Rule 11 and AI Act: strategic classification of medical software

 The revision of the MDR (Medical Device Regulation) rewrites Rule 11 and the European Artificial Intelligence Act (AI Act) already has a definitive timeline for medical AI. Discover in this article why your software's class determines your regulatory burden today under both frameworks.

For any manufacturer of software as a medical device, classification has never been a minor procedure: it determines whether you need a notified body, how long it will take to reach the market, and how much it will cost.

In 2026, this decision has gained even more weight. Your software's MDR class no longer only defines your certification route, but also whether your product is a high-risk AI system under the AI Act.

Two regulatory processes advance at the same time and it is convenient to understand them together: the revision of Rule 11 of the MDR and the definitive timeline of the AI Act.

Current Rule 11: why almost everything ends up in class IIa

The current Rule 11 is in Annex VIII of Regulation (EU) 2017/745. Since its entry into application, it has led most medical software to class IIa, including many self-management apps for patients. Furthermore, the boundary between class I and class IIa is vaguely drafted, and manufacturers, authorities, and notified bodies interpret it in different ways.

The result is well known by digital health startups: almost mandatory notified body, long deadlines, and a considerable entry barrier for products of limited clinical risk.

Draft Rule 11: what the MDR revision proposes

The Commission's proposal, COM(2025) 1023, published in December 2025, proposes replacing Rule 11. The stated objective is to better align software classification with its clinical risk, avoid overclassification when the impact on the patient is limited, and adopt the IMDRF (International Medical Device Regulators Forum) risk categorization for SaMD (Software as a Medical Device).

The new wording reverses the current logic:

• Starting point in class I: software that generates an output with clinical benefit for diagnosis, treatment, prevention, monitoring, prediction, or prognosis is classified, in principle, as class I.
• Class upgrade according to clinical situation: it upgrades to class III, IIb, or IIa when the output is intended for critical, severe, or non-severe situations, depending on whether it informs or drives clinical management.

On paper it seems like good news, but a detailed reading calls for caution. Some analyses conclude that, with this wording, a large part of the software currently considered class I could end up in IIa or higher. This would especially affect apps targeted at patients, because the argument that a user without medical training does not make diagnostic or therapeutic decisions disappears.

The text is not final either. On July 1, 2026, the rapporteur for the Public Health Committee (SANT) of the European Parliament published his draft report, with more than 130 amendments.

According to the analysis by BioSlice, a blog specializing in European Life Sciences regulation, his changes to Rule 11 simplify its application but barely make it easier for software to reach class I. Realistic estimates place the application of the new rule in 2027 at the earliest. Until then, the certification strategy must be based on the current Rule 11.

AI Act: the timeline is now locked

The Omnibus Regulation on AI, Regulation (EU) 2026/1744, was published in the Official Journal on July 24, 2026. It postpones high-risk obligations for AI integrated into medical devices until August 2, 2028.

However, the postponement does not mean there is nothing to do:

• Some obligations already apply. Since February 2025, the prohibition of certain AI practices and the obligation to train personnel in AI are in force.
• Medical devices remain within high risk. The Omnibus agreement confirmed this, and the sector now points to the MDR/IVDR revision as the vehicle to resolve what remained pending.
• Evaluation will be integrated. The high-risk requirements of the AI Act are incorporated into the conformity assessment already performed under the MDR or IVDR, and a duly designated notified body can cover both frameworks.

One single classification, two regulatory frameworks

Here is the strategic key. According to Article 6(1) of the AI Act, medical AI is high-risk when the product requires assessment by a notified body under the MDR or IVDR. In practice, this covers class IIa or higher in MDR and class B or higher in IVDR. Self-certified class I products remain, generally speaking, outside that assumption.

Therefore, the class assigned to your software under Rule 11 also determines your exposure to the AI Act.

A nuance must be added: the MDR revision itself proposes moving medical devices to Section B of Annex I of the AI Act.

In practice, this would eliminate the high-risk layer of the AI Act for AI medical devices, leaving the MDR/IVDR as the applicable framework. It is a proposal still under negotiation, so it is advisable to prepare documentation for the most demanding scenario.

What you should do now

1. Review the class justification for your portfolio: Document the reasoning according to the current Rule 11 and MDCG 2019-11, and simulate how each product would look under the draft version.  
2.  Do not base your 2026 certification plan on the proposal: If the new rule is approved and your product moves to Class I, you can opt for self-certification later. Otherwise, delaying certification while waiting for a class downgrade that may never come can turn out to be costly.  
3.  Anticipate upward class changes: Patient-facing applications that are currently defended as Class I are the most exposed if the current wording moves forward.  
4.  If your software incorporates AI, start covering what the AI Act adds: Data governance, event logging, human oversight, and technical documentation can be integrated into the MDR file without waiting for 2028.  
5.  Maintain active regulatory intelligence: The European Parliament vote, the Council position, and the trilogue negotiations could significantly change the text in the coming months.  

How Ambit Iberia helps you

At Ambit Iberia, we combine expertise in medical device regulation, software validation, and AI governance in regulated environments:

• Regulatory and Clinical Strategy: qualification and classification of your software, with scenario analysis according to the current Rule 11 and the draft version, along with a clinical evidence plan tailored to the class.
• MDR Gap Analysis: identification of what is missing in your technical documentation to also cover AI requirements.
• AI Governance and Validation, together with The Triality Group: thanks to our strategic alliance with The Triality Group, a consultancy firm specialized in implementing AI in highly regulated environments, we combine strategic advice, implementation experience, governance, and regulatory excellence. This is how we help medical software manufacturers with AI prepare for the requirements of the AI Act.
• ARI and AREIa: traceable tracking of the MDR revision and the application of the AI Act.
• Specialized Training: the Specialization Program in Software as a Medical Device and the Medical Software Validation Course.

Do you know which class your software will fall into?

Speak with our Medical Devices team. We will review the classification of your product under current Rule 11 and the draft version with you, helping you turn regulatory uncertainty into a clear roadmap. Contact us!