EU AI Act for Life Sciences: The Deadline Moved. The Operating Model Did Not.

The EU AI Act has given life sciences companies more time on the most resource-intensive part of the regime. It has not permitted commercial teams to wait.

On 29 June 2026, the Council of the European Union gave final approval to the Digital Omnibus on AI, part of the EU’s broader simplification agenda. The package moves the application of high-risk AI obligations to 2 December 2027 for stand-alone high-risk AI systems, and to 2 August 2028 for high-risk AI systems embedded in products covered by sectoral safety legislation, including medical devices. The legislative act still needs publication in the Official Journal and will enter into force on the third day after publication, but the political and regulatory direction is now clear. For many AI-enabled medical devices, clinical decision-support tools and software products, the formal compliance runway has lengthened.

That is the headline. It is not the real story.

The real story is that AI governance in life sciences is no longer a legal workstream sitting somewhere between privacy, regulatory affairs and IT. It is becoming part of the commercial operating model: how companies select vendors, design HCP engagement, run patient support, generate evidence, use field-force recommendations, and decide which tools can safely move from pilot to production.

For commercial leaders, the risk is not only regulatory non-compliance. It is building an AI-enabled commercial model that cannot survive procurement scrutiny, MLR review, market-access due diligence or hospital trust checks.

Lovely PowerPoint, terrible aftertaste.

The Digital Omnibus changes the high-risk timetable. It does not reset the AI Act.

The AI Act entered into force on 1 August 2024. The European Commission’s implementation timeline confirms that prohibited AI practices and AI literacy obligations have applied since 2 February 2025, while governance rules and obligations for general-purpose AI models have applied since 2 August 2025. The main regulation remains broadly applicable from 2 August 2026, with staged exceptions.

The new Omnibus dates matter most for two high-risk routes.

First, stand-alone high-risk AI systems listed under Annex III now move to 2 December 2027. In life sciences commercial work, this is not theoretical. Annex III includes AI used in employment, worker management and access to essential private and public services. Commercial teams may encounter this in AI-supported territory allocation, field-force performance analytics, patient-access triage, reimbursement support, resource allocation or eligibility tools.

Second, AI embedded in products covered by sectoral legislation moves to 2 August 2028. This is the route most relevant to AI-enabled software as a medical device, diagnostic software, clinical decision-support tools and connected medical devices where the AI system is itself a product or a safety component of a regulated product.
[See: AI Act Article 6 classification rules; AI Act Annex III high-risk systems]

That distinction matters because many teams have been watching the wrong clock. A product team building AI-enabled SaMD may be on the 2028 route. A commercial organisation deploying AI to optimise HCP targeting, evaluate reps, triage patient-support eligibility or recommend access interventions may be closer to Annex III exposure. The Act does not care whether the system sits in a product roadmap or in the commercial technology stack. It cares what the AI system does and what risk category it falls into.

The Omnibus also changes parts of the transparency timeline. The Council states that the new regulation sets 2 December 2026 as the deadline for providers to implement transparency solutions for artificially generated content. Separately, Article 50 still matters for customer-facing AI: people must be informed when they are interacting directly with an AI system unless that is obvious in context. For HCP portals, patient support chatbots, AI-assisted medical information interfaces and AI-generated content workflows, transparency is not a footer. It is a design requirement.

The easiest mistake is to treat the EU AI Act as another regulatory checklist.

That is too small.

In life sciences, AI is moving into precisely the places where commercial judgement, medical governance, evidence, data and customer trust meet. AI systems now support segmentation, next-best-action recommendations, content adaptation, payer analytics, forecasting, patient identification, trial recruitment, field-force planning and post-market evidence generation. Some of these tools are low-risk productivity aids. Some are high-risk systems. Many will sit in the uncomfortable middle until guidance, documentation and internal governance catch up.

That ambiguity becomes a commercial problem in four places.

The first is vendor due diligence. Most commercial AI capability is not built entirely in-house. It arrives through CRM extensions, agency tools, analytics platforms, medical information systems, patient-support vendors, content engines and field-force productivity products. If procurement does not ask the AI Act classification question early, the organisation may buy a tool it cannot deploy at scale without additional documentation, human oversight, data-governance controls or contractual protections.

The second is launch planning. A digital therapeutic, companion app, remote monitoring tool or AI-enabled device can clear one regulatory gate and still face delays if the commercial team has not modelled the AI Act, MDR, GDPR, cybersecurity and evidence expectations together. A CE mark under the Medical Device Regulation does not automatically satisfy AI Act obligations. The Council’s Omnibus text explicitly recognises overlap between AI rules and sectoral legislation such as medical devices, and creates mechanisms to limit duplication through implementing acts. But overlap is not the same as exemption. Until the operational pathway is clear, commercial plans need to account for the extra governance burden.

The third is market access. Payers, HTA bodies and hospital procurement teams are becoming more sophisticated about AI. They are not only asking whether the product works. They increasingly want to know whether the model is governed, monitored, explainable enough for the use case, integrated safely into workflow, and aligned with data-protection expectations. In markets where trust in AI remains fragile, governance is part of the value proposition.

