Image source: Adobe
How does the interplay between SaMD and AI regulation play out in practice? The international standard IEC 62304 for the software lifecycle of medical devices and the EU AI Regulation (also known as the EU AI Act, the European regulation governing AI) now both apply to the same product category: AI-based medical software. The issue is not a substantive contradiction between the two sets of regulations, but rather the need to comply with both simultaneously.
Traditional medtech processes must be integrated with AI-specific documentation requirements. For companies, this means longer approval processes and higher compliance costs. At the same time, new roles and in-demand profiles are emerging for qualified specialists and executives at the intersection of technology, regulation, and data strategy. Those who fill these roles today gain a clear advantage in a market that does not yet have well-established standard processes.
IEC 62304 mandates structured development, testing, and documentation processes for software in medical devices. It is based on the V-model, a development model in which each development phase is matched by a corresponding test phase, with risk-based classification and comprehensive documentation. The IMDRF (International Medical Device Regulators Forum, an international body of national medical device regulatory authorities) adds that SaMD (Software as a Medical Device, i.e., software that performs medical functions independently without being integrated into a physical device) is not only assessed prior to market entry but is also clinically evaluated throughout the entire product lifecycle.
The EU AI Regulation classifies AI systems used in or as medical devices as high-risk systems. It requires additional evidence regarding data governance (a structured framework for the availability, quality, and responsible use of data), technical documentation, human oversight, and robustness. The dual challenge: Both standards must be met simultaneously. Companies can no longer operate software development and AI compliance in separate silos. For candidates with expertise in both areas, this results in a measurable competitive advantage.
The greatest overlap is in the area of documentation. IEC 62304 requires traceable development and test documentation. The EU AI Regulation supplements these with requirements regarding data origin and quality, bias (systematic distortion in AI models that can lead to erroneous results for certain population groups), training logic, and model performance. A traditional software documentation package is no longer sufficient for this.
Risk management must also account for AI-specific risks: model drift (a gradual change in an AI model’s performance when real-world input data deviates from the original training data), insufficient representativeness of the training data, and adversarial attacks (targeted manipulation of input data to trick an AI system into producing incorrect outputs).
During testing and validation, a model must remain stable under real-world data distributions, and its performance must be plausible across different patient groups. An AI-powered screening tool for radiology must function flawlessly from a technical standpoint, be clinically safe, and be continuously monitored. For companies, the early integration of data strategy and risk assessment pays off as early as the architecture phase. Profiles with expertise in medtech, data, and regulatory affairs are in short supply on the job market.
The dual regulatory burden has a direct impact on workforce planning. New or expanded roles are emerging primarily at the interfaces between functions: These include, for example, regulatory affairs with a focus on AI, data governance specialists, quality management roles involving AI documentation, and clinical evaluation positions. In our consulting practice, we regularly observe that smaller companies are unable to fully develop these capabilities in-house. External consulting then becomes a pragmatic interim solution.
The EU AI Regulation has been in effect since 2024, but the obligations take effect in phases. Special transition periods apply to AI in regulated products. This provides time for planning but does not replace the immediate establishment of integrated processes. Those who act early reduce friction losses later on and improve the predictability of market approval. For job seekers, employers who visibly invest in compliance, training, and governance also signal structural stability.
Companies must treat IEC 62304 and the EU AI Regulation as integrated compliance pathways. Early stakeholder alignment, in which all relevant departments are involved from the outset, is crucial. The engineering, legal, data protection, clinical affairs, and quality departments should collaborate as early as the architecture phase. Post-market monitoring (the systematic observation of a product after market launch with regard to safety and performance) must be integrated as an integral part of the product strategy and should not be viewed as a mere afterthought. In addition, continuous monitoring of regulatory updates is recommended.
In our industries, we observe that candidates with dual expertise are in particularly high demand: a foundation in medical technology combined with data science skills and regulatory expertise. Targeted continuing education in the areas of Regulatory Affairs or Quality Management pays off. Career paths are shifting from purely technical development toward interdisciplinary responsibilities with a significant focus on governance and documentation. In this segment, remote and hybrid-friendly positions are common, as companies are searching globally for the same specialized profiles.
IEC 62304 continues to serve as the foundation for Software as a Medical Device (SaMD). The EU AI Regulation supplements this framework with AI-specific requirements; it does not replace it. In the short term, this means a greater documentation burden, more coordination, and higher demands on development and regulatory teams. In the medium term, processes and market standards will stabilize. However, complexity will remain high, particularly for learning systems that continue to evolve after market launch.
Harmonization among the EU, the U.S., Switzerland, and the United Kingdom is a foreseeable issue, but one that cannot be achieved in the short term in practice. Companies that establish integrated compliance processes early on gain planning certainty and better market access. In the job market, specialists with backgrounds in medtech, AI, and governance remain scarce and, accordingly, in high demand.
If you are looking for qualified and motivated specialists and executives for your company, we can support you with our specialized network. We have targeted access to the right candidates, particularly for cross-functional roles at the intersection of medical technology, AI development, and regulatory affairs. For over 15 years, the recruitment consultants at BESTMINDS have been filling vacancies in the medical technology, healthcare, life sciences / pharma, energy / utility, and IT / media sectors with a wealth of expertise and dedication. We find the right candidates for you in a fair, loyal, and discreet manner. Contact us for a no-obligation initial consultation so that we can fill your vacancies quickly and effectively.
