============================================================================== LEXKINETIC AI | EXECUTIVE BOARD COMPLIANCE MEMO TRACK: MEDICAL DEVICES & AI SAMD APPROVALS TIMESTAMP: 2026-10-10_1402 UTC TELEMETRY HASH (SHA-256): 06f3ea1bbb43ef28c3362e20de4e12a395edeac4fc37b51d8b66bed8c89040c6 RISK POSTURE: HIGH ============================================================================== HEADLINE: MDR Article 120 Transition Framework Governs Legacy SaMD as AI Omnibus Aligns Embedded Systems to August 2028 PRIMARY LIABILITY DRIVER: Operating legacy SaMD under MDR Article 120 requires adherence to statutory transition conditions—including valid 2024 Notified Body agreements, compliant QMS, and avoiding significant changes in design or intended purpose—while AI SaMD must prepare for dual conformity under amended AI Act Article 113. EXECUTIVE SUMMARY: As of 10 October 2026, manufacturers of Software as a Medical Device (SaMD) operating in the EU navigate the transitional architecture of Regulation (EU) 2017/745 (MDR), as extended by Regulation (EU) 2023/607 and amended by Regulation (EU) 2024/1860. Statutory extensions defer Directive certificate validity to 31 December 2027 for Class III and Class IIb implantable non-WET devices, and 31 December 2028 for other Class IIb devices, Class IIa devices, well-established-technology implantables, and Class I devices requiring notified body involvement. These extensions remain strictly contingent upon statutory conditions: formal Notified Body application by 26 May 2024, signed written agreement by 26 September 2024, maintaining a compliant QMS, and implementing no significant change in design or intended purpose under Article 120(3c). Ongoing Post-Market Clinical Follow-up (PMCF) under Annex XIV Part B is an active surveillance duty; deficiencies can lead to Notified Body audit suspension, but do not operate as an automatic statutory forfeiture of legacy status. Concurrently, Regulation (EU) 2026/1744 (Digital Omnibus on AI) amended Article 113 of the AI Act, aligning the application date for AI systems that are safety components of products subject to Union harmonisation legislation listed in Annex I Section A (specifically Regulation (EU) 2017/745 on Medical Devices) to 2 August 2028. In the US, the FDA governs machine-learning modifications through Predetermined Change Control Plans (PCCPs) authorized under Section 515C of the FD&C Act (21 U.S.C. § 360e-4). While authorized PCCPs allow pre-specified model updates without supplemental submissions, modifications exceeding authorized boundaries require standard regulatory filings. Furthermore, manufacturers must comply with MDR Article 10a, which mandates at least 6 months advance notice to competent authorities, health institutions, and distributors prior to an anticipated disruption or discontinuation in supply that could reasonably foreseeably cause serious harm or a risk of serious harm to patients or public health. ------------------------------------------------------------------------------ 1. AUDITED STATUTORY MILESTONES & PRIMARY SOURCE VERIFICATION ------------------------------------------------------------------------------ • [ENACTED / TRANSITIONAL EXTENSION] Regulation (EU) 2017/745, Article 120(3a)-(3c) (as amended by Reg (EU) 2023/607) Milestone Gate: 2027-12-31 Primary Source Link: https://eur-lex.europa.eu/eli/reg/2017/745/2025-01-10 Legal/Operational Impact: Transitional validity extension for legacy Class III and Class IIb implantable devices, contingent upon maintaining a certified QMS, Notified Body agreement, and implementing no significant design or intended-purpose changes. • [ENACTED / TRANSITIONAL EXTENSION] Regulation (EU) 2017/745, Article 120(3b)-(3c) (as amended by Reg (EU) 2023/607) Milestone Gate: 2028-12-31 Primary Source Link: https://eur-lex.europa.eu/eli/reg/2017/745/2025-01-10 Legal/Operational Impact: Transitional validity extension for Class IIa, non-implantable Class IIb devices, WET implantables, and Class I sterile/measuring devices subject to ongoing QMS surveillance and significant change restrictions. • [ADOPTED (COMMENCING 2028-08-02)] Regulation (EU) 2024/1689, Article 113(c) & Annex I Section A (MDR) Milestone Gate: 2028-08-02 Primary Source Link: https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27 Legal/Operational Impact: Codifies unified application date for AI systems embedded as safety components in medical devices covered by MDR, aligning technical documentation and conformity assessment workflows. • [ENACTED / IN FORCE] Regulation (EU) 2017/745, Article 10a (as inserted by Reg (EU) 2024/1860) Milestone Gate: 2025-01-10 Primary Source Link: https://eur-lex.europa.eu/eli/reg/2017/745/2025-01-10 Legal/Operational Impact: Statutory duty requiring manufacturers to provide at least 6 months advance notice to competent authorities, health institutions, and distributors prior to an anticipated disruption in supply posing serious harm