IVDR and AI Act Compliance for Spectroscopy Diagnostics

If you are building an AI-enabled spectroscopy diagnostic for the European market - an FTIR bacterial classifier, a Raman tissue analyzer, an NIR blood screening system - you now face two regulatory frameworks that apply simultaneously. The In Vitro Diagnostic Regulation (IVDR) governs your device as a diagnostic product. The EU AI Act governs the artificial intelligence component that interprets the spectral data.

Neither framework exempts you from the other. Both require conformity assessment. Both carry serious penalties for non-compliance. And the timelines, while recently extended, are approaching fast enough that the architectural and documentation decisions you make today will determine whether you can sell in Europe in 2028.

This article maps the dual compliance landscape for AI-enabled spectroscopy diagnostics. It covers IVDR classification, AI Act risk categorization, the overlap between the two frameworks, Notified Body requirements, current transition timelines, and a practical roadmap for achieving compliance.

This article is educational and does not constitute legal or regulatory advice - consult qualified regulatory professionals for your specific situation.

Why spectroscopy diagnostics face dual regulation

The core issue is straightforward. Your spectroscopy diagnostic product has two components that trigger independent regulatory frameworks:

The diagnostic function. Your product analyzes a clinical sample - a throat swab, a tissue biopsy, a blood specimen - and produces a diagnostic result. That makes it an in vitro diagnostic medical device under Regulation (EU) 2017/746 (IVDR).

The AI component. Your product uses a machine learning model - a CNN, an SVM, a random forest - to classify spectral data and produce that diagnostic result. That makes it an AI system under Regulation (EU) 2024/1689 (the AI Act).

Before the AI Act, you only needed IVDR compliance. Now you need both. The requirements are overlapping but not identical, and the penalties for the AI Act (up to €35 million or 7% of global turnover) are substantially higher than historical medical device enforcement actions.

The good news: the EU Commission has published guidance (MDCG 2025-6) explicitly addressing this overlap, and the conformity assessment pathways are designed to be integrated rather than duplicated. The bad news: "integrated" does not mean "simple."

IVDR classification for spectroscopy diagnostics

IVDR classifies in vitro diagnostics into four risk classes - A (lowest) through D (highest) - based on seven classification rules in Annex VIII. The classification is determined by your product's intended diagnostic purpose, not by the analytical technology. An FTIR-based diagnostic and an ELISA-based diagnostic that detect the same pathogen get the same IVDR classification.

This is the critical insight for spectroscopy companies: your IVDR class depends on what clinical question your test answers, not on the fact that you use spectroscopy to answer it.

The four classes

Class A - Lowest risk. General laboratory instruments, specimen receptacles, buffer solutions. A Bruker Alpha II spectrometer sold as a general-purpose laboratory instrument is Class A. Workflow software that controls the instrument without making diagnostic claims is Class A. Self-declaration by the manufacturer; no Notified Body involvement required.

Class B - Low-moderate risk. The default class for IVDs that do not fit higher categories. Self-test devices for non-serious conditions (pregnancy, fertility, cholesterol). Control materials and calibrators. Most Class B devices require Notified Body involvement for quality system certification but not for individual product review.

Class C - Moderate-high risk. This is where most AI-enabled spectroscopy diagnostics land. Class C covers:

• Infectious disease detection where an erroneous result could cause serious patient harm (misidentifying a pathogen leads to wrong antibiotic, delayed treatment)
• Cancer screening, staging, and diagnosis
• Companion diagnostics for targeted therapies
• Genetic disease testing
• Prenatal and neonatal screening
• Therapeutic drug monitoring

An FTIR system that classifies bacterial pathogens from clinical swabs? Class C - an erroneous identification could cause serious harm through incorrect treatment. A Raman system that classifies tissue as malignant or benign? Class C - cancer diagnosis. An NIR system screening blood products for contamination? Class C or potentially Class D depending on the specific claim.

