and create all those evidences. So, it's why you should not wait three years like we have waited for the EUMDR after the publication. And to then start to work on that. Absolutely. You're right. You know, the CMarking of medical device software or hardware, including, you know, AI system in three years at time, you know, from the entry into force of the AI Act,
we'll have to take into consideration the AI Act requirements. So, it means notify body will have to apply the AI requirements to the conformity assessment. And as you just say, you know, it's if the test is in three years, it means, you know, manufacturers must start collecting data and change their technical documentation today, you know, to be ready on time.
Exactly. Yeah. So, three years is also a long time due to the topic software software. I mean, if we talk for example about art, three agents, we started last year to have some kind of a boom of it. And this year where everybody starts to use it. So, in three years, maybe it will be, if I can say, common, I think for people. So, it's also something that's on the topic of software, which is not maybe hardware on topic of software.
It can be a long lead time, if I can say, for software manufacturers, they will have maybe to have a third generation of AI or third generation of software before they arrive to the implementation of the AI. But there are, as you've said, six months after some rules to implement. So, it's not like three years. It's really there are some phases also for that.
Yeah, absolutely. Again, it's very important to look at this act now because manufacturers, which will start only in two years, now will be probably too late to be ready on time. Great. So, you said also, I mean, in terms of the scope of the AI act, we talked about software and hardware. So, here, yeah, hardware that contains an artcentage like maybe a machine or MRI machine that maybe contains a software for MRI or for with anti-artcentage or some hardware devices are really also in the scope.
It's not only a software, it's really even software inside the medical device. Honor the pulse of the Medtech world with Medtech Conf, a dynamic platform featuring global events on medical devices, biologicals, IVD and pharmaceuticals. Stay informed, stay ahead, connect, share and elevate your knowledge. Become an official sponsor, make your event shine on the map. Medtech Conf, your key to the Medtech universe. Remember, the future is now and it's at your fingertips with Medtech Conf.
You're right, yeah, absolutely. If the hardware is incorporating AI system, then what this hardware may fall within the scope of the AI act. Actually, there are some conditions, we can summarize. So, first one is the AI and I'm using the verbiage of the AI. The AI is used as a safety component of the AI system or the AI system is itself a product. That's the first condition. So, AI used as a safety component or the AI system is itself a product.
Plus, it's covered by the MDR and IVIDDR and it is subject, this is an additional condition, it is subject to a third party assessment. So, it means it's subject to a conformity assessment involving a notified body, for example. If you meet these three cumulative conditions, you will be considered as an AI-risk AI medical device system. And it means the manufacturer of this AI-risk AI system will have to comply with the MDR and IVDR.
Plus, the AI act. Again, also another precision. AI act has no, the scope of AI act is not only on medical devices. It's everything that contains an artificial intelligence. So, here we talk about specifically medical devices because we are talking, we are on the medical device field.
But if you have even a software as a medical device that acts without artificial intelligence, but inside there is a component of artificial intelligence for something else, nothing about medical, it still has to follow AI act. Yeah, it depending on the purpose of the AI act, there will be a specific requirements. Sometimes it's just transparency, sometimes it's just registration. But yeah, the AI act is what we call industry agnostic.
So, it's applicable to the medical device industry, to Hulska and Genal, to financial services, consumer products. It has a wide range of application. Yeah, just to be precise, because people don't think that AI act is only for medical devices. No, it's really for everything. So, we talked about some challenges related to the AI act. As you said, there are things that people have also to follow now or to check now.
Can we summarize maybe a few challenges that you have identified that maybe people have to be aware first and then act upon those challenges? Sure, yeah. So, it's mainly around two or three ideas in my perspective. The first challenge is the manufacturer challenge. Like for the MDR or IVDR, a manufacturer should not wait to start implementing the AI act in their quality management system, in their technical documentation.
I think that's really the main challenge. Why I'm saying that? Because we need to learn from the MDR and IVDR. We see that there have been a lot of issues. Manufacturers are not the one to be blamed the most. But some manufacturers have been also late, transitioning to the MDR and IVDR. Here, we have another challenge with the AI act and we need manufacturers to start working very quickly. Why?
