In brief
- Regulation: AI Act.
- Providers and deployers of medical AI are concerned.
- Classify the system.
- Managing risks.
- Ensure data quality.
- Up to €35 M or 7% of turnover for prohibited practices and €15 M or 3% for failures to meet high-risk obligations, in addition to the sectoral sanctions applicable to medical devices.
Regulatory deadlines
The key dates of this regulation.
August 2024
Entry into force
In forceFebruary 2025
Ban on prohibited practices
In forceAugust 2025
General-purpose AI models (GPAI) & governance
In forceAugust 2026
High-risk system obligations (Annex III)
In forceAugust 2027
High-risk embedded in products (Annex I)
UpcomingWhat does the AI Act cover?
The AI Act classifies as high-risk those AI systems that constitute a medical device or a safety component of such a device, as well as those whose intended use is listed in Annex III. Obligations cover risk management, data quality, transparency, human oversight, and robustness.
This regime interfaces with medical device regulation, which imposes its own conformity assessment.
Is the 'Healthcare' sector affected?
Providers and deployers of medical AI are concerned. High-risk status imposes significant obligations whenever the AI contributes to a decision affecting a person's health (diagnosis, referral, prioritisation).
A purely administrative AI (scheduling, billing) may fall under limited risk; it is the clinical use that triggers a shift to high risk.
Detailed obligations
Classify the system
Determine the risk level and status (provider or deployer); clinical use generally leads to high-risk classification.
Manage risks
Implement a risk management system covering the entire lifecycle of the AI system.
Guarantee data quality
Ensuring the relevance, representativeness and quality of training, validation and test datasets.
Ensuring human oversight
Enable effective human oversight: a professional must be able to understand, weigh, and contest the AI's output.
Document and assess
Compile the technical documentation and carry out the conformity assessment, in conjunction with medical device frameworks.
Monitoring after market placement.
Organise post-market surveillance and the reporting of serious incidents.
Sanctions & risks
Up to €35 M or 7% of turnover for prohibited practices and €15 M or 3% for failures to meet high-risk obligations, in addition to the sectoral sanctions applicable to medical devices.
A failure in qualification or supervision of a clinical AI exposes the organisation to sanctions and system withdrawal.
Application timeline
- 1Entry into force. 1 August 2024.
- 2High-risk systems. Main obligations from 2 August 2026, with specific deadlines for certain systems integrated into regulated products.
Common mistakes in the sector
- 1Underestimated classification. Treating a clinical AI as a simple limited-risk tool.
- 2Managers handled separately. Managing the AI Act and medical devices in silos.
- 3Uncontrolled data. Using unrepresentative or poorly documented training data.
- 4Superficial oversight. Displaying human oversight without real means to challenge the output.
Practical case
A software publisher offers an imaging reading assistance solution. As an AI-based medical device, it falls under the high-risk category: the publisher must document the quality of its training data, provide for practitioner supervision, and align its AI Act conformity assessment with the medical device assessment, rather than conducting two independent processes.
Compliance roadmap
- 1
Inventory. Inventory clinical and administrative AI systems.
- 2
Qualify. Determine the risk level and status of each one.
- 3
Align the frameworks. Align AI Act documentation with medical device regulations.
- 4
Governing usage. Implement human oversight and traceability.
- 5
Monitor. Organising post-market surveillance.
Frequently asked questions
No: an administrative AI application may fall under limited risk. It is the clinical use — diagnosis, triage, decisions affecting health — that shifts it into the high-risk category.
Take action on AI Act
Free assessment or a chat with an expert dedicated to health.
They already trust us
See how organisations in the health sector secured their compliance with DCO.