Class D - Highest risk. Detection of life-threatening transmissible agents in blood, tissues, and organs for donor screening (HIV, HBV, HCV). Blood group typing (ABO, Rh, Kell). Unless your spectroscopy diagnostic is specifically screening donated blood or tissue for transmissible agents, you are unlikely to land in Class D.

Classification decision flow for spectroscopy diagnostics

Is your product a general-purpose instrument
with no specific diagnostic claim?
    YES → Class A (Rule 5)
    NO  ↓

Does your test screen donated blood/tissue
for transmissible agents (HIV, HBV, HCV)?
    YES → Class D (Rule 1)
    NO  ↓

Does your test perform blood group typing
(ABO, Rh, Kell, Kidd, Duffy)?
    YES → Class C or D (Rule 2)
    NO  ↓

Does your test detect infectious agents,
screen for cancer, guide therapy selection,
or test for genetic conditions?
    YES → Class C (Rule 3)
    NO  ↓

Is your test a self-test for a serious condition?
    YES → Class C (Rule 4)
    NO  ↓

Default → Class B (Rule 6)

Most spectroscopy-based diagnostic tests - pathogen identification, tissue classification, antimicrobial susceptibility, drug screening - fall under Rule 3, placing them in Class C. This classification triggers mandatory Notified Body conformity assessment, which in turn triggers automatic high-risk classification under the AI Act.

What Class C IVDR compliance requires

For a Class C IVD, IVDR requires:

• Quality Management System (QMS) conforming to IVDR Annex IX (aligned with ISO 13485)
• Technical documentation per Annex II and III - device description, intended purpose, design and manufacturing information, general safety and performance requirements (GSPRs), benefit-risk analysis, product verification and validation, clinical evidence
• Performance evaluation - analytical performance (sensitivity, specificity, accuracy, precision, linearity, interfering substances) and clinical performance (comparison to established reference methods, clinical sensitivity and specificity)
• Notified Body conformity assessment - a designated Notified Body reviews your QMS and technical documentation, audits your manufacturing and quality systems, and issues a certificate
• Post-market surveillance (PMS) - a documented plan for ongoing monitoring of device performance in real-world use, including trend analysis and periodic safety update reports
• UDI and EUDAMED registration - mandatory from May 2026 for new devices placed on the market

For teams familiar with the US FDA process, this is roughly analogous to a De Novo or PMA submission in documentation scope, but with mandatory third-party (Notified Body) audit of your quality system rather than FDA review alone. For a comparison of the FDA pathway, see our SaMD classification article.

AI Act risk classification

The EU AI Act classifies AI systems into four risk tiers: unacceptable (prohibited), high-risk, limited risk, and minimal risk. For AI-enabled spectroscopy diagnostics, the relevant question is not whether you are high-risk - you almost certainly are - but which pathway classifies you as high-risk.

Article 6(1): The automatic trigger

Article 6(1) of the AI Act states that any AI system which is itself a product - or a safety component of a product - covered by EU harmonisation legislation listed in Annex I is high-risk, provided it requires third-party conformity assessment under that legislation.

Annex I of the AI Act explicitly lists IVDR (Regulation (EU) 2017/746).

The logic chain is direct:

1. Your AI-enabled spectroscopy diagnostic is an IVD under IVDR
2. It is classified as Class C (or higher) under IVDR
3. Class C requires Notified Body conformity assessment under IVDR
4. Therefore, your AI component is automatically high-risk under Article 6(1) of the AI Act

No separate risk analysis is needed. This is a categorical rule. If your IVDR classification triggers Notified Body involvement, your AI component is high-risk under the AI Act. Period.

The only spectroscopy diagnostics that escape this automatic classification are Class A devices (general-purpose instruments without diagnostic claims) that self-declare under IVDR without Notified Body involvement. If your spectrometer is sold as a laboratory instrument and your software makes no diagnostic claims, you may not trigger Article 6(1). But the moment your software classifies a spectrum and outputs a diagnostic result, you are in scope.

