Level 3 · Retina screening — one system, two regimes

🟡 Partial — The risk loop is re-derivable today from the committed outputs of the public vldemo-retina-screening repo (one tag per beat) — but it is GPU-bound to re-train, so this level is WATCH, DON'T RUN: you read the committed evidence and the nightly reproduce gate machine-checks it. The MDR layer and the notified body are an HONEST GAP: the engine emits a signed MDR crosswalk (documentation), never an MDR conformity verdict, and the lifecycle honestly pauses at 'requested' pending an external notified body. The three retina tag links resolve on github.com/Venturalitica/vldemo-retina-screening.

TL;DR

A diabetic-retinopathy screener looks at a fundus photo of the back of the eye and sorts it as refer / no-refer. Miss a true case and a patient loses the treatment window — so this system is high-stakes twice over. It is EU AI Act high-risk, but not through Annex III this time: it is a safety component of a medical device, so the trigger is Art. 6(1) + Annex I (the product-safety route). And the same system is also a medical device in its own right — MDR Class IIa. That is the lesson of Level 3: one system, two regimes — your first overlay. James (Quality) and Martha (engineer) run the familiar loop. On real ODIR-5K fundus images the first model’s DR sensitivity (recall) comes out 0.4165 — RED (it misses more than half the cases). Martha treats it with a code change (class-balanced retraining + a 0.30 decision threshold), and V2’s recall reaches 0.8847, with the bootstrap 95% CI low at 0.8516 — comfortably above the 0.80 line. That is a clean GREEN — not Level 2’s honest amber, because here the held-out cohort is large enough to prove it. Then James requests approval — and the repo stays a DRAFT. No approve. A Class IIa device cannot close its cycle without an external notified body (MDR Art. 52), and the engine is not one. So the lifecycle honestly pauses at “requested”, and the engine emits a signed MDR crosswalk — documentation, not an MDR conformity verdict. The notified-body GAP is the whole lesson.

If you have not met the spine (the clean AI Act levels) or the overlay idea, read these first:

Level 2 · Student selection — the clean spineThe high-risk spine with no overlay: Annex III §3 and the data-minimization gate for a minor's data (GDPR), which closes clean GREEN. Level 3 keeps the three-role structure (PO Nerea + QM James + dev Martha) and stacks the first sector overlay (MDR) on top.

More than the AI ActThe concept this level runs on: a sectoral regime stacked on the AI Act spine; one system, N regimes; the same signed bundle projected onto multiple catalogs — some governed (real verdicts), MDR a signed crosswalk + GAP (documentation, not a verdict).

By the end you'll be able to…

Explain why one system is subject to two regimes at once — EU AI Act high-risk and MDR Class IIa — and how the high-risk trigger here is Art. 6(1) + Annex I (safety component of a product), not Annex III.
Say which laws apply (AI Act high-risk + MDR Class IIa) and which do not (no DORA — the operator is not a financial entity), and why the MDR is a crosswalk, not a verdict.
Read a deep, objective, blocking robustness control (Art. 15 — DR sensitivity) and recite its honest limits (specificity unmeasured, PPV audit-only, single fold/seed, mono-population cohort).
Read a deep, organizational, not objective-required human-oversight control (Art. 14 — HITL + clinician review + automation-bias training) and explain why self-declaration is legitimate there.
Explain the notified-body GAP: why a clean-GREEN technical gate does not close a Class IIa cycle, so the lifecycle pauses at requested, and why the engine’s signed MDR crosswalk is documentation, not conformity.

Lessons in this level

The framing — two regimes and 'watch, don't run'A DR screening SaMD that is simultaneously high-risk (EU AI Act Art. 6(1) + Annex I) and a medical device (MDR Class IIa); which laws apply and why here you watch the evidence rather than re-run it (GPU).

The arc, by handoffsThe sensitivity gate (Art. 15) goes RED → clean GREEN on real ODIR-5K images; human oversight (Art. 14) is declared; and the cycle honestly pauses at 'requested' because a Class IIa cannot close without a notified body.

In depth — Arts. 15 and 14, and the MDR crosswalkArticle 15 as a real, blocking gate (with honest limits), Art. 14 human oversight (organizational, not objective-required), and the MDR crosswalk with the notified-body GAP.

Practice & recapWatch the signed evidence (GPU system: watch, don't re-run), review the honest pause at the notified body, and self-check what you learned.