The EU AI Act Is Law: What Health and Life Sciences Boards Should Ask Now

The European Union adopted its AI rules in 2024 and reset the high-risk deadlines in July 2026. Boards that read the delay as relief will find that the work it requires takes longer than the time it buys.

In Brief

The Problem. The European Union (EU) Artificial Intelligence (AI) Act is law. Some duties already bind, and the high-risk regime that will reach most AI-enabled medical devices, diagnostics, and clinical tools now applies from December 2, 2027 and August 2, 2028.

Why It Persists. Many boards treat the Act as a European compliance matter for later. The July 2026 postponement reinforced that view, even though an inventory, vendor terms, and a technical file for each system take longer to build than the delay allows.

What Boards Should Do. Ask management to identify every AI system whose output is used in the EU, to state whether the organization is the provider or the deployer for each, to name one accountable executive, and to report readiness to the board on a set schedule.

When I first wrote about the EU AI Act in June 2023, the European Parliament had just adopted its negotiating position on a draft. The Act is now Regulation (EU) 2024/1689, adopted on June 13, 2024 and in force since August 1, 2024 (European Parliament and Council of the European Union, 2024). On July 27, 2026, an amending regulation adopted on July 8, 2026, the Digital Omnibus on AI (Regulation (EU) 2026/1744), entered into force and moved the main high-risk deadlines (European Parliament and Council of the European Union, 2026; Van Eecke and Regenhardt, 2026).

My argument is that the postponement is the greatest risk the Act now presents to health and life sciences boards. The question is no longer whether the Act will apply. It is which of the organization's AI systems fall within it, on what date, and who in management is accountable for readiness. Those questions take longer to answer than most boards assume, and the clock is already running.

The General Data Protection Regulation Came First

The AI Act did not arrive in an empty field. Within the EU and the European Economic Area (EEA), the General Data Protection Regulation (GDPR) already governs any AI system that collects or processes personal data, and so far it has produced the enforcement. In March 2023, the Italian data protection authority (the Garante) imposed an immediate temporary limitation on ChatGPT. It lifted the limitation within a month after OpenAI agreed to corrective measures (Lewis Silkin, 2025). In December 2024, the Garante fined OpenAI EUR 15 million for training without an adequate legal basis, transparency failures, weak age verification, and an unreported data breach (Lewis Silkin, 2025). The Tribunal of Rome annulled that fine in March 2026 (Orrù, 2026).

The European Data Protection Board (EDPB) set up a task force on ChatGPT in April 2023. Its May 2024 report stated preliminary views: each stage of processing needs a lawful basis, the accuracy principle must be met even when outputs are probabilistic, and a provider cannot shift responsibility for compliance onto its users (European Data Protection Board, 2024). For a board, the lesson is that a company running AI on European patient or employee data has carried regulatory exposure since 2018, whatever the AI Act timetable says.

From Draft to Law

The 2023 draft would have required every user of a high-risk system to complete a fundamental rights impact assessment. The final text is narrower. Article 27 limits the duty to public bodies, private entities that provide public services, and deployers of systems that assess creditworthiness or set risk and prices in life and health insurance (EU Artificial Intelligence Act, n.d.-h). The core design survived: high-risk systems are allowed, but they must meet requirements for testing, data quality, documentation, and human oversight before and during use.

I also predicted in 2023 that the Act would take effect about two years after adoption. Instead, it applies in stages, and the Omnibus has now stretched those stages to 2028 for products and 2030 for some public authorities (Van Eecke and Regenhardt, 2026).

Who the Act Reaches

The Act applies to providers that place AI systems on the EU market, wherever they are established. It also reaches providers and deployers outside the EU when the output of the system is used in the Union (EU Artificial Intelligence Act, n.d.-a). That test turns on where the output is used, not, as my 2023 article suggested, on whether the system processes the personal data of people in the EU; that is the GDPR test. A United States health system with no European patients may sit outside the Act. A United States manufacturer selling a diagnostic algorithm in Europe should assume it is inside. So should a sponsor whose AI-generated outputs support an EU submission.

The Act separates two roles. The provider develops a system and places it on the market; the deployer uses it under its own authority (EU Artificial Intelligence Act, n.d.-a). Many hospitals will be deployers. Many device and diagnostics companies will be providers. The duties differ, and the board should know which role the organization plays for each system.

