AI Compliance
An AI-powered diagnostic, decision-support or discovery tool no longer answers to one law. Several frameworks apply, often at the same time: the EU AI Act (binding, risk-based, extraterritorial, with fines of up to 7% of global turnover), the GDPR (lawful basis for training data, Art. 9 for health and genetic data, DPIA), the MDR and IVDR where the AI is medical device software, US FDA expectations for AI-enabled devices, and the international standards regulators read against, ISO/IEC 42001, ISO 14971 and IEC 62304.
AI Compliance is our track for organisations that develop AI systems and place them on the market or put them into service. We build provider obligations in by design, so that they are not retrofitted under notified-body pressure. If you mainly use third-party AI tools, start with AI Governance for deployers.
AI Compliance for Providers: From Classification to Post-Market
The EU AI Act allocates the heaviest obligations to providers of high-risk AI systems: diagnostic AI, clinical decision support, AI in medical devices and triage systems all sit in that tier through Annex I (products already subject to MDR/IVDR conformity assessment) or Annex III. Limited-risk systems such as patient-facing chatbots carry transparency duties; minimal-risk internal tooling carries no new AI Act obligation, but the GDPR still applies whenever personal data is processed.
We deliver the full provider file: classification, risk management, data governance, technical documentation, human oversight, registration and post-market monitoring, structured so that it integrates with the quality and regulatory systems you already operate.
Every AI system you develop receives a reasoned, documented classification: prohibited, high-risk, limited-risk or minimal-risk, with your role per system (provider, deployer, importer, distributor) and the interaction with MDR/IVDR device classification. Where a system also embeds a general-purpose AI model, we map the additional GPAI obligations.
The classification opinion is the anchor of the whole compliance file: it sets the scope of obligations, the conformity assessment route and the evidence that authorities and notified bodies will expect.
For high-risk systems we build the complete technical documentation package required by Art. 11 and Annex IV EU AI Act, ready for notified bodies and market surveillance authorities: risk management system (Art. 9), data and data governance (Art. 10), record-keeping and logging (Art. 12), transparency and instructions for use (Art. 13), human oversight (Art. 14), and accuracy and robustness evidence (Art. 15).
We integrate the AI quality management system of Art. 17 with your existing ISO 13485 QMS, align risk management with ISO 14971 and software lifecycle with IEC 62304, and manage EU declaration of conformity, CE marking and registration in the EU database (Art. 49). See also our medical devices practice.
AI systems that process health or genetic data need a combined assessment: the GDPR DPIA (Art. 35) on lawful basis, Art. 9 conditions, minimisation, retention and transfers of training, validation and inference data, and the AI Act risk assessment on bias, performance and impact on individuals.
We run both in a single exercise, building on our DPIA methodology and, where applicable, the Fundamental Rights Impact Assessment of Art. 27, so that your privacy and AI evidence tell one consistent story.
AI used in clinical development raises its own questions: AI-generated or AI-processed evidence in trials, algorithms trained on study data, decision support offered to investigators, and disclosures owed to participants under EU CTR 536/2014 and the GDPR.
We set up an AI development governance SOP and a repeatable assessment toolbox (risk classification plus conformity checklist) so that every model your R&D, data-science or medical teams build is assessed the same way, and we align protocol and informed-consent language with our clinical trials and clinical research practices.
Compliance does not end at market entry. We draft your post-market monitoring plan (Art. 72), set up the serious-incident reporting process to market surveillance authorities (Art. 73), define log retention, and put in place the change-control logic that decides when a model update is a substantial modification requiring re-assessment.
Where your device is also under MDR/IVDR, the plan is merged with your existing post-market surveillance and vigilance system rather than run in parallel.
Providers established outside the EU must appoint an authorised representative in the Union before placing a high-risk AI system on the EU market (Art. 22 EU AI Act). The representative holds the technical documentation, cooperates with authorities and verifies that the conformity assessment has been carried out.
iliomad acts as EU AI Act Authorised Representative for US, UK, Swiss and other non-EU developers, alongside our EU, UK and Swiss data protection representative mandates.
How iliomad Health Data Takes Your AI Systems Through Regulation
We work as an extension of your regulatory, quality and data-science teams. Our consultants have classified and documented AI systems for diagnosis, monitoring, imaging and genomics, and we bring the GDPR, MDR/IVDR and AI Act evidence together in one file that withstands regulatory scrutiny.
Start with our guide to the EU AI Act and our analysis of what Life Sciences companies must do before the high-risk obligations apply. If your teams also use third-party AI tools, our AI Governance track covers the deployer side. Get in touch to scope your compliance programme.
FAQs
Our frequently questions
An AI Compliance Framework is the operational infrastructure that ensures your AI systems meet EU AI Act, MDR/IVDR, GDPR, and related regulatory requirements through systematic classification, risk management, governance structures, and ongoing monitoring. Organizations developing or deploying AI in healthcare must demonstrate audit-ready compliance a robust framework transforms regulatory obligations into repeatable, defensible processes that satisfy authorities, notified bodies, and investors.
Our comprehensive framework includes classification and risk assessment (determining your AI system's regulatory category), AI quality management systems (QMS integration with ISO 13485 and MDR/IVDR), ethical compliance and oversight structures, technical documentation packages, fundamental rights impact assessments, and post-market monitoring systems. Each component is tailored to your AI system's risk level, intended use, and regulatory pathway while maintaining consistency with existing quality and compliance infrastructure.
AI-enabled medical devices must simultaneously comply with EU AI Act requirements and MDR/IVDR obligations, creating overlapping documentation, risk management, and post-market surveillance requirements. We design integrated compliance frameworks that harmonize AI Act conformity assessment with MDR/IVDR technical files, align AI risk management with ISO 14971 medical device risk processes, and coordinate notified body submissions to avoid duplication while meeting both regulatory regimes efficiently.
Implementation timeline depends on AI system complexity, regulatory classification, and existing quality management maturity, typically ranging from 8-16 weeks for initial framework establishment. High-risk medical AI systems require more comprehensive documentation and validation, while limited-risk systems can achieve compliance more rapidly we prioritize regulatory blockers first (classification, risk assessment, essential documentation) while building comprehensive governance systematically.
Contact us through our website form or email directly. We'll schedule an initial consultation to understand your regulatory landscape, identify immediate priorities, and propose a tailored engagement that fits your timeline and budget.
Any Questions ?
