Regulations governing the use of AI systems

The regulations for medical devices are particularly important for AI systems in the healthcare sector. In addition, the forthcoming AI Act introduces key principles and will impose requirements on both manufacturers and users (e.g. healthcare organisations) of high-risk AI systems [32]. Although the AI Act has not yet entered into force in Norway as of 2024, it may be appropriate for organisations to begin considering its requirements now, particularly when planning to procure high-risk systems. The Personal Data Act and the general health legislation also provide important frameworks for the use of AI systems [33].

Intended purpose

The intended purpose of an AI system, i.e. the purpose for which the system is designed to be used, determines which regulations apply [34]. General-purpose AI models (GPAI models) [35] do not have a specific intended purpose on their own, but they can be incorporated into systems that has a medical purpose. They fall under specific regulations in the EU regulation for AI.

Under the Medical Device Regulations, AI systems are considered medical devices if they are intended for use on human beings for the purpose of diagnosing, preventing, monitoring, predicting, prognosing, treating or alleviating disease [36][37]. Other types of AI systems, such as those used for logistics or shift scheduling, do not typically fall under medical device regulations. However, AI systems like electronic health record systems may include additional functions that could result in their classification as medical devices. The EU Medical Device Coordination Group (MDCG) [38] has published guidance documents to assist in determining when software qualifies as a medical device under EU law [39].

• If the intended purpose is medical, the following applies:
  • The AI system is considered a medical device, and the organisation must procure a CE-marked device [40]. The equipment must fulfil the documentation requirements set out in the Medical Devices Regulation.
  • The AI system will generally be considered a high-risk system in accordance with the AI Act and must comply with the requirements set for these systems when the Act enters into force [41].
• If the intended purpose is not medical, the following applies:
  • The AI system is considered a high-risk system under the AI Act if the intended purpose is listed in Annex III and must fulfil the requirements therein when it enters into force [42]. This applies, for example, if the AI system influences an individual's right to receive public benefits or health services [43]. In this case, public service providers are required to conduct a Fundamental Rights Impact Assessment (FRIA) [44].
• If the AI system is intended to interact directly with natural persons, the following applies, with some exceptions:
  • The AI Act requires transparency: The AI system must be designed and developed so that affected individuals are informed that they are interacting with an AI system [45].
• Additionally, the organisation must assess whether the AI system may fall under other product legislation [46]. The section Alignment of product legislation on EU's website for the New legislative framework provides an overview of relevant product categoreis [47].

The legislation for medical devices [48]

The Norwegian laws and regulations on medical devices implement the EU Medical Devices Regulations (MDR and IVDR). If an AI system is to be used for a medical purpose, a medical device must be procured. While similar systems may be available on the market under other regulations, they do not meet the safety requirements for medical devices.

• Medical devices can only be marketed, distributed, or put into use when the devices comply with the fundamental requirements for safety and performance in accordance with the regulations, have undergone conformity assessment, and bear the CE mark, as outlined in § 7 of the Regulation on the use of medical d​evices (Håndteringsforskriften). This regulation require that the organisations ensure that medical devices are suitable for their intended use and that they are used in accordance with the manufacturer’s enclosed instructions for use.

Risk classes for medical devices

The extent of the conformity assessment required under the Medical Device Regulation depends, among other factors, on the risk class of the medical device [49].

Medical devices are classified into four risk classes (I, IIa, IIb and III) based on the level of risk associated with their intended use. For most types of class I devices, manufacturers may self-declare conformity. For class IIa, IIb and III devices (as well as equipment in classes Ir, Is and Im), a certificate from a notified body is required. An overview of classification rules can be found on the Norwegian Medical Products Agency website [50].

Medical devices intended for in vitro diagnostics (IVD) have their own classes (A, B, C and D) [51]. A certificate from a notified body is required for IVD equipment in classes B, C and D

Manufacturer responsibility

If a medical device is used for a purpose other than that stated in the declaration of conformity, or if the organisation modifies the device in a way that may affect compliance with the applicable requirements, the organisation assumes the legal obligations of a manufacturer under the MDR. This includes full responsibility for ensuring that the AI system meet all applicable safety and regulatory standards [52].

An example of this from diagnostic radiology [53]:

• An AI system developed for use in adults cannot automatically be used on children (ages 0–18). Children are not simply “small adults,” and special expertise is required to assess whether the AI system is safe for paediatric use and whether its performance on children is comparable to that on adults. If the system was CE-marked for adult radiology, but is intended to be used for children, it must be tested for the new age group through a clinical trial. In such cases, the organisation takes on manufacturer responsibility for the AI system.

Healthcare institutions may develop medical devices for internal use. The Norwegian Medical Products Agency's website provides guidance on the applicable requirements [54].

Transitional arrangements

Some medical devices currently on the market are still regulated under the previous EU regulations [55]. Transitional provisions have been introduced to bridge the gap between old and new regulations and to avoid shortages in the European market. For details, refer to the DMP’s website [56].

Clinical trial of an AI system that is not CE marked

If no suitable CE-marked alternative exists, or if an unmarked AI system is considered appropriate, organisations must apply for approval to conduct a clinical trial. Applications should be submitted to both the Norwegian Medical Products Acency(DMP) and the Regional Committees for Medical and Health Research Ethics for Clinical Trials (REK KULMU) [57].

FDA approval

Medical devices that are approved by the US Food and Drug Administration (FDA) [58], but have not undergone EU conformity assessed and do not carry the CE mark, cannot legally be used in Norway or elsewhere in the EU/EEA. They should therefore not be procured for clinical use. Manufacturers sometimes offer different models or versions of their devices for the U.S. and European markets. In such cases, it is important to ensure that the version being procured is the CE-marked model intended for use in the EU/EEA.

The AI Act

The purpose of the AI Act is to promote and increase the use of human-centred and trustworthy AI systems, while ensuring a high level of protection of health, safety and fundamental rights, including key democratic values, such as the rule of law and the environmental sustainability, against harmful effects that may result from AI systems. At the same time it aims to support innovation.

The AI regulation was published on 7^th July 2024 [59], and its various provisions will enter into force gradually over time [60]. The Norwegian government has stated its intention to ensure that the AI Act is incorporated into the EEA Agreement as swiftly as possible [61].

To support compliance, the European Commission has mandated the development of harmonised European standards. These will provide technical specifications to help manufacturers and users meet the requirements set out in the regulation [62].

A key principle of the AI Act is that risk classification is based on the system’s intended use, not solely on the technical characteristics of the AI system itself. As a result, the same AI model may be considered limited risk in one application, but high risk in another, depending on the context in which it is deployed.

High-risk AI systems

Under the AI Act, an AI system may be classified as high-risk in two ways: If it is part of a regulated product category (e.g. medical devices) or if it is used for a regulated purpose [63].

The specific requirements for AI systems that are, or form part of, medical devices will apply from 2^nd August 2027 [64]. For high-risk systems used for purposes listed in Annex III, the requirements will come into force on 2^nd August 2026.