Quality management for AI-supported medical devices
The EU AI Act introduces an additional regulatory framework for medical device manufacturers who develop AI systems for medical devices or place them on the market as a component of their products, alongside the established medical device regulations. This raises a practical question, particularly for manufacturers with an existing quality management system compliant with ISO 13485: do new, parallel structures need to be established, or can the AI regulations be integrated into the existing QMS?
EN 18286:3036 has been harmonised under the AI Act
With EN 18286:2026 ‘Artificial intelligence – Quality management system for EU AI Act regulatory purposes’, there is now, for the first time, a harmonised European standard to support the AI Act. Its reference was published in the Official Journal of the European Union in October 2026. This makes it the first harmonised standard under the AI Act.
Essentially, EN 18286 translates the regulatory requirements for quality management set out in Article 17 of the AI Act into specific organisational and operational QMS requirements. In doing so, it takes into account the life cycle of the respective AI system. In addition to ISO 9001 and ISO/IEC 42001, the European Commission explicitly mentions a sector-specific QMS in accordance with ISO 13485. This is crucial for medical device manufacturers: EN 18286 is not to be understood as a separate management system, but can be integrated into existing management systems.
For medtech manufacturers, the key question is therefore not:
“Do we need a second QMS alongside ISO 13485?”
But rather:
“Which requirements of EN 18286 does our existing QMS already cover, and where do we need to extend it specifically for AI?”
It is precisely this analysis that provides a sensible starting point for practical implementation.
ISO 13485 alone is not sufficient for the development of AI-enabled products
The good news for medical device manufacturers: the practical approach should therefore not involve setting up a separate, second management system alongside the existing medical device QMS. Rather, it is a matter of specifically extending existing processes where EN 18286 imposes additional requirements on governance, regulatory evidence management and the lifecycle management of AI systems.
This involves, in particular, systematically identifying regulatory requirements for each AI system and setting them out in a documented regulatory compliance strategy. EN 18286 thus broadens the scope of a traditional medical device QMS: the focus is not only on the medical device and its regulatory lifecycle, but also on the AI system used within it or associated with it.
[Image is AI-generated]
This extension also affects the understanding of risks and protection objectives. Alongside health and safety, fundamental rights play a central role in the AI Act. For manufacturers, this means considering, throughout the AI lifecycle, what impact an AI system may have on these protected legal rights. This adds a dimension that is not given the same level of focus in a traditional ISO 13485 QMS.
The key changes: data, lifecycle and AI governance
The additional need for action is particularly evident in the area of data management. Whilst a QMS in accordance with ISO 13485 already contains comprehensive requirements for the development and control of medical devices, data itself becomes a central focus of quality management in the context of AI systems. Manufacturers must therefore establish suitable processes covering the entire data lifecycle. This covers, amongst other things, the collection and gathering, analysis and labelling, storage and filtering, as well as the aggregation and retention of data, right through to the controlled archiving or destruction of data that is no longer required. At the same time, the requirements for the AI system must be systematically derived and documented. Key starting points are, in particular, the intended purpose and the reasonably foreseeable misuse of the AI system. Regulatory requirements are translated from these into specific requirements for development and operation. As a result, AI-specific characteristics such as accuracy, robustness, cybersecurity, transparency and human oversight are given greater prominence in the development QMS, on a par with the requirements for data and records. The AI Act addresses these issues as key requirements for high-risk AI systems.
[AI-generated]
Another significant change lies in the consistent lifecycle perspective. EN 18286 is explicitly aligned with the lifecycle of the AI system. For manufacturers, this means that consideration of the AI system does not end with development, verification and validation. Maintenance, updates, modifications and, above all, the newly introduced retraining must also be integrated into appropriate QMS processes. This is particularly relevant for systems whose models or performance characteristics may change after they have first been placed on the market. Changes must be assessed and documented in terms of their impact on risks, intended purpose and quality. This also includes the cumulative effects of multiple changes and the controlled management of pre-defined changes.
Supplier management is also taking on a new dimension. The supply chain of an AI system does not consist solely of traditional components or outsourced services. Data sources, training and test data, as well as externally carried out activities within the AI lifecycle, must also be incorporated into supply chain management. This means that existing supplier control processes must be reviewed to ensure they adequately account for these new dependencies.
Finally, post-market monitoring is also to be expanded. Traditional sources such as feedback, complaints and incidents remain relevant, but are not necessarily sufficient for AI systems. Added to these are AI-specific sources of information and developments, such as system logs, emerging risks (e.g. model drift), interactions with other AI systems, or feedback from affected individuals.
Three things medical device manufacturers should do now
For medical device manufacturers, the most pragmatic way to implement EN 18286 is via their existing quality management system. Rather than setting up parallel structures, manufacturers should now focus on three key areas of action.
[AI-generated]
Conduct a targeted review of the existing ISO 13485 QMS for AI gaps
The starting point should be a structured gap analysis that examines at least the following existing processes:
- Design & Development
- Risk management
- Supplier management
- Post-market surveillance
- Change Control
- Management Review
These processes should be systematically aligned with AI-specific requirements. Particular attention should be paid to issues that go beyond the existing requirements of ISO 13485. A key example is end-to-end data management for AI systems or the regulatory compliance strategy.
Clearly define AI governance and responsibilities
For each AI system, it should first be clarified what regulatory role(s) and scope apply, and what requirements result from these. Building on this, responsibilities for regulatory compliance, AI risk management and decision-making throughout the entire life cycle must be clearly defined. This also includes the question of the necessary expertise: in addition to medical device legislation and quality management, knowledge of AI technologies, data, the AI Act and AI-specific risks to health, safety and fundamental rights is required. If this expertise is not available, it should be developed as part of a training programme for specific groups and individuals.
Operationalise data and lifecycle processes at an early stage
In future, data management should no longer be viewed solely as part of individual development activities, but as a separate component of the QMS. In practice, for example, robust version control and traceability are required between the AI system, the models used, relevant data sets and technical documentation. At the same time, processes must be defined for updates and retraining, changes, monitoring, logs and the management of newly identified risks.
Conclusion: Not a second QMS, but a significantly expanded one
For medical device manufacturers with an established quality management system in accordance with ISO 13485, EN 18286 does not mean starting from scratch. Many key mechanisms and processes are already in place and can serve as a basis for implementing the additional requirements of the AI Act.
The pragmatic approach is therefore to utilise existing structures, identify AI-specific gaps and systematically address them. A functioning ISO 13485 QMS provides medical device manufacturers with a good starting point for this. However, it does not replace the need to engage specifically with the new requirements for AI systems.
This is precisely where ai6 Solutions can help: from a structured gap analysis between the existing QMS and EN 18286 to the practical integration of the necessary AI processes into quality management. Our approach is deliberately pragmatic: “We uncomplicate medtec for our customers.” After all, AI-Act compliance should not mean making established and functioning processes unnecessarily more complicated, but rather developing them further in a targeted manner where AI actually introduces new requirements.
Please note that all information and lists are not intended to be exhaustive, are provided without guarantee and are for information purposes only.
