The EU Artificial Intelligence Act entered into force in August 2024 — the world's first comprehensive, legally binding framework for AI governance. For most industries, it is a distant concern. For healthcare, the reckoning is immediate, structural, and still being debated.
Unlike most regulation, which targets a product or a sector, the AI Act is horizontal: it cuts across industries and lays new obligations on top of existing ones. In healthcare, where AI already operates within the Medical Device Regulation (MDR) and the In Vitro Diagnostic Regulation (IVDR), the Act does not replace those frameworks — it adds a second layer. The result is a dual compliance structure that is reshaping how AI is built, sold, and used across European medicine.
Healthcare as universally high risk
The Act classifies AI systems into four categories — prohibited, high-risk, limited-risk, and minimal-risk — and places most of its regulatory weight on high-risk systems. In healthcare, high-risk is the default rather than the exception.
Any AI system that is itself a medical device, or a safety component of one, and that already requires third-party conformity assessment under the MDR or IVDR, is automatically classified as high-risk under the Act. In practice, this covers MDR Class IIa, IIb, and Class III devices — which captures virtually every commercially deployed clinical AI tool: diagnostic imaging algorithms, surgical decision support, digital pathology models, Software as a Medical Device (SaMD). Even healthcare AI that is not a medical device can become high-risk if it performs emergency triage, determines eligibility for healthcare benefits, or sets health insurance pricing.
What this means, concretely, is that providers of high-risk AI systems face a mandatory stack of obligations: continuous risk management, data and data governance documentation, technical transparency files, logging and record-keeping, human oversight mechanisms, bias and fairness controls, post-market monitoring, and incident reporting to competent authorities within 15 days of identifying a serious risk. These requirements are layered on top of whatever the MDR already demands — they do not substitute for it.
Healthcare startups
For early-stage companies building diagnostic tools, clinical decision support, or AI-enabled SaMD, the compliance architecture is potentially decisive.
Estimated compliance costs for a healthtech startup deploying a single high-risk AI system run from €350,000 to €500,000 in initial implementation costs, with €80,000 to €150,000 in annual maintenance. The largest component is the quality management system (QMS), which alone can cost €193,000 to €330,000 to build, plus €71,000 per year to maintain. These figures include clinical validation studies, patient safety monitoring infrastructure, health data governance, legal counsel for dual MDR/AI Act compliance documentation, and third-party conformity assessment fees.
A 2026 survey found that EU and UK tech startups delayed by AI regulation lose between €94,000 and €322,000 annually per firm from delayed product launches, a figure that rises to €453,000 for directly affected small technology companies. The concern, repeatedly raised by industry associations, is that the burden does not fall evenly: large medtech incumbents absorb compliance costs as overhead, while startups face a structural disadvantage that could progressively consolidate the medical AI market around established players.
The Act is not entirely blind to this asymmetry. It mentions small and medium enterprises 38 times — more than any other stakeholder category — and includes provisions specifically designed to reduce startup friction. These include priority free access to AI regulatory sandboxes, proportional notified body fees, simplified technical documentation forms, and dedicated Commission guidance channels. In December 2025, the European Commission published draft rules for AI regulatory sandboxes, creating supervised testing environments where startups can develop and validate AI systems under regulatory oversight before market entry, with participation free of charge for SMEs. However, the Act's concessions to SMEs are structural accommodations, not exemptions — a startup building a diagnostic AI for oncology still faces the same conformity assessment as a multinational.
Dual compliance trap
The most structurally complex challenge for any company selling AI-enabled medical devices into Europe is not understanding what the AI Act requires — it is managing two regulatory frameworks simultaneously without being caught between their inconsistencies.
The MDR and IVDR were designed before modern AI was a clinical reality. They govern device safety and efficacy, but say nothing specific about model drift, training data bias, explainability, or the particular risks of continuously learning systems. The AI Act closes that gap by introducing AI-specific requirements: bias mitigation, functional traceability, cybersecurity, and mandatory human oversight mechanisms. In June 2025, the Medical Device Coordination Group (MDCG) and the EU AI Board published joint guidance (MDCG 2025-6) clarifying how the two frameworks interact, permitting manufacturers to integrate AI Act obligations (such as risk management and post-market monitoring) into their existing MDR/IVDR quality management systems and produce a single unified technical file rather than two separate ones.
This integration eases the administrative burden somewhat, but the underlying problem remains: compliance with both frameworks simultaneously requires notified body involvement, and notified bodies are scarce. Existing MDR/IVDR notified bodies cannot automatically extend their designation to cover AI systems under the Act — they must undergo a separate designation process under Article 31, meeting distinct requirements around organizational structure, technical competence, and resource allocation. The European association of notified bodies warned in its April 2025 position paper that delays in national-level designation processes could produce a capacity crunch precisely when high-risk obligations become enforceable, potentially delaying market entry of innovative AI systems.
