If you built your compliance plan around 2 August 2027, that date no longer exists. Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, entered into force on 27 July 2026 and moved the application of high-risk obligations for AI systems embedded in medical devices to 2 August 2028.

One extra year. That is substantial, and it is also the easiest way to focus on the wrong thing: several parts of the AI Act did become applicable on 2 August 2026, penalties included. Here is what moved, what did not, and what remains to be done.

What the digital omnibus actually did

Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July and in force since 27 July 2026, amends Regulation (EU) 2024/1689 — the AI Act — along with Regulations (EU) 2018/1139 and (EU) 2023/1230.

Its main effect comes down to two dates:

Annex III — stand-alone high-risk AI systems (recruitment, education, creditworthiness, emergency call triage and others): application deferred from 2 August 2026 to 2 December 2027.
Annex I — AI systems embedded in products already covered by Union harmonisation legislation, which includes medical devices (MDR 2017/745) and in vitro diagnostics (IVDR 2017/746): application deferred from 2 August 2027 to 2 August 2028.

One drafting detail deserves attention. The Commission's November 2025 draft made these deferrals conditional on harmonised standards actually being available: the dates would have slipped on their own had standardisation fallen behind. That conditional trigger was removed from the final text. Both dates are now firm calendar dates that cannot move without a new legislative procedure.

In other words, this deferral is probably the last easy one.

The real question is not the date, it is the classification

Before you write down 2 August 2028, establish whether your device is in fact a high-risk AI system. Article 6(1) of the AI Act sets two cumulative conditions:

the AI system is intended to be used as a safety component of a product covered by the Annex I legislation, or is itself such a product; and
that product is required to undergo a third-party conformity assessment with a view to being placed on the market under that legislation.

The second condition is the one people forget. Under the MDR, a class I device that is not sterile, has no measuring function and is not a reusable surgical instrument is self-certified: no notified body is involved. Condition (2) is not met, so the device is not classified as high-risk through that route. The same reasoning applies to a non-sterile class A IVD under the IVDR.

Three caveats, because that conclusion is narrower than it looks:

MDR Rule 11 pushes almost all software into class IIa or above. Genuinely class I software is the exception, not the rule — we explain the mechanism in our article on qualifying software as a medical device.
Annex III remains a separate entry point. Emergency patient triage systems are listed there explicitly, regardless of any CE marking. Their application date is 2 December 2027, not 2 August 2028: a hospital and a manufacturer can therefore be on two different timelines inside the same building.
The Article 50 transparency obligations apply whatever the risk class. They do not depend on the high-risk classification at all.

What already applies, and was not deferred

This is where the deferral creates the most confusion. Since 2 August 2026:

Penalties are live. The Commission and the AI Office hold their full enforcement powers. The ceiling is EUR 15 million or 3% of total worldwide annual turnover, whichever is higher.

Article 50 transparency obligations apply. Users must be informed when they interact with an AI system, and AI-generated or AI-modified content must be marked. One accommodation exists for the machine-readable marking in Article 50(2): providers of synthetic content systems already on the market before 2 August 2026 have until 2 December 2026. Systems placed on the market after that date get no additional time.

The Article 5 prohibitions have applied since 2 February 2025 and were left in place — the omnibus in fact added further prohibited practices.

General-purpose AI model obligations have applied since 2 August 2025. If a function of your device rests on a third-party foundation model, your provider is subject to them, and the documentation you receive follows from that.

Article 4 on AI literacy was rewritten, not removed. The new text asks providers and deployers to "take measures to support the development" of a sufficient level of AI literacy, where the original required them to "ensure" that level. A new sentence clarifies that the obligation does not require guaranteeing any specific level of AI literacy for any individual. This turns an obligation of result into an obligation of means: your training plan is still expected, proof of an individual outcome is not.

And above all: the MDR and the IVDR did not move at all. An AI-based medical device remains subject today, with no deferral whatsoever, to CE marking, clinical evaluation, risk management under ISO 14971 and software lifecycle under IEC 62304. The AI Act adds to that foundation; it never replaces it. An AI Act deferral frees up no MDR deadline.

Why twelve more months are not twelve months of respite

Three mechanisms mean that AI Act compliance for a medical device cannot be treated as a separate project to be started in 2027.

Conformity assessment is integrated, not parallel. Article 43(3) provides that the manufacturer follows the conformity assessment procedure required by the sectoral legislation — the MDR or the IVDR — and that the requirements of Chapter III, Section 2 of the AI Act form part of that assessment. There will be no separate AI Act certificate alongside the MDR certificate: there will be one audit, a heavier one.