What high-risk AI Act compliance requires

For high-risk AI systems under Article 6(1), the AI Act imposes requirements beyond what IVDR alone demands:

Risk management system (Article 9). A continuous, documented lifecycle risk management process covering AI-specific risks: model drift, distributional shift, adversarial inputs, training data bias, failure modes in edge cases. If you already use ISO 14971 for IVDR risk management, the AI Act requires you to extend it - not replace it - to cover AI-specific hazards. For spectroscopy AI, this means documenting what happens when your classifier encounters a spectrum from an instrument it was not trained on, a sample preparation technique it has not seen, or a pathogen outside its training distribution.

Data and data governance (Article 10). Training, validation, and test datasets must be relevant, representative, free of errors, and complete. Bias assessment across demographic and geographic subgroups is required. Data lineage documentation must be maintained. For spectroscopy AI, this means documenting which instruments generated your training data, which sample preparation protocols were used, what patient populations were represented, and how you assessed cross-site and cross-instrument variability. If your model was trained exclusively on Bruker FTIR data and you deploy on Thermo instruments, this is a data governance finding.

Technical documentation (Article 11 + Annex IV). AI-specific technical documentation addressing: general AI system description, intended purpose, training methodology, validation approach, performance across subgroups, human oversight design, and post-market monitoring plan. The EU Commission guidance (MDCG 2025-6) recommends a single integrated technical file covering both IVDR and AI Act requirements rather than maintaining two separate documentation sets.

Transparency and instructions for use (Article 13). Your instructions for use must explicitly state that AI is used, describe the AI system's limitations and accuracy metrics, specify the circumstances under which human review is required, and explain how to interpret AI outputs. Clinician-facing interfaces must communicate AI confidence levels. This aligns with best practices for explainable AI in clinical spectroscopy.

Human oversight (Article 14). The system must be designed so that human operators can understand AI outputs, detect failures, and override or reverse AI decisions. For spectroscopy diagnostics, this means a pathologist or laboratory director must be able to review the spectral data underlying any classification, understand why the model reached its conclusion, and countermand the result. A black-box classifier that outputs "Positive" with no supporting information does not meet this requirement.

Accuracy, robustness, and cybersecurity (Article 15). Declared accuracy metrics must be validated and documented. The system must perform consistently across input variations - different spectrometer models, environmental conditions, operator techniques. Cybersecurity requirements are additive to existing IVDR requirements.

Post-market monitoring (Article 72). Continuous monitoring for model drift, accuracy degradation, and distribution shift in real-world data, integrated into your IVDR post-market surveillance plan.

EU database registration (Article 71). High-risk AI systems must be registered in the EU database for AI systems - a separate system from EUDAMED.

Dual compliance: How the frameworks interact

The good news is that the EU Commission has explicitly addressed the overlap between IVDR and the AI Act. The MDCG 2025-6 guidance document (published June 2025, jointly by the Medical Device Coordination Group and the AI Board) establishes several important principles.

One manufacturer, one assessment

Under both frameworks, the responsible entity is the same: the "manufacturer" under IVDR equals the "provider" under the AI Act. You do not need separate legal entities or separate regulatory teams for each framework. One integrated quality management system, one integrated technical file, one Notified Body.

Single conformity assessment

For AI systems that are high-risk under Article 6(1) - which includes all AI-enabled IVDs requiring Notified Body assessment - the IVDR conformity assessment procedure is the primary pathway. The Notified Body conducting the IVDR assessment simultaneously evaluates AI Act compliance. You do not need a separate AI Act conformity assessment body.

This is critical: your IVDR Notified Body also handles your AI Act conformity assessment. You do not need dual designation (at least not yet - see the Notified Body section below).

Single technical documentation

MDCG 2025-6 recommends - and most Notified Bodies expect - a single integrated technical file covering both IVDR and AI Act requirements. The IVDR technical documentation (Annex II/III) is extended with AI Act-specific content (Annex IV of the AI Act) rather than duplicated.