This structural bottleneck does not affect all companies equally. Large manufacturers with established regulatory relationships can navigate the queue; smaller companies often cannot. The irony is that the Act's intended effect — ensuring safer AI reaches patients faster — could be partially undermined by the administrative infrastructure required to certify that safety.
Hospitals building in-house
A separate, underappreciated dimension of the Act concerns hospitals and health systems that develop AI internally — tools built for their own patients, not for sale. This is more common than it appears: academic medical centres, teaching hospitals, and health data-rich university hospitals have been building clinical prediction models, triage algorithms, and imaging tools for years.
The AI Act's primary obligations target providers — those placing AI systems on the market or putting them into service. When a hospital builds and deploys a tool exclusively for its own patients and does not place it on the market, it may be exempt from third-party notified body conformity assessment under the MDR's in-house exemption. If the in-house exemption applies, the AI system may not automatically qualify as high-risk under Article 6 of the Act, since high-risk classification under Article 6(1) is contingent on a notified body being required.
The key word here is may. Article 43(3) of the Act suggests that certain AI systems could still qualify as high-risk even where the in-house MDR exemption applies, and the European Commission has not yet provided definitive guidance on this question. In the interim, legal experts advise hospitals to apply the high-risk compliance framework voluntarily — not because it is legally mandatory in every case, but because the risk profile of deploying an unvalidated triage algorithm on real patients is identical regardless of whether it was bought from a vendor or built internally.
For hospitals that deploy commercially purchased AI tools, the picture is clearer: they are deployers under Article 26 of the Act, and deployer obligations are enforceable from August 2026. These include using AI systems strictly according to the provider's instructions; assigning human oversight to staff with documented competence, training, and authority to intervene; monitoring operation and reporting risks or serious incidents; retaining automatically generated logs for a minimum of six months; and notifying affected workers. Public hospitals deploying high-risk AI must also register their usage in the EU AI database.
Crucially, the Act kills the "vendor handles compliance" defense. A hospital that deploys a high-risk AI diagnostic tool and fails to maintain adequate oversight cannot point to the manufacturer's documentation as absolution — the deployer is independently responsible for how the system operates in its specific clinical context. This has real operational implications: hospitals need AI-literate clinical staff not merely to use these tools, but to govern them.
The patient dimension
For patients, the AI Act represents a legal shift of genuine significance — though one whose practical meaning is still being worked out.
The most substantive new patient right is found in Article 86: any person subject to a decision made by a deployer on the basis of a high-risk AI system — where that decision produces legal effects or significantly affects their health, safety, or fundamental rights — has the right to obtain a clear and meaningful explanation of the AI's role in the decision. This is new. Before the Act, a patient whose cancer screening result was shaped by an AI diagnostic algorithm had no formal legal basis to demand an explanation of how that determination was reached.
The right exists, but whether it can be exercised in practice is a different question. A March 2026 analysis in the Journal of Medical Internet Research observed that the Act and the GDPR together give patients legal grounds to seek explanations of AI-driven medical recommendations, but that neither framework specifies what a meaningful explanation requires in clinical practice. Technical explainability methods are primarily designed to satisfy developers and regulators, not patients in a consultation room. The gap between compliance ("Was an explanation provided?") and effectiveness ("Can a patient use it to make an informed decision?") is not addressed by law alone.
The Act also introduces Fundamental Rights Impact Assessments (FRIAs) under Article 27 — the world's first legally binding impact assessment specifically focused on AI and fundamental rights. For healthcare AI, this means deployers must systematically assess how a given AI system might affect specific patient populations: how an emergency triage algorithm treats elderly patients or non-native speakers differently, whether a diagnostic model performs equitably across racial or socioeconomic groups, whether the system's outputs could exacerbate existing inequalities in care access. This is not a box-checking exercise. Designing a genuinely equitable clinical AI system requires longitudinal data governance and continuous monitoring — both of which now carry regulatory weight.
For patients interacting with AI-powered virtual health assistants or chatbots, the Act's transparency obligations under Article 50 require that users be informed they are interacting with AI, that AI-generated outputs be machine-readable and recognisable as artificially generated, and that healthcare providers receive downstream documentation about the AI system's capabilities and limitations. A patient asking an AI symptom-checker whether they need to go to hospital must be informed they are not speaking with a clinician — a requirement that sounds obvious until one considers how many deployed health apps currently obscure this.