What Applies Now

Three sets of obligations already bind (EU Artificial Intelligence Act, n.d.-d):

• Prohibited practices and AI literacy, since February 2, 2025. Certain uses, such as manipulative techniques that cause significant harm, are banned. Article 4 requires providers and deployers to take measures to support AI literacy among the people who operate AI systems on their behalf. The amended text states that this duty does not require any specific level of literacy (EU Artificial Intelligence Act, n.d.-b).
• General-purpose AI models, governance, and penalties, since August 2, 2025. Developers of general-purpose models carry documentation and transparency duties, and the penalty regime is in force.
• Transparency, since August 2, 2026. Article 50 requires, among other things, that people are told when they interact with an AI system and that AI-generated content is marked. Generative systems already on the market before that date have until December 2, 2026 to add machine-readable marking (Gibson Dunn, 2026).

Fines reach EUR 35 million or seven percent of worldwide annual turnover for prohibited practices, whichever is higher. Most other breaches carry up to EUR 15 million or three percent (EU Artificial Intelligence Act, n.d.-c).

What the Digital Omnibus Changed

The European Commission proposed the Omnibus in November 2025 (Gibson Dunn, 2026), citing the absence of harmonized standards, guidance, and other compliance tools for high-risk systems (Hunton Andrews Kurth, 2026). Parliament and the Council reached provisional agreement in May 2026 (Gibson Dunn, 2026). The adopted text sets these dates (European Parliament and Council of the European Union, 2026; Van Eecke and Regenhardt, 2026):

Date	What Applies
December 2, 2026	New prohibitions on AI that generates non-consensual intimate imagery or child sexual abuse material; end of the marking grace period for existing generative systems
August 2, 2027	Each Member State must have at least one operational AI regulatory sandbox
December 2, 2027	High-risk obligations for the stand-alone uses listed in Annex III
August 2, 2028	High-risk obligations for AI in products covered by Annex I, including medical devices and in vitro diagnostics
August 2, 2030	High-risk obligations for systems intended for use by public authorities

The Omnibus also extended simplifications for small and medium-sized enterprises to small mid-cap companies. It kept the registration duty for systems that a provider claims are not high-risk. It gave the European AI Office direct supervision of systems built on a general-purpose model by the same provider or group (Van Eecke and Regenhardt, 2026).

The High-Risk Scenarios, Revisited

In 2023 I listed six health and life sciences uses that could be classed as high-risk. The final law sorts them differently, and the differences matter for planning.

Diagnosis and treatment recommendations, clinical decision support, patient monitoring, and robotic surgery. AI that is a medical device, or a safety component of one, is high-risk when the device needs a notified body's conformity assessment under the Medical Devices Regulation (MDR) or the In Vitro Diagnostic Regulation (IVDR) (EU Artificial Intelligence Act, n.d.-e). Guidance issued jointly by the Medical Device Coordination Group (MDCG) and the Artificial Intelligence Board in June 2025 confirms that devices in MDR classes IIa, IIb, and III meet that test, and states that a single set of technical documentation shall be drawn up for both regimes (Medical Device Coordination Group and Artificial Intelligence Board, 2025). In December 2025, the Commission proposed taking devices largely out of the Act's high-risk regime. Parliament and the Council did not accept that change, although the Commission may still limit the Act's application to devices through implementing acts where the MDR or IVDR ensure an equivalent level of protection (Gleiss Lutz, 2025). AI-enabled devices therefore remain subject to the high-risk obligations from August 2, 2028 (Hunton Andrews Kurth, 2026; Van Eecke and Regenhardt, 2026). I would advise manufacturers to plan for one combined technical file, not two.

Genetic testing and personalized medicine. Genetic testing is not a stand-alone high-risk category. It becomes high-risk through the device route: in vitro diagnostics in IVDR classes B, C, and D require a notified body and therefore meet the Article 6 test (Medical Device Coordination Group and Artificial Intelligence Board, 2025).

Drug discovery and development. AI developed and used solely for scientific research and development is excluded, as is research and testing before a system reaches the market, other than testing in real-world conditions (EU Artificial Intelligence Act, n.d.-a). Most discovery tools therefore sit outside the high-risk regime. The exclusion ends once a tool is placed on the market or used for a regulated purpose.

Uses I did not list. From December 2, 2027, high-risk status also attaches to stand-alone uses in Annex III that matter to health organizations: emergency patient triage, risk assessment and pricing in life and health insurance, public authorities' decisions on eligibility for healthcare services, and AI used to recruit, promote, assign tasks to, or monitor staff (EU Artificial Intelligence Act, n.d.-f). That last category catches human resources tools that boards rarely think of as clinical AI.

One point from 2023 still holds. A high-risk classification does not mean a system is dangerous. It means the potential for harm is high enough to require stricter controls before and during use.

