Two Important Updates: Regulation (EU) 2026/1744 and ISO 9001:2026

4 November 2026

Two important developments have recently taken place in the fields of artificial intelligence, medical devices and quality management systems: the publication of Regulation (EU) 2026/1744 – Digital Omnibus on AI and the new edition of ISO 9001:2026.

Both developments introduce considerations that manufacturers, conformity assessment bodies and certified organizations should begin addressing in their regulatory and quality management strategies.

Regulation (EU) 2026/1744 – Digital Omnibus on AI

Regulation (EU) 2026/1744 was published in the Official Journal of the European Union on July 24, 2026 and entered into force on July 27, 2026.

The Regulation introduces amendments primarily to Regulation (EU) 2024/1689 – the Artificial Intelligence Act (AI Act). Its objectives include simplifying implementation, reducing potential duplication between the AI Act and sector-specific Union legislation, and clarifying conformity assessment and transitional provisions for high-risk AI systems.

What does this mean for medical devices?

The Medical Device Regulation (EU) 2017/745 (MDR) and In Vitro Diagnostic Medical Device Regulation (EU) 2017/746 (IVDR) are included among the Union harmonization legislation listed in Annex I, Section A of the AI Act.

However, an important distinction must be made:

The incorporation of AI into a medical device does not automatically make the AI system a high-risk AI system under the AI Act.

Under Article 6(1), the classification of a product-related AI system as high-risk depends primarily on whether:

the AI system is itself a product or a safety component of a product, and
the relevant product is required to undergo a third-party conformity assessment under the applicable Union harmonization legislation.

AI functions used for purposes such as user assistance, performance optimization, service efficiency, automation, usability or non-safety-related quality control may therefore not necessarily constitute safety components.

However, where the failure or malfunctioning of the AI system could create a risk to the health or safety of persons, its role as a safety component must be carefully assessed.

Integration of AI Act and MDR/IVDR conformity assessment

One of the most significant developments introduced by Regulation (EU) 2026/1744 concerns the conformity assessment of product-related high-risk AI systems subject to MDR or IVDR.

Rather than establishing a completely separate parallel AI Act conformity assessment, applicable AI Act requirements are to be addressed within the relevant sectoral conformity assessment procedure.

This includes the applicable AI Act requirements and the Quality Management System requirements under Article 17 of the AI Act.

The Regulation also establishes a mechanism intended to reduce unnecessary duplication where requirements under sectoral Union legislation provide an equivalent or higher level of protection.

Further European Commission guidance on the complementary and proportionate application of sectoral QMS and risk management requirements together with AI Act requirements is expected by August 1, 2027.

What changes for manufacturers?

For manufacturers of AI-enabled medical devices, determining whether the AI system falls within the high-risk framework becomes a critical regulatory step.

Where the system qualifies as high-risk, AI-specific requirements will need to be addressed alongside existing MDR/IVDR requirements.

These include, among others:

risk management,
data and data governance,
technical documentation,
record-keeping and traceability,
human oversight,
accuracy,
robustness, and
cybersecurity.

AI Act risk management and quality management requirements may be integrated into existing MDR/IVDR QMS and risk management processes, helping to avoid unnecessary duplication while ensuring that AI-specific risks are adequately addressed.

The Regulation also provides for a simplified technical documentation approach for certain operators where the applicable conditions are met.

What changes for Notified Bodies?

The Regulation also has significant implications for Notified Bodies.
Being designated under MDR or IVDR does not, by itself, establish the competence required to perform conformity assessment activities for high-risk AI systems.

Notified Bodies wishing to perform these activities must meet additional requirements relating to competence, organizational capability, independence and AI-specific technical expertise.

To facilitate the process for existing sectoral Notified Bodies, Regulation (EU) 2026/1744 provides for mechanisms including:

a single application,
a combined assessment process, and
the possibility of using documentation from existing sectoral designation processes.

Relevant existing Notified Bodies benefiting from the transitional arrangements are expected to submit their AI Act designation applications by January 28, 2028.

A new competence framework: AIP and AIH codes

Another important development is the introduction of a new Annex XIV code system for defining the scope of Notified Body designation under the AI Act.

The structure includes:

AIP codes, linked to applicable product legislation, and
AIH horizontal technology codes, identifying the AI technologies involved.

AIH codes cover a broad range of technologies, including knowledge-based and symbolic AI, structured data, signal/audio, text, image/video and environment-learning systems, as well as generative AI and emerging AI technologies.