General-purpose AI in clinical settings
One area where the Act draws a counterintuitive boundary concerns general-purpose AI (GPAI) models — large language models like GPT-4 and its successors used internally by healthcare professionals for tasks like drafting clinical notes, assisting with literature review, or supporting trial design.
Using a GPAI model for internal drafting or ideation does not create a high-risk AI system under the Act, because the system's intended purpose remains general. A physician using a commercial LLM to structure a clinical note is not operating a high-risk system. The high-risk classification arises only when an organisation develops, modifies, or integrates a GPAI model into a product or service with a healthcare-specific or safety-critical intended purpose — for instance, building an RAG-based clinical decision support system on top of a foundation model and deploying it to influence diagnostic decisions. The distinction is between a tool and a system: the moment an AI model is embedded into a defined clinical workflow with a defined medical intent, the regulatory clock starts.
All GPAI model providers, regardless of risk level, must comply with transparency obligations: they must provide technical documentation, instructions for use, and ensure that healthcare deployers downstream understand the model's capabilities and limitations. For hospitals considering AI procurement, this places new due diligence requirements on vendor selection — it is no longer sufficient to ask whether a model "works"; institutions must assess whether it is properly documented, auditable, and supported by a provider who will fulfil ongoing transparency obligations.
The practical calculus
For those building, deploying, or using clinical AI in Europe, the Act is not a distant regulatory horizon — it is an immediate operational variable. The high-risk obligations that matter most for healthcare become enforceable in 2026, with legacy systems following in 2027 or 2028 depending on the outcome of ongoing Omnibus negotiations.
The companies and institutions that treat compliance as an engineering problem — integrating risk management, logging, and bias monitoring into development workflows from the outset rather than retrofitting them — will fare better than those that approach it as a documentation exercise at the end of the product cycle. The Act's requirements are most costly when they arrive late. Built in from the beginning, they are, at minimum, defensible. Built correctly, they may turn out to be exactly what is needed to earn the trust of a healthcare system that has watched too many AI promises dissolve on contact with clinical reality.
References
- The Governance Platform for Regulated AI — From model development to FDA approval and everything after. "The EU AI Act Is Redefining High-Risk Healthcare AI." October 2024.
- Reed Smith. "The EU AI Act and Medical Devices: Navigating High-Risk Compliance." June 2025.
- Nature npj Digital Medicine. Lans, A. et al. "Navigating the EU AI Act: implications for regulated digital medical products." September 2024.
- Nature npj Digital Medicine. van Velzen, S. et al. "Navigating the European Union Artificial Intelligence Act for Healthcare." August 2024.
- Digital Imaging Research in Europe / Dir Journal. "The AI Act: Responsibilities and Obligations for Healthcare Professionals and Organizations." May 2025.
- SoftwareSeni. "Budgeting for EU AI Act Compliance: Cost Models for SMB Tech Companies." January 2026.
- ACT | The App Association. "The Hidden Cost of AI Regulations: A Survey of EU, UK, and U.S. Companies." February 2026.
- EU AI Act Explorer. "Small Businesses' Guide to the AI Act." February 2025.
- European Commission. "AI Regulatory Sandboxes — Draft Implementing Regulation." December 2025.
- Digital Nemko. "Fundamental Rights Impact Assessments (FRIAs) under the EU AI Act." February 2025.
- KLA Digital. "EU AI Act FRIA Template: Free Fundamental Rights Checklist." January 2026.
- JMIR. Ankolekar, A. "The Right to Understand in Health Care AI." March 2026.
- arXiv. Hummel, A. et al. "The EU AI Act, Stakeholder Needs, and Explainable AI." May 2025.
- Hogan Lovells. "MDCG Published New Guidance on the Interplay Between the MDR & IVDR and the AI Act." June 2025.
- Plesner. "New Guidance on the Interplay Between Medical Device Regulations and the AI Act." September 2025.
- MedTech Europe. "One Year of AI Act: MedTech Europe Calls for Coherent Implementation." July 2025.
- Harvard Petrie-Flom Center. "Simplification or Back to Square One? The Future of EU Medical AI Regulation." March 2026.
- European Parliament. "Artificial Intelligence Act: Delayed Application, Ban on Nudifier Apps." March 2026.
- Arnold & Porter. "EU Digital Omnibus: What the Proposed Reforms Mean for Pharma and Life Sciences." February 2026.
- European Commission. AI Act Application Timeline. Digital Strategy portal, updated January 2026.
- European Commission. "In 2023, the EU Invests in AI Only 4% of What the U.S. Does." March 2025.
- Team-NB. "Position Paper on European Artificial Intelligence Regulation (V2)." April 2025.
- European Health Data Space. EC Digital Health portal, updated March 2026.