Seven Implications, Restated for the Board

My 2023 article listed seven implications for companies. Each still applies, and each now has a defined duty behind it and a question the board can ask (EU Artificial Intelligence Act, n.d.-g; Van Eecke and Regenhardt, 2026).

Implication	What the Law Now Requires	What the Board Should See
Regulatory compliance	Staged obligations from 2025 to 2030	An inventory with each system's role, risk class, and application date
Risk assessment and mitigation	Risk management and monitoring for high-risk systems; suspension and notice when a risk is identified	A named owner and a procedure for each high-risk system
Transparency and accountability	Article 50 disclosure and marking; logs kept at least six months	Evidence that patients and staff are told when they interact with AI
Innovation and testing	A national sandbox in each Member State by August 2, 2027	A decision on whether to use a sandbox for products in development
Patient rights and trust	Information to affected individuals; impact assessments for some deployers	How the organization explains AI use to patients
High-risk systems	Full obligations from December 2, 2027 or August 2, 2028	A readiness plan with dates and resources
Research and development	Exclusions for research and for free and open-source systems that are not high-risk	Confirmation of when a research tool crosses into regulated use

For a high-risk system, a deployer must use it according to the provider's instructions, assign human oversight to people with the competence, training, and authority to exercise it, monitor operation, suspend use and notify the provider when it identifies a risk, keep system logs for at least six months, and inform workers and affected individuals (EU Artificial Intelligence Act, n.d.-g). The open-source exclusion does not apply to systems placed on the market as high-risk or to systems subject to the transparency duties (EU Artificial Intelligence Act, n.d.-a). Each of these duties needs an owner, a procedure, and a record. That is the board's interest: not how the controls work, but whether they exist and whether management can show them.

The Wider Regulatory Picture

In 2023 I wrote that the EU would take the strictest approach of the three major jurisdictions, while the United Kingdom and the United States relied on existing authorities and nonbinding guidance. That remains broadly true. As of September 2026, the United Kingdom still has no comprehensive AI law, and a government AI bill has not appeared (Higgins and Charalambous, 2026). In the United States, a December 11, 2025 executive order created a Department of Justice task force to challenge state AI laws and named Colorado's law (Ghavi et al., 2025). Colorado has since replaced that law; the new version takes effect on January 1, 2027 and gives a partial exemption to entities covered by the Health Insurance Portability and Accountability Act (HIPAA) (Darch et al., 2026). A company that sells in Europe and the United States must plan to more than one calendar.

The Strongest Objection: Wait for the Standards

The best case for waiting is a serious one. The EU delayed the high-risk regime because the harmonized standards and guidance needed to apply it were not ready, and the dates have now moved once (Hunton Andrews Kurth, 2026; Van Eecke and Regenhardt, 2026). Building controls before the standards exist risks building the wrong ones, and the Commission had proposed removing devices from the regime altogether.

My answer is that the work boards should ask for does not depend on the standards. An inventory, a provider or deployer designation, a named executive, and vendor terms that secure documentation are needed under any version of the rules. The device carve-out was proposed and rejected. Literacy, transparency, and the prohibitions already apply. In my experience, boards that treat a deferred deadline as a planning window arrive ready; boards that treat it as relief do not.

What the Delay Means for the Board

Measured against the original Act, the Omnibus gives most organizations 16 more months for Annex III systems and 12 more months for device AI (Van Eecke and Regenhardt, 2026). It does not change what the obligations are. Three requests to management will make good use of the time. First, an inventory that marks each system's role (provider or deployer), its likely risk class, and its application date. Second, a named accountable executive with a reporting date to the board. Third, vendor terms that commit suppliers to give the organization the instructions, documentation, and incident notices a deployer needs.

For the Board

• Which of our AI systems are used in the EU, or produce outputs used there, and are we the provider or the deployer for each?
• Which systems fall in Annex III (applying December 2, 2027), and which fall in Annex I through the MDR or IVDR (applying August 2, 2028)?
• Who is the executive accountable for EU AI Act readiness, and when will the board next see a status report?
• Do our vendor contracts require providers to give us the instructions, documentation, and incident notices a deployer needs?
• Where do we process European personal data with AI today, and what is our lawful basis under the GDPR?
• What measures have we taken to support AI literacy among the staff who operate these systems, and how is that recorded?

Filter the Avancer AI Governance Navigator by jurisdiction to follow the EU timeline alongside United States developments.