Because again, in three years' time, when the conformity assessment will take place in the notify body, we'll review the validation data. For example, for the AI software, we'll have access to the data set that was used today to build up the AI system, to train it, to validate it.
The notify body will check the quality of the data set. If the quality is not the one expected according to the AI act requirements, it means that the manufacturer will face non-conformities at the time of the conformity assessment. It could have an impact on the process because it will delay the conformity assessment. Just to recap a bit, we have the AI act that will be published in three years. They have to implement that.
But in three years, maybe they will be using the AI on data sets that were already non-conform or not good since the beginning. When they will arrive three years later, they say, oh, I'm already using that since three years, they can be in non-conformity because the initial data set was not correct. Today, the pick-up of the data set, let's say it's not meeting the data governance requirements of the AI act.
It means they will train and validate their AI system based on data which could have been manipulated, which could not reflect the requirements of the AI act. The notified body will check that in three years' time. And they may say, we have an issue with the original data set. And therefore, we cannot accept the AI system as it is because it was not properly validated. So you need to come back to us with good validation data.
Does it mean also that they have the power at that moment to stop the use of your software? And say you have to put it on hold or recall it or this kind of thing? So what I was talking about is just the pre-market phase. So it was under the circumstance the AI system is not yet on the market. But I think you are raising a good question. I don't think the notified body will have the power. Let's say the AI system is already in use in a medical, as part of a medical device software C mark.
The notified body will not have, I think, the power to request the manufacturer to recall the software when doing the assessment. Why? Because currently the AI act requirements are not applicable. So it's a placing on the market principle. It's placed on the market correctly, if I can say because AI was not there. So at the moment it was placed on the market, everything was okay or it's compliant. But in three years it's not. But it means that during that time it was already correct.
So you cannot remove that. But if you change something in three years, you have them to apply the AI for your software, I suppose. Absolutely. If you change, so if you have a C mark software using AI today, you need to comply with the MD. And the first thing is that the MD is already putting high standard on the C marking, this type of product. There will be additional requirements to be made by the AI act. But it's only when the AI could be applicable to this AI system as medical device.
Yeah, it's a stage approach. So if you have an AI XC mark under the MDR today, and once the AI act requirements for medical device software using AI are applicable in three years time, if you do a substantial change or a significant change to your software, you will be required to apply the requirements of the AI act. Hey, just a second, do you need the EU suites or you care representative, then choose easy medical device.
We can represent you and also become your importer, contact us at eoatissimedicaldevice.com. And this can be the part where all you have some delay or you have a bit to provide more testing and you cannot do that. So will there be maybe just thinking about that now while you were talking? So will there be like the MDR like this MDC guidance or a type of MDC guidance for the AI act on what is the significant change? Well, we hope there will be guidance.
I think it's one of the challenges faced by manufacturer currently. Our message is you need to start preparing, but we have a lot of uncertainties. Now, you know, the process will take place, how notified are these? We will assess this AI system. There are guidance documents that must be adopted by the commission. For example, by Q4 2025, the commission is supposed to have published guidelines on practical implementation for the classification rules of the IRISC AI system.
It's only 18 months after the entry into force of the AI act. And so 12 months after publication or the forcing publication of these guidelines, you know, the medical device industry will be supposed to be fully compliant with the AI act.
And so we can see money and that there is something wrong already, which is, you know, our coming too late in the process, you know, if we want, you know, manufacturing to start preparing now, I think the guidance document should also be available today, you know. I mean, we need to be the same story as what we happen with the MDR. We have the MDR that is published and then a lot of uncertainty also where on the MDR and then guidance is start to to be pulled.
You can say to everybody to say you have to do it on that way, on that way, on that way, on that way, etc. So will it be the same story like for MDR? I hope not. But yeah, there will be a lot of issues, you know, to fix, you know, as part of guidance document. There are a lot of works. For example, you know, the conformity assessment, you know, not necessarily aligned between the AI act and the MDR or IVID.
