The Change-Control Gap Between MDR and the AI Act

The gap is not that two frameworks apply. It is that neither has a shared change-control instrument.

It is well established by now that a CE mark under MDR or IVDR does not, on its own, satisfy the EU AI Act. AI-enabled medical devices sit inside the AI Act’s high-risk category on their own terms, and the two regimes are converging on the same products without a shared procedural bridge, as Healthcare in Europe has documented. That much is settled in trade press and counsel briefings. The harder question, and the one compliance leads still need answered, is what specific mechanism is producing the duplication of work, not just the fact that duplication exists.

The mechanism is change control. MDR and IVDR conformity assessment is built around a device design that is fixed at certification, with defined triggers for re-assessment when that design changes. Adaptive algorithms, the kind doing risk scoring or pattern detection at scale, do not sit still inside that model. The FDA side of the market has been building a formal instrument for this exact problem: Predetermined Change Control Plans, which let a manufacturer pre-specify how an AI model is allowed to evolve without triggering a fresh submission every time. IMDRF has now published key principles urging regulators to adopt PCCPs, which is itself an admission that most regulatory regimes, the EU AI Act included, do not yet have an equivalent, harmonized mechanism for pre-authorizing algorithm change. Manufacturers building for the US market are already reconciling ISO 13485 design controls, ISO 14971 risk management, ISO 20417 lifecycle documentation, and PCCP guidance in a single submission, according to Quality Magazine. The EU has no parallel instrument that lets a manufacturer pre-clear the same kind of adaptive change once and carry it across both the device file and the AI Act risk management system.

That absence is what turns a known regulatory overlap into an operational cost. NGeneBio’s recent IVDR certification for its hereditary breast and ovarian cancer diagnostic panel is a clean illustration: a valid device certificate that still leaves an open, separate AI Act conformity question wherever the underlying algorithm does adaptive scoring, per The Asia Business Daily. Without a PCCP-equivalent, every meaningful model update risks being treated as a new

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The central argument—that the absence of a PCCP-equivalent mechanism is the specific source of operational burden—is coherent and logically structured, but the piece asserts without evidence that the
Source & Claim Verification	Qwen · local	cleared. Most claims are well-supported by citations, but the final sentence is incomplete and lacks a citation, potentially leaving a critical point unverified.
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately identifies the change-control gap between MDR/IVDR and the EU AI Act, aligning with ISO 42001’s lifecycle management requirements and the FDA’s PCCP framework, though it does n
Technical Accuracy	Llama	cleared. The article accurately highlights the lack of a shared change-control instrument between MDR/IVDR and the EU AI Act, and correctly identifies Predetermined Change Control Plans (PCCPs) as a potential
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies a specific regulatory gap and supports its claims with relevant external sources, demonstrating a good balance of information without undue vendor hype.
Novelty & Non-Duplication	Grok	held. The change-control/PCCP-absence angle is only a thin restatement of settled dual-regime coverage plus recent IMDRF wire, not a genuinely new finding versus the catalogue.
Validation	DeepSeek	cleared. The central claim that the EU lacks a shared, pre-authorizing change-control instrument for AI-enabled medical devices is validated by the absence of such a mechanism in the AI Act and the IMDRF’s cal

Sources cited: 15. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.