What actually stops AI in healthcare, and which deadline now applies

Two things about AI in healthcare no longer match the way they are usually said. One is a date that moved this summer but still stands in the guidance the sector cites. The other is the assumption about what is actually holding development back.

The date in the guidance no longer holds

The joint guidance from the AI Board and the Medical Device Coordination Group, AIB 2025-1 and MDCG 2025-6, is the text most people point to when the interplay between the MDR, the IVDR and the AI Act has to be explained. It was published in June 2025 and gives 2 August 2027 for the Annex I obligations.

Since then, amending Regulation (EU) 2026/1744 has changed Article 113. The text now provides that Chapter III sections 1, 2 and 3 apply from 2 December 2027 for systems classified as high risk under Article 6(2) and Annex III, and from 2 August 2028 for systems classified as high risk under Article 6(1) and Annex I.

Medical devices belong to Annex I. Their date is therefore 2 August 2028, a year later than the guidance states.

The gap between the two high-risk tracks is eight months, and it is not arbitrary. The whole rescheduling is covered in our review of the new deadlines.

The substance of the guidance still stands. The timing in it does not.

The distinction matters, because the guidance is useful in every other respect. It states plainly when a medical device AI counts as high risk: when it is either a safety component or is itself a medical device, and it is at the same time subject to a third-party conformity assessment by a notified body. Both conditions have to hold. The guidance also describes the relationship between the regimes as a simultaneous and complementary application: the AI Act adds requirements addressing hazards and risks specific to AI systems, and replaces nothing in the MDR or IVDR.

The reported obstacle is not the assumed one

The second assumption is that access to data is what holds development back. It is a reasonable guess, and three Swedish sources point elsewhere.

The SLIT report, compiled by the network of IT directors of Sweden's healthcare regions, ranks the largest obstacles to continued digital development as the same as the year before: a shortage of their own resources, followed by finances and unclear legislation. Access to data does not appear among them. The ranking should be read as exactly that, a ranking. SLIT grades the obstacles on a five-point scale and reports no percentages, and the edition does not state how many of the twenty-one regions submitted input. It says in what order the IT directors place the obstacles, not how large they are.

Two other sources supply the numbers SLIT does not, and they measure something else.

Vårdkartan, AI Sweden's survey from April 2025, counted 179 AI initiatives across seventeen of the twenty-one regions. Twenty-four of them, thirteen per cent, were fully implemented and integrated.

The Swedish Medical Association's survey of the regions, published in June 2025 and including eighteen of the twenty-one regions, shows where it stalls organisationally: ten of the eighteen have no policy for how AI may be used by clinical staff, thirteen call for a national recommendation, and a single region fully agrees that it has sufficient resources and competence.

The SLIT report also describes what is actually in use, and the list runs in two directions. On the administrative side there are chatbots that retrieve information for staff, automatic clinical documentation of the kind known as ambient scribes and AI-supported optimisation of scheduling. On the clinical side there is speech recognition writing straight into the record, introduced in every region to varying degrees, and mammography screening where AI reviews the low-risk images together with a breast radiologist instead of the previous double reading by two radiologists. Region Östergötland has used that solution since 2019.

The three sources point the same way, and mammography settles the data question. If access to sensitive data were what held development back, the application working on the most sensitive images of all would be the one that never reached service. It is in service, and has been since 2019. That half the initiatives sit as ongoing and only thirteen per cent as finished, while ten of eighteen regions have no policy for how AI may be used, describes an organisational bottleneck instead: more is being built than is being put into service, and what is built often lacks the governance that would allow it to go live.

What the observations mean together

Another year on the timetable sounds like relief. It is relief only for whoever uses the time.

Moving a deadline does not solve a resource shortage, and it does not solve finances. What moves is only the outer limit for when the Chapter III requirements must be met, and for most organisations that was not the binding constraint to begin with. The third item on the regions' list, unclear legislation, is partly a question of knowledge, and there a year makes a difference if it is spent working out which systems are actually covered.

There is also a risk in the extra time that is worth stating plainly. The requirements in the MDR and IVDR are unchanged. An organisation that defers its work by pointing at the AI Act's new date is not deferring anything that applies under medical device law, and that is where the bulk of the documentation effort sits.

Three steps that need no new deadline

1. Establish which AI systems are already in use. Including those that entered the organisation as a feature of a system you already had. The inventory is the precondition for everything else.
2. Decide your role for each of them. Provider and deployer are different things under the AI Act and carry different obligations. A care provider that builds its own tools can be both, for different systems.
3. Check which are subject to a third-party conformity assessment. That condition, together with the product characteristic, is what decides the high-risk question for medical devices. Without that answer there is no way to know which of the two dates is yours.

The classification in any given case is settled together with the notified body, and that assessment has to be made before the timetable is set.