Bundesnetzagentur publishes detailed roadmap for AI regulatory sandboxes and medical device requirements

What was published

On September 30, 2026, the Bundesnetzagentur published a 56 page roadmap titled "Pilotprojekt KI-Reallabor: Hochrisiko-KI-Anforderungen f5C5B5C54r KI-basierte Medizinprodukte aus Sicht der KI-Verordnung" that summarises the results of a multiagency pilot to simulate an AI regulatory sandbox and offers a structured checklist for developers and manufacturers of AI-based medical devices. The roadmap collects practical steps, mapping of relevant standards, and an executive overview of how to meet high risk AI obligations under the EU AI Act and related European standards.

Key contents and technical guidance

The document provides a detailed, use case driven interpretation of the AI Act provisions most relevant to medical devices, including risk management obligations, logging and documentation requirements, transparency measures and human oversight expectations. It cross references ongoing European and ISO working items, giving manufacturers a consolidated timeline of standards expected to be available and showing where transitional gaps remain.

Specifically, the roadmap highlights the intersection of the EU AI Act and the Medical Device Regulation and offers practical guidance for organisations working to align product development pipelines, technical documentation and post market surveillance with both rule sets. The file includes annexes listing relevant CEN, CENELEC and ISO/IEC work items and indicates intended publication or voting dates where available, which helps vendors plan compliance activities against expected normative milestones.

Why this matters for German industry and startups

Germany has positioned the Bundesnetzagentur as the national hub for AI oversight, including a coordinating competence centre. The roadmap is the regulator's attempt to turn pilot experience into operational guidance that reduces ambiguity for companies trying to bring AI-enabled medical products to market. For startups and small and medium sized enterprises, the paper offers a practical starting point: a roadmap of tasks they must complete to demonstrate conformity, and a clearer set of expectations for documentation, testing and governance during development and clinical integration.

That matters because regulatory uncertainty has been one of the main friction points slowing AI adoption in health tech. The roadmap aims to shorten that lead time by offering a replicable template for regulatory sandbox work and by listing concrete standards and their forecasted availability so companies can prioritise compliance investment sensibly.

How the roadmap fits into the wider regulatory picture

The paper sits alongside Germany's broader policy push to boost AI adoption while keeping safety front and centre. The regulator references the 2026 Digital Omnibus updates to the EU AI framework, which changed several deadlines for high risk categories. The Bundesnetzagentur roadmap is framed as an implementation tool for national authorities and market surveillance actors, and it is consistent with the national Hightech Agenda where Germany is seeking industrial scale adoption of dependable, certifiable AI systems.

Operationally, the roadmap links to earlier pilot activity the Bundesnetzagentur ran with the Federal Commissioner for Data Protection and the Hessian Ministry for Digitalisation and Innovation, which tested processes for sandboxing two real life use cases. The new document aims to translate those lessons into an actionable process for future AI reallabore, including suggested workflows for assessment, evidence collection and cross authority coordination.

Implications for regulators and standards bodies

By listing expected publication dates for several prEN and ISO/IEC items, the roadmap signals which pieces of the standards puzzle German regulators expect to rely on. That transparency will help conformity assessment bodies, test labs and notified bodies prioritise the technical work that supports market surveillance. It also clarifies where national guidance will temporarily stand until harmonised standards are published.

For European and German standardisation stakeholders, the roadmap effectively creates a demand signal: industry and the regulator will use these referenced standards to operationalise the AI Act, so timely completion of those work items becomes critical for the broader ecosystem.

What to expect next

The roadmap is an implementation milestone rather than a final rule. Companies should treat it as a high quality interpretation from the market surveillance authority, and expect further refinements as harmonised standards arrive and as the Bundesnetzagentur and other authorities begin routine market surveillance under the AI Act. Practically, firms developing AI-based medical systems should align internal risk management, logging, documentation and testing processes to the guidance in the roadmap and track the referenced standards dates closely.

For policy watchers, the publication underlines that Germany is moving from discussion to operationalisation: regulators are translating pilot insight into practical tools that businesses can use to meet their compliance obligations under the EU AI framework while continuing to encourage innovation in strategic sectors such as health technology.

Bottom line

The Bundesnetzagentur roadmap issued on September 30, 2026, narrows an important gap between high level AI rules and the day to day reality of bringing AI enabled medical products to market. It is a pragmatic blueprint for industry, conformity assessors and other national authorities, and it will shape how German AI reallabore operate as the EU AI Act and a slate of harmonised standards reach full force.