So it means, you know, if it's not aligned, you know, the notified body, you know, may have to follow two different, you know, processes, you know, to be able to issue certificate of conformity to the AI system as a medical device software. So, yeah, I think, you know, again, you know, because of the lack of guidance, you know, because it's a new act, you know, because not if for notify body will see that, you know, it's also a new job.
I think, you know, we, it's difficult to say now, but we may, you know, face also additional delays, you know, in implementing this AI act, you know, because guidance are not available. So, yeah, I mean, we apparently we are maybe not learning from our previous lessons that we are reacting again on the same way, but now it will not be only for medical devices for you for all industry. So, as you say industry agnostic. Okay. So, what is the second challenge that you have identified?
The second challenge is the notify body. I just mentioned that briefly, you know, but so what is good is the AI act permits, you know, a single conformity assessment under the MDR and also under the AI act. It means as a medical device manufacturer, you will be able to develop a single technical documentation, single declination of conformity, you will have a single C mark on your product, and you will be able to claim complaints with MDR and I act together.
However, to be able to do that, remember that was the case for MDR and I have a there notify bodies must be designated, you know, by their competences on entities, you know, to do this conformity assessment. It means they need to be assessed by their competences on entities as having the expertise to assess an AI system under the AI act.
So, there will be a period where they will be subject to audits, you know, by their competences on entities, you know, just to show that they have where independence integrity, you know, internal competence, you know, appropriate personnel, you know, to conduct this conformity assessment.
The personnel is key, you know, and everyone at the manufacturer level, but also at the notify body level, we'll be looking for expertise, you know, and so we'll be looking for good, you know, personnel, you know, to drive this AI project forward.
And I think it will take time, you know, like for the MDR and IVDR, you know, it's not going to take place tomorrow. The problem is that if you have a single notify body, if you want to keep a single notify body for MDR and AI, you're notify body will have to be designated under the act. And that's a challenge because maybe not all of them will be willing, you know, to transition and to be designated under the AI act.
We know that not all of them will be designated at the same time as well. So, if you have a notify body, which is MDR designated, but not AI designated, you know, you will face an issue. Because, you know, the notify body will not be able to issue certificate of conformity for your product. It means you may have to work with two notify bodies at the same time or you may have to switch notify body to ensure that you can have only one conformity assessment for MDR and the AI act.
So, that's a big challenge. I suppose here we can say that maybe the big notified bodies will maybe overcome this challenge and find some resources to then have the possibility to be designated for both, but maybe smaller notified bodies will not have this possibility and cannot cannot help you on that.
And the one one of the issue I or the issue that I can find was if we look again at the MDR and I VDR was for notified bodies to find the resources to find the auditors that are knowledgeable on art shouldn't intelligence for doing that. So, art shouldn't just is kind of a new topic for can say so it's not like something that was existing since many years or it was existing for can say this many years but publicly now it's really becoming a new topic.
So, do you think from what you may be heard do you think that there is enough people that are knowledgeable on AI and that can become the auditors and then can help notified bodies to be designated. And those AI people normally are all I can say hired by the industry to do the AI activity. So, is there like a competition now between notified bodies and industry to hire the right people to do to do these things.
Yeah, I think it's a fair question to ask you know I don't know exactly you know the market here but these people will be on the very high demand. I think you know already there you know but they will be more and more. So, notified body will need these people you know manufacturers will need these skilled employees you know the AI activity is also creating you know the AI office AI board you know.
A lot of consultant you know will be working also with these different entities you know so very high demand and when you see for example the number of notified bodies in certain jurisdictions for the IVDR you you wonder you know or they will be.
All you know getting you know they are team ready you know for the AI act of course not all notified body will specialize in medical device software and an AI medical device software it's already the case scope of designation is is not always covering medical device software but for those covering it you know they will be a fierce you know.
