AI Medical Device Rules Are Taking Shape Worldwide. What Is Your Exposure?

For years, AI in medical devices was regulated mostly with rules written for ordinary software. That is now changing in several major markets at once. The details differ, but regulators share one premise: an AI tool can’t be approved once and then forgotten, because it keeps changing after it reaches the market. This series looks at what each jurisdiction is doing and what it means for the organizations that build, buy and use these tools.

United States

The FDA has made AI the top priority on its fiscal 2027 guidance agenda, with final rules on lifecycle management and marketing submissions expected within the year. The agency is also taking comment until October 19 on generative AI devices, and has proposed evaluating them through a competency assessment loosely modeled on how physicians are trained and tested.

United Kingdom

The UK is earlier in the process but heading the same way. A national commission set up by the MHRA has issued 44 recommendations that would shift oversight from one-time pre-market review to the product’s full lifecycle. They include staged authorization, under which a device starts with a narrow scope and expands as it meets evidence thresholds. The government has not yet formally responded.

European Union

The EU has the most developed framework and now a firm timeline. The AI Act’s high-risk obligations for AI in medical devices apply from August 2, 2028, and the dates are no longer conditional, so no further delay is coming. Those obligations sit on top of the Medical Device Regulation rather than replacing it.

Asia-Pacific

The region is less uniform but moving. South Korea’s AI Framework Act took effect in January 2026 and treats AI in healthcare and medical devices as high-impact. Providers must give users advance notice, maintain risk management plans and build in human oversight. Other regulators in the region are developing their own approaches at different speeds.

The Common Thread

Each framework assumes the product will change and expects someone to monitor how it performs over time. Each also leaves open how responsibility is divided between the manufacturer and the organizations using the tool. For a hospital, a practice or a vendor operating across borders, that unanswered question is where the exposure sits. Later parts of the series will take each jurisdiction in turn.