Quick answer
The EU AI Act is the European Union's risk-based regulation for artificial intelligence. It applies to organizations that develop, provide or use AI systems, including pharmaceutical, biotechnology and medical device companies. Compliance requirements depend on the AI system's level of risk, with high-risk applications subject to strict rules for risk management, human oversight, documentation, data governance and cybersecurity.
Introduction
The life sciences industry is notoriously inefficient, with innovative drugs taking roughly a decade of labor-intensive research to develop; a process that involves vast quantities of data and countless repetitive administrative processes. From there, manufacturing and distribution creates another mountain of repetitive quality checks and a mountain of data.
This makes the life sciences industry a prime candidate for AI adoption because AI tools offer the most exciting efficiency gains in use cases that involve a great deal of data and a great deal of repetition.
The EU AI Act was introduced in 2024 to establish a unified, risk-based legal framework for artificial intelligence, aimed at ensuring that AI systems are safe and developed in trustworthy ways that respect fundamental human rights.
The EU AI Act is applicable to all industries and organizations developing or leveraging AI systems, including the life sciences industry, and organizations need to be aware of how to remain compliant.
In this post, we’ll explain why the EU AI Act is important, how to understand the AI Act’s risk-based approach and provide key compliance requirements for high-risk AI systems.
Key takeaways
What is the EU AI Act?
The EU AI Act is a ground-breaking legal framework for governing artificial intelligence; the first in the world to be so comprehensive. The intention behind it is to make sure that AI systems are developed and used safely and transparently, respecting fundamental human rights by design.
Understanding the AI Act's risk-based approach
Compliance obligations for organizations vary depending on which risk-category the EU AI Act places them in.
At a glance: The EU AI Act's four risk levels
| Risk tier | Level of regulation | Typical examples | Compliance |
| Tier 1 | Unacceptable risk | Social scoring, manipulative AI | Prohibited |
| Tier 2 | High risk | AI medical devices, CDSS, pharmacovigilance | Strict compliance requirements |
| Tier 3 | Transparency risk | Chatbots, AI-generated content | Transparency obligations |
| Tier 4 | Minimal risk | Literature search, scheduling tools | No mandatory requirements |
There are four risk-based tiers:
Tier 1, Unacceptable Risk:
These AI systems are banned outright, as they pose a clear and unacceptable threat to human safety, fundamental rights or democracy.
Date of enforcement: February 2, 2025 (in effect)
Compliance obligations: Article 5 of the EU AI Act covers tier 1 AI systems, and there are no mitigation pathways or exemptions.
Examples: Prohibited AI systems and processes include the scraping of facial images indiscriminately for facial recognition databases, biometric categorization based on race, political opinions or any other sensitive attribute, sublimation, manipulation or the exploitation of vulnerabilities to distort their behavior, predictive policing and social scoring of individuals or groups over time.
Tier 2, High Risk:
AI systems deemed to be high risk have the potential to affect health, safety or fundamental human rights.
Date of enforcement: August 2, 2027, and August 2, 2028, depending on classification.
Non-compliance penalties: Fines up to €15 million, or 3% of worldwide annual turnover, whichever is higher.
Compliance obligations: Article 6 covers high-risk AI systems. Systems need to pass rigorous conformity assessments before being launched on the market and follow strict rules that require risk management systems and high-quality data governance.
Examples: There are many examples of high-risk AI systems across a range of contexts, including public services and critical infrastructure. For life sciences organizations specifically, like pharma Medtech companies, examples include:
- Pharmacovigilance AI models that flag potential safety issues with drugs.
- Diagnostic imaging software that analyzes various scans to detect tumors or fractures.
- Clinical trial recruitment AI platforms that screen, rank and potentially flag potential participants to approach for clinical trial enrollment.
- Clinical Decision Support Systems (CDSS) that help doctors with clinical decision making such as flagging potential diagnoses, tests and treatment planning.
- Smart patient monitoring systems that involve wearables or bedside software to monitor patients’ vital signs and detect or predict health risks like heart irregularities or sepsis.
Tier 3, Specific Transparency Risk:
This tier covers AI systems that interact with people, recognize emotion, perform permitted biometric categorization or generate content.
Date of enforcement: August 2, 2026 (in effect).
Non-compliance penalties: Fines of up to €15 million, or 3% of worldwide annual turnover, whichever is higher.