In practice, this means adding sections to your existing IVDR technical file for:

• AI system architecture and training methodology
• Training/validation/test data documentation and bias assessment
• AI-specific risk management (extending your ISO 14971 analysis)
• Transparency and human oversight design
• Post-market AI monitoring plan

Performance studies count for both

If you conduct a performance study under IVDR, it also qualifies as real-world testing under AI Act Article 60. You do not need separate clinical studies for each framework. Your spectroscopy diagnostic performance evaluation - sensitivity, specificity, comparison to reference methods - satisfies both IVDR clinical evidence requirements and AI Act accuracy/robustness requirements, provided you also address AI-specific aspects (performance across subgroups, robustness to input variation).

Current timelines

The regulatory calendar has shifted significantly due to the Digital Omnibus provisional agreement reached on May 7, 2026. Here is the current state.

IVDR transition deadlines

These apply to legacy devices - products CE-marked under the predecessor IVDD directive that are transitioning to IVDR. New devices (first placed on market after May 2022) must comply with IVDR from the outset.

Conditions for eligibility: the device must have held valid IVDD certification as of May 26, 2025, the manufacturer must have an IVDR-compliant QMS, and the manufacturer must meet the application and written agreement deadlines for their class.

For new spectroscopy diagnostics (not legacy devices): these grace periods do not apply. You must achieve full IVDR compliance before placing your product on the EU market.

AI Act implementation dates

The Digital Omnibus extension is the most significant development for spectroscopy diagnostic companies. Your AI-enabled IVD - a product-embedded AI system under Annex I / Article 6(1) - now has until August 2, 2028 before AI Act obligations become enforceable.

This does not mean you can ignore the AI Act until 2028. Your Notified Body will increasingly expect AI Act readiness as part of the IVDR conformity assessment, and building AI Act compliance into your development process from the start is dramatically cheaper than retrofitting. But you have more runway than the original timeline provided.

EUDAMED

Mandatory EUDAMED registration became effective May 28, 2026 for new devices placed on the market. Legacy devices already on the market must complete registration by November 28, 2026. The Vigilance and Clinical Investigation modules are not yet mandatory - their activation timeline follows separately.

Notified Bodies: The practical bottleneck

As of late 2025, 19 Notified Bodies are designated under IVDR - up from only 6-7 in 2022-2023, but still far fewer than the 50+ that operated under the predecessor IVDD directive. The bottleneck has eased but has not disappeared, particularly for Class C and D applications.

Current capacity

Application queue times have shortened since the severe 2022-2023 shortage, and most designated bodies report available capacity. However, Class C and D applications - which require the most intensive NB review - remain the most capacity-constrained.

Key Notified Bodies with IVDR designation include BSI, TÜV SÜD, TÜV Rheinland, SGS, DEKRA, and LNE/G-MED. Early engagement with your chosen NB is essential, particularly given the additional AI Act review workload.

AI Act assessment capability

Currently, existing IVDR-designated Notified Bodies can conduct AI Act conformity assessment as part of their IVDR review without requiring a separate AI Act designation. MDCG 2025-6 confirms that NB involvement under IVDR is sufficient to satisfy the AI Act conformity assessment obligation for Article 6(1) systems.

This may change as the AI Act governance infrastructure matures. Most EU member states have not yet fully designated national competent authorities under the AI Act, and AI Act-specific NB designations are in early stages. The Digital Omnibus extensions are partly designed to allow this infrastructure to develop.

Practical recommendation: confirm with your chosen NB that they have the capability and willingness to assess AI Act compliance as part of the IVDR review. Not all NBs have built AI assessment competence equally.

EU vs. US: Comparative regulatory burden

For spectroscopy diagnostic companies deciding where to seek market authorization first, the relative burden matters. Here is how the EU pathway compares to the US FDA pathway.

The historical playbook - CE mark first (cheaper, faster), then FDA - has reversed for higher-risk IVDs. IVDR plus AI Act compliance now represents substantially greater upfront burden than an FDA 510(k) or even De Novo submission. The Digital Omnibus extensions provide breathing room, but the ultimate compliance burden remains higher in the EU.

