An AI system training a predictive cardiology model today may not be subject to the EU AI Act — but the same system, validated and running six months later, could fall under both the AI Act and the MDR. Is your ethics committee ready?

A new paper published in European Cardiology Review by researchers from Italy's National Research Council and Careggi University Hospital addresses a question that has been generating quiet anxiety in clinical research ethics circles across Europe: how do the obligations of the EU AI Act actually apply to the different stages of an AI clinical study, and what does that mean concretely for researchers designing protocols and ethics committees evaluating them?

The paper is practical in orientation and draws directly on the authors' experience reviewing clinical protocols involving AI, including at the Paediatric Ethics Committee of Tuscany's Meyer IRCCS University Hospital. That grounding shows. The problems it identifies are not theoretical. They are the recurring patterns of inadequately described AI study protocols landing on ethics committee desks with no clear articulation of what the system does, where its training data came from, how the training and test sets were divided, or whether the AI component constitutes a medical device under EU law.

The core regulatory clarification the paper provides is important and underappreciated in practice. The EU AI Act explicitly exempts AI systems still in research and development from its requirements - but it draws a precise boundary at "testing in real-world conditions," defined in the regulation as temporary testing outside a laboratory or simulated environment with a view to assessing conformity. Once a clinical study crosses that threshold, the AI Act applies. If the AI system at that point also meets the definition of a medical device under the MDR - because it provides diagnostic or therapeutic decision support - then both frameworks apply simultaneously, with overlapping and sometimes non-identical requirements. Sponsors, researchers, and ethics committees are all responsible for understanding where a given study sits relative to that line, and currently many do not.

The authors propose a three-phase lifecycle framework designed to make this clearer in practice. Phase 1 covers algorithm training, where the system is not yet capable of fulfilling its intended clinical purpose, patient data are used purely for model development, and the AI has no impact on clinical decisions. At this stage the MDR does not apply, the AI Act does not apply, but general GDPR, good clinical practice, and ethical principles do - and the authors argue that informed consent forms must explicitly inform patients that their data will be used to train AI, and that the system will not affect their care or clinical responsibility at this stage. Phase 2 covers real-world testing for pre-marketing validation, where the system can now fulfil its intended purpose and is being evaluated on a population different from the training cohort. Here both the MDR and the AI Act engage, requiring data governance documentation, technical documentation for high-risk AI, record-keeping across the system lifetime, human oversight provisions, and cybersecurity assurance throughout the lifecycle. Phase 3 covers post-marketing monitoring of a CE-marked system, with its own continuous surveillance obligations under both frameworks.

The paper is particularly valuable on the Phase 1 documentation problem, which in the authors' experience is the most common source of protocol opacity at ethics committee level. They propose a detailed checklist of what researchers should specify at this early stage: the rationale and criteria for dataset population selection; whether and how pre-trained third-party systems are used or modified; the characteristics of the input data and how they are divided into training, validation, and test sets; whether pre-processing or post-processing steps are applied and how; whether any synthetic data is used; the complete data pipeline from collection through to output; and the access privileges and computational environment - including whether training occurs on local infrastructure or cloud platforms. This level of specificity is not bureaucratic excess. It is what an ethics committee needs to assess whether a study is appropriately designed, whether the population is representative, and whether the risks to participants are correctly characterised.

On the AI Act's broader ethical architecture, the paper situates clinical AI research within the framework of EU fundamental rights law - human dignity, personal autonomy, data protection, protection of minors, non-discrimination - and notes that these obligations apply even when the AI Act itself does not, because the systems being developed will eventually operate in regulated clinical environments. The authors also highlight Recital 73 of the AI Act, which explicitly names consumer associations and patient organisations as stakeholders who should be involved in the design, development, and ongoing oversight of high-risk AI systems. This is not widely implemented in current clinical AI trial design, and the authors argue it should be.

A notable structural point the paper makes is about the current absence of joint assessment procedures. In Europe, clinical investigations involving medical devices are evaluated by both ethics committees and national competent authorities, but there is no equivalent joint evaluation pathway specifically calibrated to AI systems. Researchers designing an AI study have to navigate MDR requirements, AI Act requirements, GDPR data governance obligations, and the local requirements of multiple national ethics committees, with no standardized framework coordinating how these interact. The practical result is heterogeneity in what gets asked, what gets documented, and what level of AI literacy reviewers bring to the assessment.

The AI Act's Article 4 creates a literacy obligation - providers and deployers of AI systems are required to ensure that their personnel have sufficient AI literacy. Ethics committee members and researchers are within scope of this requirement. The authors recommend that professional societies and hospital institutions invest in training courses, refresher seminars, and internal guidance documents to build that literacy systematically rather than expecting each committee to develop it independently.

The phased framework this paper proposes will not resolve every complexity at the intersection of clinical trials regulation and AI governance. But it offers something useful and currently missing: a structured way for researchers to declare where in the development lifecycle their AI system sits, and a corresponding set of evaluation criteria for ethics committees to apply that is calibrated to the actual risk and maturity of the technology being studied. That clarity - about what applies when, and what documentation is needed at each stage - is exactly what the current landscape lacks.

Full paper: https://pmc.ncbi.nlm.nih.gov/articles/PMC12888102/