The fourth is MLR and content operations. Generative AI can produce more content than regulated organisations can safely review. That is not innovation; that is a compliance treadmill with better shoes. Article 50 transparency, synthetic-content labelling, provenance, version control, prompt governance and human review all matter when AI enters promotional content, medical education, disease awareness or HCP support. The bottleneck is not only whether AI can generate something. It is whether the organisation can prove what was generated, from which source, for which audience, under which approval logic.

A sensible AI Act response starts with inventory. Not a beautiful inventory. A useful one.

Commercial leaders should begin with the systems that shape decisions about people: HCPs, patients, employees, customers and accounts. In practice, that means at least seven categories.

Start with HCP engagement systems: next-best-action engines, AI-assisted segmentation, propensity models, automated channel recommendations and content-personalisation tools. These systems may not diagnose or treat, but they influence commercial decisions at scale.

Then look at patient-support and access tools: eligibility engines, reimbursement assistance, prior-authorisation support, patient navigation, risk stratification and adherence prediction. If an AI system affects access to healthcare support, the classification discussion becomes much more serious.

Third, review field-force and workforce analytics: territory optimisation, rep scoring, coaching recommendations, incentive support, performance prediction and workforce allocation. Annex III’s employment and worker-management category should make commercial operations teams sit up a little straighter.

Fourth, map AI in content operations: medical copy generation, promotional adaptation, modular content assembly, translation, claims checking, automated tagging and MLR routing. Even when these tools are not high-risk, they raise transparency, provenance and quality-management questions.

Fifth, include payer and market-access analytics: budget impact support, real-world data analysis, account prioritisation, hospital pathway modelling and tender or opportunity scoring. These systems often influence commercial choices without being visible as AI to end users.

Sixth, include customer-facing AI interfaces: HCP chatbots, medical information assistants, self-service support tools, patient-facing conversational agents and AI-enabled portals. Here, Article 50 is a direct operating-model concern.

Finally, include AI-enabled regulated products: SaMD, diagnostics, clinical decision support, remote monitoring and connected devices. These may sit under product or regulatory teams, but commercial teams inherit their market-access consequences.

The point is not to panic. The point is to stop pretending the AI stack is smaller than it is.

The AI Act creates obligations for providers, deployers and other operators. Commercial organisations need a practical translation of that language.

Who owns classification? Not in theory. In the process. When a country team proposes a new AI-enabled HCP targeting tool, who decides whether the tool is prohibited, high-risk, limited-risk or ordinary enterprise software? Legal cannot do this alone. Neither can IT. The decision requires commercial context, regulatory interpretation, data protection, procurement and sometimes medical governance.

Who owns the output? If an AI system recommends that a rep should visit one HCP rather than another, or that a patient should be routed into one support pathway rather than another, who is accountable for that decision? The vendor? The brand team? The local affiliate? The deployer? The field manager who accepted the recommendation? This is where elegant AI strategy starts sweating through its shirt.

Who owns monitoring? High-risk AI obligations include risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity. Even where a system is not high-risk, regulated life sciences companies need post-deployment monitoring because models drift, data changes, product claims evolve and market context shifts.

Who owns the stop button? Human oversight is not a slogan. It requires an operating design: thresholds, escalation rules, override rights, audit trails and the authority to pause a tool when performance, bias, safety or compliance concerns emerge.

And who owns the vendor file? Commercial AI is often bought faster than it is governed. The minimum standard should be simple: no AI-enabled vendor enters commercial production without AI classification, data processing review, security assessment, intended-use documentation, human oversight design, auditability and a named internal owner.

The new timeline is useful because it creates room to build the model properly. Squandering that room would be impressively on-brand for the industry, but still a bad idea.

The first move is to create a commercial AI register. This should not be a static spreadsheet buried in compliance. It should be a living register across CRM, content, analytics, patient support, market access, field operations and regulated digital products. The register should capture intended use, user group, vendor, model type where known, data inputs, decision impact, classification view, owner, market, and whether the system touches patients, HCPs, employees or access to care.

The second move is to make AI Act classification part of commercial governance. New campaigns, platforms, vendors and pilots should not enter production without an AI classification check. This sounds bureaucratic. It is less bureaucratic than unwinding a tool after procurement, integration and local rollout.

The third move is to redesign vendor due diligence. The question is no longer “does the tool have AI?” That question is useless. The better questions are: what is the intended use, what decisions does the system influence, what data was used to train and validate it, what documentation exists, what human oversight is required, what logs are available, who monitors performance, and what changes if the tool is deployed in Germany, France, Spain or the UK?

The fourth move is to connect AI governance to MLR and content operations. AI-assisted content needs provenance, approval logic, human review, version control and disclosure rules. If the same AI system generates promotional adaptation, medical education content and internal training material, the organisation needs different governance for each use case.

The fifth move is to treat AI governance as market-access infrastructure. For digital health, SaMD and AI-enabled devices, a documented governance posture can support payer conversations, procurement qualification and clinical adoption. It will not replace evidence. But weak governance can undermine otherwise credible evidence, especially when AI is involved in clinical or access decisions.

This also intersects with broader European health data governance. The European Health Data Space entered into force in March 2025 and begins staged application from 2027 onward. That means AI Act readiness, health data access, secondary use of health data, GDPR, MDR and market access will increasingly collide in the same operating model.