References

Darch, J. E., Brooks, P., Daudi, S., Hinckley, D., and Kaye, A. (2026, May 19). Colorado scales back AI law, with targeted implications for health care. Ropes and Gray. https://www.ropesgray.com/en/insights/alerts/2026/05/colorado-scales-back-ai-law-with-targeted-implications-for-health-care

EU Artificial Intelligence Act. (n.d.-a). Article 2: Scope. Retrieved October 21, 2026, from https://artificialintelligenceact.eu/article/2/

EU Artificial Intelligence Act. (n.d.-b). Article 4: AI literacy. Retrieved October 21, 2026, from https://artificialintelligenceact.eu/article/4/

EU Artificial Intelligence Act. (n.d.-c). Article 99: Penalties. Retrieved October 21, 2026, from https://artificialintelligenceact.eu/article/99/

EU Artificial Intelligence Act. (n.d.-d). Article 113: Entry into force and application. Retrieved October 21, 2026, from https://artificialintelligenceact.eu/article/113/

EU Artificial Intelligence Act. (n.d.-e). Article 6: Classification rules for high-risk AI systems. Retrieved October 21, 2026, from https://artificialintelligenceact.eu/article/6/

EU Artificial Intelligence Act. (n.d.-f). Annex III: High-risk AI systems referred to in Article 6(2). Retrieved October 21, 2026, from https://artificialintelligenceact.eu/annex/3/

EU Artificial Intelligence Act. (n.d.-g). Article 26: Obligations of deployers of high-risk AI systems. Retrieved October 21, 2026, from https://artificialintelligenceact.eu/article/26/

EU Artificial Intelligence Act. (n.d.-h). Article 27: Fundamental rights impact assessment for high-risk AI systems. Retrieved October 21, 2026, from https://artificialintelligenceact.eu/article/27/

European Data Protection Board. (2024, May 23). Report of the work undertaken by the ChatGPT Taskforce. https://edpb.europa.eu/system/files/2024-05/edpb_20240523_report_chatgpt_taskforce_en.pdf

European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2024/1689/oj

European Parliament and Council of the European Union. (2026). Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI). Official Journal of the European Union. https://eur-lex.europa.eu/eli/reg/2026/1744/oj

Ghavi, A. R., Glucksman, H., and Katsuki, K. (2025, December 16). President Trump signs executive order challenging state AI laws. Paul Hastings. https://www.paulhastings.com/insights/client-alerts/president-trump-signs-executive-order-challenging-state-ai-laws

Gibson Dunn. (2026, May 27). EU AI Act omnibus agreement: Postponed high-risk deadlines and other key changes. https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/

Gleiss Lutz. (2025, December 30). Radical simplification of the MDR and IVDR and broad inapplicability of the AI Act to medical devices and IVDs [Updated May 7, 2026]. Retrieved October 21, 2026, from https://www.gleisslutz.com/en/know-how/radical-simplification-mdr-and-ivdr-and-broad-inapplicability-ai-act-medical-devices-and-ivds

Higgins, S.-J., and Charalambous, M. (2026, September 14). AI judgment day on the horizon, while UK lawmakers play catch up. Lewis Silkin. https://www.lewissilkin.com/insights/2026/09/14/ai-judgment-day-on-the-horizon-while-uk-lawmakers-play-catch-up

Hunton Andrews Kurth. (2026, July 28). EU Digital Omnibus on AI enters into force. Privacy and Cybersecurity Law Blog. https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force

Lewis Silkin. (2025, January 14). OpenAI faces €15 million fine as the Italian Garante strikes again. https://www.lewissilkin.com/insights/2025/01/14/openai-faces-15-million-fine-as-the-italian-garante-strikes-again-102jtqc

Medical Device Coordination Group and Artificial Intelligence Board. (2025). Interplay between the Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR) and the Artificial Intelligence Act (AIA) (MDCG 2025-6, AIB 2025-1). European Commission. https://health.ec.europa.eu/document/download/b78a17d7-e3cd-4943-851d-e02a2f22bbb4_en?filename=mdcg_2025-6_en.pdf

Orrù, T. (2026, March 30). Chi governa l’AI? Il Tribunale annulla la sanzione a OpenAI e ridefinisce i confini del Garante [Who governs AI? The court annuls the OpenAI fine and redraws the limits of the Garante]. Cybersecurity360. https://www.cybersecurity360.it/legal/privacy-dati-personali/chi-governa-lai-il-tribunale-annulla-la-sanzione-a-openai-e-ridefinisce-i-confini-del-garante-privacy/

Van Eecke, P., and Regenhardt, B. (2026, August 3). Digital AI Omnibus delays key deadlines, introduces new rules. Cooley. https://cdp.cooley.com/digital-ai-omnibus-delays-key-deadlines-introduces-new-rules/