Your MDR notified body will assess those requirements, provided it has itself been assessed on that point during its notification procedure. The question to put to them today is therefore not "when must we be ready" but "will you be designated for the AI scope, and when do you open slots". Notified body queues have been measured in months since the MDR became applicable; nothing suggests an influx of AI files will shorten them.

The technical documentation is shared. AI Act requirements will slot into the existing MDR technical file, not into a neighbouring binder. Risk management system, training data governance, logging, accuracy and robustness, human oversight: each of these crosses a section you already maintain. Integrating them late means reopening a closed technical file, which always costs more than writing it once.

What this delay is reasonably good for

Classify first. For every reference in the portfolio, settle the Article 6(1) question: is a notified body involved under the MDR or the IVDR? The answer determines whether you fall under 2 August 2028, under 2 December 2027 via Annex III, or under neither. Write that analysis down and date it: an auditor will ask for the reasoning, not the conclusion.

Handle Article 50 now. It already applies and it is inexpensive. If your device exposes a conversational interface or produces synthetic content, user information and marking need checking before 2 December 2026.

Frame training data governance. This is the one requirement a delay does not help you catch up on: traceability of the provenance, representativeness and bias of a dataset cannot be reconstructed after the fact. If the model is retrained in the meantime, everything that was not documented is lost.

Track standardisation. The harmonised standards expected under the AI Act are the real critical path — their delay is what motivated the deferral in the first place. Their publication, along with the Commission's guidelines on classifying high-risk systems, governs most of the concrete work.

Also in August 2026

Three other texts from the month deserve a place in your regulatory review.

Decree no. 2026-730 of 1 August 2026 (French Official Journal no. 0180 of 4 August) creates articles R. 5215-1 to R. 5215-3 and R. 5224-1 to R. 5224-3 of the French Public Health Code, covering supply shortages of medical devices and IVDs. The manufacturer or its authorised representative must notify the ANSM electronically of any planned interruption or cessation of supply, stating the name, class, indication, reasons and estimated duration, and must inform economic operators and healthcare professionals by a means that provides acknowledgement of receipt. The decree sets no notice period in months, but it does impose short response windows: 8 days to answer an ANSM request for information, reduced to 24 hours in an emergency. If your product crisis procedure does not provide for a 24-hour response, it is already non-compliant.

Decree no. 2026-810 of 21 August 2026 (Official Journal no. 0195 of 22 August), applicable from 1 January 2027, changes how reimbursement for certain medical devices is split between French statutory health insurance and complementary insurers under solidarity-based contracts. Full coverage is preserved for patients with long-term conditions and for major appliances. This is a market access matter rather than a compliance one, but it bears directly on commercial conditions in France.

At the FDA, three texts on 17 August: a final rule reclassifying in situ hybridisation test systems into class II for use with an approved oncology therapeutic product, and two proposed rules — one on diagnostic endoscopic light source systems, the other on a proposed list of accessories to be classified in class I. On 10 August came a proposed reclassification of digital breast tomosynthesis systems from class III to class II. Every reclassification into class II opens a 510(k) route where premarket approval was previously required: for an affected manufacturer, that is a US market access strategy worth revisiting.

Finally, Team-NB published two position papers in early August on transparency in the announced revision of the MDR and IVDR, arguing in particular that notified bodies need access to the information held in EUDAMED to carry out genuinely risk-based surveillance.

Tracking all of this without spending your days on it

None of the texts cited here was announced through the same channel. The digital omnibus appeared in the Official Journal of the European Union, the decrees in the French Official Journal, the reclassifications in the Federal Register, the Team-NB positions on their own website. Rebuilding this picture by hand every month takes hours, with the permanent risk of missing the one text that changes a date.

MedQara monitors 32 sources, including 19 regulatory authorities, ranks every publication by criticality against your device and market scope, and produces a timestamped export you can file in your QMS as evidence of regulatory monitoring. The built-in regulatory assistant answers your questions while citing the texts it read.

Create an account in a few minutes — free trial, no credit card.

This article is provided for information purposes and does not constitute regulatory advice. The dates and references cited were verified on 29 August 2026 against the published texts. For any decision affecting a device, confirm with your notified body or a regulatory affairs expert.

The AI Act and medical devices: the new timeline after the digital omnibus