risks. • [ENACTED / IN FORCE] US FD&C Act Section 515C [21 U.S.C. § 360e-4] & FDA PCCP Framework Milestone Gate: 2024-12-18 Primary Source Link: https://www.govinfo.gov/app/details/USCODE-2022-title21/USCODE-2022-title21-chap9-subchapV-partA-sec360e-4 Legal/Operational Impact: Authorizes pre-cleared iterative machine learning modifications without supplemental 510(k)/PMA filings, provided changes remain strictly within authorized PCCP boundaries and verification protocols. ------------------------------------------------------------------------------ 2. GENERAL COUNSEL ACTION MATRIX & WORKSTREAMS ------------------------------------------------------------------------------ [CRITICAL] [LEGAL REQUIREMENT] Audit PMCF data streams and clinical evaluation reports against Notified Body audit schedules to sustain MDR QMS compliance and legacy certificate surveillance. Accountable Owner: Chief Regulatory Officer Completion Gate: 2026-12-15 Statutory Anchor: Regulation (EU) 2017/745, Article 120(3c) & Annex XIV Part B [CRITICAL] [RECOMMENDED CONTROL] Establish algorithmic change control procedures to verify that ML software updates do not constitute significant design changes under MDCG 2020-3 guidance. Accountable Owner: VP of Quality Assurance Completion Gate: 2026-11-30 Statutory Anchor: Regulation (EU) 2017/745, Article 120(3c) [MEDIUM] [LEGAL REQUIREMENT] Implement supply monitoring procedures to ensure mandatory 6-month advance notice is submitted under Article 10a prior to any anticipated device shortage posing serious risk. Accountable Owner: General Counsel Completion Gate: 2027-01-15 Statutory Anchor: Regulation (EU) 2017/745, Article 10a [HIGH] [REGULATORY EXPECTATION] Construct a synchronized technical documentation plan aligning SaMD clinical evaluation with AI Act Article 113 dual conformity requirements ahead of August 2028. Accountable Owner: Chief Compliance Officer Completion Gate: 2027-03-31 Statutory Anchor: Regulation (EU) 2024/1689, Article 113(c) ------------------------------------------------------------------------------ 3. 90-DAY EXPOSURE & CAPITAL ALLOCATION PROFILE ------------------------------------------------------------------------------ • 90-Day Budget Decision: €420,000 - €780,000 • Cost Allocation Basis: Illustrative enterprise scenario: assumes 3 commercial SaMD applications undergoing MDR technical file transition, external notified body clinical surveillance fees, and FDA PCCP monitoring tooling. Itemized Capital Breakdown: - Notified Body clinical evaluation review & surveillance retainers: €195,000 - Algorithmic change control & PCCP drift monitoring systems: €160,000 - MDR / AI Act dual conformity alignment legal counsel: €130,000 - PMCF clinical registry data extraction and statistical validation: €115,000 - Article 10a supply continuity governance buffer: €50,000 Modeled Capital Total: €650,000 • Primary Liability Vector: Suspension or withdrawal of CE certificate by Notified Bodies for QMS or clinical deficiencies; loss of Article 120 transitional eligibility if significant unapproved design changes are introduced; FDA Warning Letters under 21 CFR 807.81(a)(3) for algorithmic modifications exceeding authorized PCCP specifications. • Scoping / Affected Population: Manufacturers of Class IIa, IIb, and III legacy Software as a Medical Device (SaMD) operating under MDR Article 120, AI diagnostic software developers, and medical device manufacturers marketing products with authorized PCCPs in the US. ------------------------------------------------------------------------------ 4. DECISIONS REQUIRED THIS QUARTER (BOARD AUDIT COMMITTEE) ------------------------------------------------------------------------------ 1. DECISION: Confirm active Notified Body written agreements remain in force across all legacy SaMD certificates, closed upon notified body contract review memo. 2. DECISION: Authorize algorithmic drift monitoring implementation (modeled at €160,000) to maintain FDA compliance boundaries, closed upon validation of drift alert thresholds. 3. DECISION: Approve Article 10a early-warning escalation protocol for manufacturing and cloud infrastructure dependencies, closed upon SOP distribution. ============================================================================== INSTITUTIONAL PORTFOLIO AVAILABILITY & TELEMETRY NOTICE: This intelligence dossier is simultaneously produced in audited .PDF (executive brief), .TXT (board memo), and schema-validated .JSON (ServiceNow/Jira REST ingestion). Explore the full 7-track suite (Battery Passport & CRMA, CBAM Clean Trade, CSDDD Supply Audit, DORA Fintech Resilience, EU AI Act, Sanctions & Dual-Use). Manage institutional access or enroll in the All-Track Pass at https://lexkinetic.ai ============================================================================== DISCLAIMER: Autonomous regulatory intelligence. Not formal legal advice. ==============================================================================