Compliance obligations: Article 50 covers transparency obligations for providers (developers) and deployers (business users). The core compliance obligations revolve around transparency and ensuring that individuals know when they are interacting with AI or viewing AI generated content including text related to matters of public interest, images, audio and video through labeling.
Chatbots and agents from developers must be engineered so that the system architecture communicates the identity of the system to any software that integrates it. But there are exemptions, such as when works are purely creative or editorial.
Examples: A Medical Technology company develops a medicines-support avatar that can be licensed to healthcare institutions or pharmaceutical companies, where it is adapted to be HCP-facing or patient-facing. They are obligated to engineer the interface so that it explicitly forces a notification to alert the end-user that they are interacting with an AI system. A pharmaceutical company (the deployer/user) then licenses the tool for Medical Information purposes as a chatbot for HCPs.
The Medical Affairs team that are deploying the tool are obligated to ensure that the first greeting or window clearly states that the HCP is speaking with an automated AI assistant, and provide a channel for human interaction when inquiries are critical.
Other generative outputs from this tier of AI system include medical communication and educational materials, and pharmaceutical marketing materials. For example, a data science team trains a generative AI model on authentic anatomical data to generate synthetic 3D liver models for various uses such as to train surgical planning software or for use in medical educational videos for HCPs.
The developer must embed compliant, machine-readable watermarks into the generated files to show they are synthetic. Any deployers, such as a pharmaceutical marketing team generating patient education videos must comply with “deepfake” disclosure rules and clearly label the video with a disclaimer stating that the visuals were created using AI.
Tier 4, Minimal Risk:
These AI systems are deemed to pose negligible or not threat to human safety, human rights or livelihoods (despite the fact that many in the industry fear their livelihoods are indeed at risk from their deployment).
Date of enforcement: N/A
Compliance obligations: No mandatory legal requirements.
Examples: R&D literature search tools, text mining and document retrieval tools used to search academic papers or databases, laboratory logistics and scheduling tools that optimize administrative tasks, or laboratory productivity assistants.
| AI application | Likely EU AI Act tier |
| AI medical device | High Risk |
|
Clinical Decision Support |
High Risk |
| Pharmacovigilance AI | High Risk |
| Patient monitoring | High Risk |
| Clinical trial recruitment | High Risk |
| Medical chatbot | Transparency Risk |
| AI-generated educational content | Transparency Risk |
| Literature search assistant | Minimal Risk |
| Meeting transcription | Minimal Risk |
What does the EU AI Act mean for life sciences?
The EU AI Act intersects with life sciences existing regulatory frameworks by layering horizontal AI rules over industry-specific frameworks such as the Medical Device Regulation (MDR), In Vitro Diagnostic Regulation (IVDR) and General Data Protection Regulation (GDPR), creating a dual-compliance landscape.
How the EU AI Act overlays MDR and IVDR
AI systems that act as medical devices or monitor safety and risk require dual certification, that is they need both a CE mark indicating MDR/IVDR compliance and an AI Act high-risk conformity assessment. Thankfully, the same Notified Bodies are responsible for both and the AI conformity assessment has been integrated into the existing audit framework of quality management systems.
How the EU AI Act overlays GDPR
The EU AI Act mandates that health-related algorithms require training on unbiased, high-quality data, but this creates tension with the GDPR principles of minimizing data sharing and the right-to-be-forgotten. The EU AI Act explicitly states that it does not affect the existing EU law on the protection of personal data, naming the GDPR, specifically. This means that the two legal frameworks apply simultaneously. Where there is overlap, it is the stricter standard that must be applied.
Key compliance requirements for high-risk AI systems
High-risk AI systems are mostly covered by Article 6 of the EU AI Act, and there are two classifications pathways: Article 6(1) which applies to AI systems used in products and safety components such as medical devices or machinery, and Article 6(2) which covers standalone use cases in high-risk domains such as AI-driven patient triage, clinical trial participant recruitment or HCP/physician copilot/guidance systems.
Legal obligations depend on whether the organization is the developer or deployer of the system. On the developer side, systems need to pass rigorous conformity assessments before being launched on the market. Manufacturers/providers are required to follow a large number of requirements including the following:
- Implement a Risk Management System: A continuous Risk Management System across the lifecycle of the system
- Implement Data Governance Systems: in which representative datasets are stored for training, validation and testing. Data must be free of bias and high quality.