This introduces an important change in the competence model for conformity assessment.

It will no longer be sufficient to consider only what type of medical device is being assessed. The specific AI technology used within that device will also become relevant when determining whether the conformity assessment body has the necessary competence.

July 27, 2026

Regulation (EU) 2026/1744 entered into force.

August 1, 2027

Expected Commission guidance on the complementary and proportionate application of AI Act and sectoral QMS/risk management requirements.

August 2, 2027

Expected measures concerning overlapping requirements between sectoral legislation and the AI Act.

December 2, 2027

Relevant application date for high-risk AI systems falling under Article 6(2)/Annex III.

January 28, 2028

Important transitional deadline for AI Act designation applications by relevant existing Notified Bodies.

August 2, 2028

Key application date for Article 6(1) product-related high-risk AI systems, including relevant systems associated with MDR/IVDR products.

Transitional considerations

Transitional provisions also apply to high-risk AI systems placed on the market or put into service before the relevant application dates.
Where a significant design change is introduced after the applicable date, the new AI Act requirements may become applicable.

It is important that the AI Act concept of a “significant change” is not automatically treated as equivalent to the substantial or significant change concepts used under MDR/IVDR. The assessment should be performed separately under the applicable legislative framework.

Regulation (EU) 2026/1744 is not guidance or an industry position paper. It is a directly applicable and legally binding EU Regulation.

For manufacturers and Notified Bodies involved with AI-enabled medical devices, the key questions are therefore becoming increasingly clear:

Is the AI system high-risk? Is it a safety component? Which AI-specific requirements apply? How should those requirements be integrated into the existing MDR/IVDR framework? And do both the manufacturer and the Notified Body have the necessary competence to demonstrate and assess compliance?

ISO 9001:2026 – A New Edition of the Quality Management Systems Standard

ISO published ISO 9001:2026 – Quality management systems — Requirements in September 2026.

The sixth edition replaces ISO 9001:2015 while retaining the fundamental principles and structure of the ISO 9001 quality management approach.
The revision introduces updates intended to reflect the changing organizational environment and evolving expectations placed on quality management systems.

Key changes

Among the areas receiving increased or clearer emphasis in ISO 9001:2026 are:

quality culture and ethical behavior,
clearer consideration of risks and opportunities,
strengthened change management,
continued consideration of climate change when evaluating organizational context and relevant interested parties, and
updated terminology and explanatory content.

These changes do not fundamentally alter the quality management philosophy of ISO 9001. Rather, they reinforce the expectation that quality management systems remain responsive to organizational change, emerging risks and the broader environment in which organizations operate.

What does this mean for ISO 9001:2015-certified organizations?

The publication of ISO 9001:2026 does not mean that existing ISO 9001:2015 certificates immediately become invalid.

Organizations currently certified to ISO 9001:2015 should begin by reviewing the revised standard and identifying differences between their existing management systems and the new requirements.

A structured gap analysis can provide the basis for determining whether changes are needed in areas such as policies, processes, risk and opportunity management, organizational culture, change management and documented information.

Whitepaper: The revised ISO 9001 explained

This whitepaper provides a clear, business oriented overview of the most impactful changes of the ISO 9001, explaining their practical implications to help Quality Managers ensure a smooth and efficient transition to the new standard.

Click here to download the whitepaper

Transition to ISO 9001:2026

Detailed transition timelines and certification arrangements will be defined through the relevant requirements and guidance issued by ISO, IAF and accreditation bodies.

Certified organizations should therefore avoid treating the publication of the new edition as requiring an immediate replacement of their existing certification.

Instead, the transition should be approached as a planned management-system activity involving:

understanding the revised requirements,
identifying applicable gaps,
determining necessary changes,
implementing those changes within the QMS, and
following official transition arrangements as they are published.

Looking ahead

Although Regulation (EU) 2026/1744 and ISO 9001:2026 address very different regulatory and standardization frameworks, they reflect a common direction.

Competence, risk-based thinking, effective change management and the ability to integrate emerging technological requirements into established management systems are becoming increasingly important.

For organizations operating in regulated and technology-driven sectors, understanding these developments early will help support a more structured and effective transition.

If you're considering transferring your ISO 9001 certificate, this article will walk you through the process, costs, and benefits of making the switch. Ensuring you of a smooth transition to Kiwa.

Medical devices manufactured or traded in the EU must comply with EU legislation in safety and health. This means they must be conformed to the pertaining product directives and regulations and must be CE marked.