EU AI Act & Healthcare Software: What You Need to Know (Updated Timeline, November 2026)

What Is the EU AI Act Timeline for Healthcare AI? (Updated November 2026)

Status update, November 2026. When this article was first published in March 2026, the high-risk obligations were scheduled for 2 August 2026. That is no longer the case. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026⁴. According to the legal analyses we reviewed⁵:

• •Annex III high-risk systems (stand-alone systems in the listed areas): obligations now apply from 2 December 2027.
• •Annex I high-risk systems (AI that is a medical device, or a safety component of one, under MDR/IVDR): obligations now apply from 2 August 2028.
• •Article 50 transparency obligations are reported as unchanged (2 August 2026). Verify this point against the consolidated text.
• •MDR (2017/745) and IVDR (2017/746) are not amended: their requirements and conformity assessment keep applying as before.

This is a postponement, not a repeal. The requirements described below stay the same, and since a conformity assessment typically takes 6-12 months, preparation should not stop. Check the official text on EUR-Lex before relying on any date for a compliance decision.

What Makes Healthcare AI "High-Risk"?

The EU AI Act (Regulation 2024/1689)¹ uses a risk-based classification. Healthcare AI can be classified as high-risk through two distinct pathways:

Pathway 1 — Annex I / Article 6(1): AI systems that are themselves medical devices or safety components of medical devices, already regulated under MDR (2017/745) or IVDR (2017/746)². This is the primary route for most healthcare AI in production: radiology AI, pathology assistants, genomic variant classifiers, patient risk scoring, and diagnostic imaging systems.

Pathway 2 — Annex III: AI systems intended for use in areas listed in Annex III, including those that influence access to healthcare services or evaluate eligibility for public health benefits¹.

In practice, if your AI system touches a clinical decision or qualifies as a medical device, it is almost certainly high-risk under one of these pathways.

What's NOT high-risk?

AI systems used purely for research (no clinical decisions), administrative automation (scheduling, billing), or general-purpose models not fine-tuned for medical use may fall outside the high-risk category. But the boundaries are narrower than most organizations assume¹.

The 7 Compliance Requirements

For high-risk systems, Articles 8-15 mandate:

1. Risk Management System (Art. 9)

A living document — not a one-time assessment. You need continuous identification, analysis, and mitigation of risks throughout the AI system's lifecycle. This must include testing with real-world data representative of the intended patient population.

2. Data Governance (Art. 10)

Training, validation, and test datasets must meet strict quality criteria: relevance, representativeness, completeness, and freedom from errors. For healthcare, this means documenting data provenance, handling bias across demographic groups, and maintaining dataset cards.

3. Technical Documentation (Art. 11)

Comprehensive documentation covering architecture, training methodology, performance metrics, known limitations, and intended use. Think of it as a technical file similar to what MDR already requires — but with AI-specific additions.

4. Record-Keeping & Logging (Art. 12)

Automatic logging of system operation, including inputs, outputs, and the data used for inference. Logs must be retained for the system's intended lifetime or a minimum period set by sector-specific rules.

5. Transparency (Art. 13)

Clear instructions for use, including the system's capabilities, limitations, intended purpose, and the level of human oversight required. Healthcare providers using your system need to understand what it can and cannot do.

6. Human Oversight (Art. 14)

The system must be designed so that a qualified human (typically a healthcare professional) can effectively oversee its operation, interpret its outputs, and override or stop it. "Rubber stamp" oversight doesn't count.

7. Accuracy, Robustness & Cybersecurity (Art. 15)

Performance must be consistent across intended conditions. Systems must be resilient to adversarial attacks and data drift. For healthcare, this means ongoing monitoring post-deployment.

What This Means for Your Organization

If you're a developer/vendor:

• •Start your conformity assessment NOW. The process takes 6-12 months for most organizations.
• •Implement a Quality Management System (QMS) aligned with Art. 17.
• •Register in the EU database (Art. 71) before placing your system on the market.
• •Budget for ongoing post-market monitoring.

If you're a hospital or healthcare provider (deployer):

• •Audit your current AI tools. Which ones are high-risk under the Act?
• •Ensure your vendors can provide the required documentation.
• •Train your clinical staff on their oversight responsibilities.
• •Implement fundamental rights impact assessments for public-sector use (Art. 27).

If you're a researcher:

• •AI systems used exclusively for R&D are generally exempt — but the moment you validate on patient data or influence a clinical decision, the line blurs.
• •Document your intended use clearly to avoid accidental classification as high-risk.

The Penalty Structure

Article 99 of the Act establishes a tiered penalty structure¹:

• •Prohibited AI practices: up to €35 million or 7% of global annual turnover (whichever is higher)
• •High-risk system non-compliance: up to €15 million or 3% of global annual turnover
• •Supplying incorrect information: up to €7.5 million or 1% of global annual turnover

For SMEs and startups, reduced proportional caps apply. The amounts are maximum ceilings — actual fines are determined by severity, scope, and intent. But the ceiling itself signals how seriously the EU takes enforcement.

Our Recommendation

Don't treat the EU AI Act as a checkbox exercise. The organizations that will win are those that use compliance as a quality framework — improving their AI systems' reliability, interpretability, and clinical value in the process.

If you're building healthcare AI and need help navigating the technical requirements — from data governance pipelines to conformity documentation — get in touch. Our team combines hands-on AI engineering with real clinical trial experience and regulatory knowledge (GCP-ICH, ISO 14155) to bridge the gap between engineering teams and compliance officers. We'll assess your case and propose a concrete plan.

References

• 1.Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence. Official Journal of the European Union, L 2024/1689. Available at: eur-lex.europa.eu/eli/reg/2024/1689
• 2.Regulation (EU) 2017/745 on medical devices (MDR). Official Journal of the European Union, L 117/1.
• 3.European Commission AI Act Implementation Timeline. Available at: artificialintelligenceact.eu/implementation-timeline
• 4.Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026. Official text: eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
• 5.Secondary legal analyses: White & Case; Gibson Dunn; Pure Global

Updated November 2026 for the Digital Omnibus (first published March 2026). Always confirm dates against the official text.