Challenge you know through critical skill people in this area yeah I think we talked about that long time ago but when we started to talk about notified bodies also we said at a certain point that maybe to be interesting to have some notified bodies are specialized in some areas so maybe having a notified body specialized in software and maybe also AI and not in any other thing just software and doing only that only that only that and this can be re assuring if I can say for.
Manufacture that develops software because they will have somebody in front of them that is software specialist so if it is a normal software AI software whatever software then they will be having special instead of trying to go to different notified bodies for that so this idea of having dedicated notified bodies for specialities like having.
Hospital that is specialized on this or a doctor that is specialized on that can be also an idea for giving some confidence to to manufacturers but it's not very for the man that it's not really the rule of all notified bodies. Any other challenges from your side yeah I just want to mention two other points you know the notify body so we mentioned you know the recruitment you know which is one thing they will be also this problem of capacity of notified bodies.
Notify body to notify bodies to deal with applications by manufacturers you know software you know hardware you know including you know AI systems because they could have the personnel but maybe not the personnel to deal with. The personnel to deal with 100 or 1000 sort of application you know at the same time and so we have that and we have also the cost you know we talk a lot about the cost of conformity assessment which has raised significantly under the MDR and I video.
Well the AI act you know will also had have you know its consequences you know on the cost of conformity assessment because at the top of the MDR I video regular assessment they will be the AI act assessment as well so it will definitely had you know on. You know on the budget of manufacturers you know to to BC mark in Europe and so with that and one year you know again you know.
I think the last challenge you know I will mention is innovation you know AI you know is software you know using AI you know AI in general it's part of innovation it's the world in which we live currently. We have a big problem in Europe with innovation at the moment you know because the rules are very complicated you know the time to market you know is long because the conformity assessment you know takes take a lot of time 18 24 months you know still.
The AI act application will not help you know to attract innovation you know on the European market and I think that's the main challenge because if the product are not coming on the you market. Physician will not be able to use this new technologies and patients will not benefit you know from this innovative you know devices so again innovation is is at the heart you know of the challenges. And as you as you said and as we said before this field is.
Is changing so fast that maybe today you have your software with AI that is. Developed you try to put it on the market and maybe it will arrive on the market one year after or two years after but.
The technology will have changed or the AI will have evolved and there will be competitors that will have already moved to the next generation etc where you are still stuck on this thing that was developed one year one year ago so these are many the problem of the software industry that will happen is the fact that you'll be maybe outdated when you will be on the market because all the competitors maybe will have already moved to the next generation or maybe as you said maybe we will be outdated in Europe.
But you'll have some some facility to sell in other countries and then to be able to put the latest latest version of a kind of your software in the other country but you still are stuck with the generation one of it in in Europe. Right and we know that currently there are discussions you know to attract innovation again on the market you know for the medical device industry.
I think it will be important to integrate also you know the solutions you know which will be put in the table to integrate the AI act into the discussion because something that could work you know to attract innovation under the MDR may not work under the AI act. So we need you know to to harmonize the rules you know on these two pieces of legislation.
So just maybe your opinion on that so do you think that because of the AI act we can have some manufacturer decide to not go on the market for Europe and go outside of Europe and say it's too complicated too expensive too much time too much effort etc so if we just go to Europe it's like yeah we'll if I can say we may be no fail.
So let's go directly to another country maybe US I don't know if you was is more is easier for them but US or Canada or wherever where they can sell this device maybe quicker with the cost will be less the budget will be lower for than Europe etc so is this something that you think that manufacturers of software manufacturers will be starting to think about.
Absolutely yeah and actually when I talk to to my clients I'm always you know talking about the company strategy and I think there are three options you know either you know you focus on other market and you wait for the AI act you know an related guidance to build up you know a lot of manufacturers have done that for the MDR and I video.
Or you are an early adopter of the AI act you know so you complain immediately you know and you prepare for it that's the recommendation you know I'm giving to all my clients you know it's always better.