For most spectroscopy diagnostic startups, the pragmatic sequence is:

1. US market first - via LDT pathway (fastest, lowest cost) or FDA De Novo
2. EU market second - using clinical data from US deployment to support IVDR performance evaluation
3. Build the IEC 62304 documentation from the start - it serves both FDA and IVDR pathways

Practical compliance roadmap

Here is what to do, when, and in what order - for a spectroscopy diagnostic company targeting the EU market.

Phase 1: Now (regardless of timeline)

Architectural decisions that affect classification. Your software architecture determines your IVDR classification. If your software only displays results from the instrument's built-in classifier, it may qualify as Class A. If your software runs its own ML classification pipeline, it is Class C. Make this architectural decision deliberately.

Quality Management System. Stand up an ISO 13485-compliant QMS. This is required for all IVDR classes above A and provides the foundation for both IVDR and AI Act compliance. If you are also targeting the US market, the QMS serves both pathways.

Design controls from day one. Implement IEC 62304 software lifecycle processes from the first commit. Document requirements, architecture, verification, and validation as you build - not retroactively. See our IEC 62304 guide for spectroscopy-specific examples.

Training data governance. Document your training data rigorously: instrument models, acquisition parameters, sample preparation protocols, patient demographics, collection sites. The AI Act's data governance requirements (Article 10) are difficult to satisfy retroactively. If you did not document your data provenance during collection, you cannot demonstrate compliance later.

Phase 2: 12-18 months before planned EU market entry

Notified Body engagement. Contact 2-3 Notified Bodies for preliminary discussions. Confirm their IVDR designation scope covers your device class and intended use. Confirm their AI Act assessment capability. Request a timeline estimate for conformity assessment.

Technical documentation. Begin building the integrated technical file - IVDR Annex II/III requirements extended with AI Act Annex IV content. Include AI-specific risk management, data governance documentation, transparency design, and human oversight architecture.

Performance evaluation planning. Design your analytical and clinical performance studies to satisfy both IVDR evidence requirements and AI Act accuracy/robustness requirements. Plan for performance assessment across subgroups (demographic, geographic, instrument variation).

Phase 3: 6-12 months before planned EU market entry

Notified Body application. Submit your formal application to your chosen NB. Include your integrated technical file, QMS documentation, performance evaluation plan, and post-market surveillance plan.

EUDAMED registration preparation. Prepare your device registration data, UDI assignment, and economic operator information for EUDAMED submission.

AI Act registration. Prepare your high-risk AI system registration for the EU AI database (separate from EUDAMED).

Phase 4: Post-certification

Post-market surveillance. Implement your PMS plan, including AI-specific monitoring for model drift, accuracy degradation, and distribution shift. IVDR requires periodic safety update reports; the AI Act requires ongoing performance monitoring documentation.

Change management. Any modification to your AI model - retraining, architecture changes, expanded intended use - triggers the change assessment process under both IVDR and the AI Act. Build this into your software maintenance processes from the start.

What you can defer (and what you cannot)

Cannot defer

• QMS establishment (required before any regulatory engagement)
• Design controls and IEC 62304 lifecycle documentation (impossible to reconstruct retroactively)
• Training data governance and provenance documentation (lost if not captured during development)
• Architectural decisions that determine IVDR classification

Can defer (but track the timeline)

• Formal Notified Body application (until 12-18 months before planned EU market entry)
• EUDAMED registration (until device is ready for market)
• AI Act database registration (until August 2028 deadline, though earlier is better)
• Full AI Act technical documentation (can be built incrementally, finalized before NB submission)

The dual compliance requirement for AI-enabled spectroscopy diagnostics in Europe is real and substantial. But it is also manageable if you integrate both frameworks into your development process from the start rather than treating them as separate regulatory workstreams to be addressed later. The companies that build compliance into their architecture and development lifecycle will reach the EU market - the SpectraDx platform is designed with both IVDR and AI Act requirements embedded from the start. The companies that treat compliance as a phase to be bolted on before launch will not.