- Retain Technical Documentation: Providers must document compliance and provide transparency during audit.
- Rigorous human oversight mechanisms that allow natural persons to monitor and override the AI system.
- Traceability requirements with systems automatically logging events with minimum 6-month data retention. Data must demonstrate timestamps, actions and outputs, to ensure traceability.
- A high level of accuracy and robust cybersecurity to protect against errors or malicious attacks.
On the deployer’s side, compliance requirements include:
- Strictly following the provider’s instructions for use and technical guidance.
- Ensuring trained, competent natural persons are providing oversight.
- Ensuring that any data input into the system from the deployer’s side is relevant, high quality, unbiased and fit-for-purpose.
- Retaining automatically generated logs of actions and access for at least six months.
- Informing workers before deploying high-risk AI systems in the workplace.
- Conduct a Fundamental Rights Impact Assessment (FRIA) before active rollout when required.
Before Compliance timelines and how organizations can prepare
| Date | Milestone | Status |
| Feb 2025 | AI literacy & prohibited AI | In effect |
| Aug 2025 |
GPAI obligations |
In effect |
| Aug 2026 | Transparency obligations & most high-risk rules | Upcoming / In effect (depending on article date) |
| Aug 2027-2028 | High-risk grace periods end | Upcoming |
Compliance timelines and how organizations can prepare
First introduced on August 1st, 2024, the EU AI Act requirements are taking effect in phases, with some extended grace periods for high-risk AI embedded in certain regulated products such as medical devices:
Phase 1, AI literacy obligations: February 2nd, 2025 (in effect)
Certain AI literacy obligations and prohibited practices such as social scoring and subliminal manipulation became enforceable.
Phase 2, General-Purpose AI: August 2nd, 2025 (in effect)
General-Purpose AI (GPAI) models and core governance rules took effect.
Phase 3, High-risk AI: August 2nd, 2026 (new)
The majority of high-risk AI system requirements take effect.
Phase 4, High-risk AI Grace period: August 2027 and 2028
Extended grace periods end for high-risk AI embedded in regulated products, such as medical devices.
To remain compliant with the EU AI Act, life sciences organizations must catalog all deployed AI systems, as well as those under development, and evaluate the risk tier under the act’s risk-based framework.
Organizations must be aware of the current obligations under phase 1 and 2, already in effect, and undertake immediate operational preparations for the upcoming deadlines for high-risk AI systems, such as software-based medical devices, patient triage mechanisms and Clinical Decision Support Systems, to ensure they understand what is required of them.
Recommended learning:
QARA expert shares how to use AI in quality management and regulatory work.
Conclusion: Prepare for EU AI Act compliance with a digital QMS
The EU AI Act introduces a comprehensive, risk-based framework for the development and use of artificial intelligence across the European Union. For life sciences organizations, its impact is particularly significant because many AI applications can directly affect patient safety, clinical decision-making and fundamental rights.
Although not every AI system will be classified as high risk, organizations must understand how each system is being used and where it sits within the Act’s four-tier risk framework. High-risk systems may be subject to extensive requirements relating to risk management, data quality, documentation, human oversight, traceability, accuracy and cybersecurity.
The EU AI Act also does not replace existing life sciences regulations. Instead, it creates an additional layer of compliance alongside frameworks such as MDR, IVDR and GDPR. This means that organizations need a coordinated approach that connects AI governance with their existing quality, regulatory and data protection processes.
A digital quality management system such as Scilife Smart QMS can help organizations prepare by centralizing documentation, formalizing workflows and maintaining traceable evidence of compliance activities. With Scilife Smart QMS, life sciences organizations can:
- Centralize AI policies, procedures and technical documentation
- Document risk assessments and risk control measures
- Manage approvals, reviews and change control
- Maintain training records and demonstrate AI literacy
- Track corrective and preventive actions
- Improve traceability and audit readiness
- Connect AI governance with existing quality management processes
By identifying AI systems early and embedding EU AI Act requirements into the existing quality management framework, organizations can reduce compliance risks while continuing to benefit from the efficiencies and innovations that AI offers.
Build a stronger foundation for AI governance with Scilife's Smart Quality QMS. See how it helps life sciences teams stay compliant and inspection-ready.