Or you some people may want to do that is to prioritize the sea marking of AI system before the AI act requirements you know are fully applicable because if you do that you know the conformity assessment by your notified body will not necessarily take into consideration all these additional requirements so there are three yeah three strategies here.
Okay so it's it's something that's as you said people should be thinking of now so it's not something that they will have to look later so any major or main recommendation from your side on this.
Yeah so recommendation number one conduct to get assessment with between the MDR and the AI act you want to understand what are the additional requirements you need to comply with you know on the AI act you know and so once you have identified you know those extra requirements you know for example on data governance. You can adapt your technical documentation.
Take a clean risk management files for example you know you can also start recruiting you know skill you know employees if you don't have them second you need to talk to your notified body you know to understand whether they are. We link to transition to the act to be designated under the act and and and whether they are already taking steps. Because if you are developing AI software as medical device I think you want to understand quickly if you are not a five body will be able to.
Assess your product you know in the future if it's not the case again it's strategic decision you need to take you know do we stay with with that notify body. Knowing that they will get you know designation you know in the near future or do we switch to another notified body. Another point is to I think you know we discussed guidance morning earlier guidance is you know are still not developed you know there will be development you know in the coming months.
And I think it's very important you know to try to influence you know as much as possible you know the development of those guidance so to do that you need to participate to industry group. To be a member of industry association you know at the national or you level. And to make your point and your concerns known you know again if the commission is not aware of what could be an issue for the medical device industry with the act. The guidance will not be produced you know to address the concern.
Now I think it's a good point and I hope everybody will be following following them but yeah so I actually be something that people need to have on focus so it's why we are making also this episode today that people are really trying to understand what's happening that they are. I mean it's also what I have done before on you and the art try to help people to understand you and the art will allow them please do it now do it now do it now.
So yeah it's something that we are trying really to do and so again we are asking you to act now and not wait just just an information also for people so we are also planning a conference in Strasbourg France in October 1st about the AI act so we will call it AI act summit.
We put the link again on the show notes of people maybe to join us so the idea here is also to educate again people on AI act also networking so we'll have a lot of people there that will be joining I will try to attract also some notified bodies to then discuss those points and provide some some changes so manufacturers also to talk about the challenge they had about AI.
So I'm going to talk about some consultations about the standards etc and and yeah discussing about all that mainly so this is something that I hope with this episode with those events that will happen will help you to be on compliance because many this is objective for you to be in compliance with the AI act and one of the hidden objective also is that not everyone is moving out of Europe also not being afraid of AI act and try to act quickly so that it will be.
In place because we need that also for our patients in Europe and not just for patients outside of Europe for that Fabian so how can you help the audience maybe about also all this all this discussion here.
Yes so currently we are helping you know a number of clients understanding whether the AI act is applicable you know to their product that's the first thing you know we can help also with the gap assessment that I mentioned and then to update the technical documentation you know the procedures.
And we have very good insight also on what's going on at the level you know in the industry association level so that's something we can do we can try to build argument to try to influence you know the process you know at the guidance level you can contact you know confidential so it is. And that's that's a day to the job for us medical device you know is is a key topic you know in addition to the privacy cyber security consideration because.
It's not it's another topic money but you know AI and software means you know privacy means cyber security threats so there are a lot of excellent topic to be covered and we can help on all of them exactly so maybe another subject for another.
So anywhere we put all your details of Fabian on the show notes or if you want to contact him directly the link in page the website of also the his company so organ levels and then if you have also some questions don't hesitate to go to the YouTube channel or to.
The link in page where we'll be placing this episode and if you have some questions please ask them directly also there we try to help you to answer that and if you have some comments also maybe you have some some elements that you want to to disclose to the people so don't hesitate to put that also in the comments of the video and let us know about that.
Okay so Fabian it was really a pleasure thanks again for all your expertise and all the information you provided and I hope you're going to be helpful for everybody so thanks very much and I wish you a nice day. I'm here at the museum a medical device experts specialized on quality and regulatory efforts my mission is to help you learn how to place a compliant medical device on the market.