EU Artificial Intelligence Act becomes applicable, with medical-device obligations deferred to 2028

Regulation (EU) 2024/1689, the European Union's Artificial Intelligence Act, became applicable on 2 August 2026. From that date, in the European Commission's words, "the AI Office and authorities of the Member States are responsible for implementing, supervising and enforcing the AI Act." The high-risk obligations that bite on AI embedded in regulated products, medical devices among them, have been pushed back to 2 August 2028. For developers of clinical AI, the date that arrived in August 2026 is therefore not the date on which most of their obligations start.

The Act entered into force on 1 August 2024. The Commission states that it "became applicable on 2 August 2026, with some exceptions." Those exceptions are what matter most to clinical AI.

The medical-device carve-out is set out directly by the Commission: "the rules for high-risk AI systems embedded into regulated products (Annex I) have an extended transition period until 2 August 2028." Annex I is the list that covers medical devices requiring notified-body assessment under the Medical Device Regulation and the In Vitro Diagnostic Regulation. In practice, a Class IIb or Class III device under the Medical Device Regulation, or a Class C or D in-vitro diagnostic, with AI inside it, is a high-risk AI system under Article 6(1), but its AI Act conformity obligations are not enforceable until 2 August 2028. The horizontal transparency, governance and general-purpose AI provisions apply now.

Annex III high-risk use cases, which cover biometrics, critical infrastructure, education, employment, and migration, asylum and border control, were extended to 2 December 2027. The Commission attributes both extensions to "the political agreement on the proposal to simplify the AI Act", known as the AI Omnibus. The deadlines were moved rather than met.

Parts of the regime were already binding before this date. Prohibited AI practices and AI literacy requirements applied from 2 February 2025, and governance rules and obligations on general-purpose AI models from 2 August 2025. The AI Office holds enforcement powers over general-purpose AI models and, again in the Commission's own description, "can request technical documentation, evaluate models, require corrective measures and issue fines for non-compliance."

Governance is exercised through three bodies: the AI Board, the Scientific Panel and the Advisory Forum. Of the three, the Scientific Panel is not yet running. It is to be operational by 2027, to strengthen third-party assessment of AI capabilities and risks.

Also live from 2 August 2026 are the Commission's guidelines on transparency obligations for providers and deployers of certain AI systems, including a set of icons for disclosing AI-generated images, audio including deepfakes, and text. A July 2026 action plan on Cybersecurity and AI accompanies the regime. Under it, the Commission and ENISA are to build a blueprint for secure access to advanced AI systems and a secure testing platform for critical sectors, health among them.

The deferral arrives while notified-body capacity under the Medical Device Regulation remains the acknowledged bottleneck for European medical-device certification, and while the United Kingdom runs a separate route. The MHRA has launched a London Region AI Regulatory Sandbox with NHS England (London) and three Health Innovation Networks, open to up to ten AI device manufacturers, with expressions of interest opened on 30 July 2026.

For health AI developers selling into the European Union, the two dates that now matter are 2 December 2027 for the Annex III use cases and 2 August 2028 for AI embedded in regulated products. Those are the operative compliance deadlines.