The EU AI Act is the first broad law on artificial intelligence, and life sciences companies keep asking the same question about it: does it apply to us? The honest answer is that it applies to some of what you do, probably less of it than you fear, and in at least one way that most companies have not noticed yet.
The timeline in brief
The Act, Regulation (EU) 2024/1689, entered into force in August 2024 and applies in stages. Bans on certain practices and a general duty on AI literacy have applied since February 2025. Obligations for general-purpose AI models followed in August 2025. Most rules for high-risk systems were set to apply from August 2026, with high-risk AI built into products already covered by EU safety law, such as medical devices, following in August 2027.
In late 2025 the Commission proposed pushing back some high-risk dates while supporting standards are finished. Check the current position before you plan around a specific date, because this part is still moving.
Most GxP AI is not high-risk under the Act
This surprises people. The Act defines high-risk by use, through a fixed list and through links to existing product law. AI that drafts a validation document, flags deviations for review or supports batch record review in a pharmaceutical plant is not, in itself, on that list.
That does not mean it is unregulated. It means the rules that govern it are the ones you already know: GMP, GCP, GVP, data integrity expectations, and in time the draft EU GMP Annex 22. The AI Act sits beside them, not on top of them. Our GxP AI page covers how those GxP expectations apply.
Where the Act does bite
- Medical devices with AI. AI that is a safety component of a device, or is the device, and needs a notified body under MDR or IVDR, is high-risk. Manufacturers face AI Act requirements on top of MDR, designed to be handled through one conformity assessment where possible.
- HR and workforce tools. AI used for recruitment, promotion or performance decisions is on the high-risk list. Pharma companies use these tools like everyone else, and they are often bought by HR with little involvement from quality or legal.
- AI literacy. Since February 2025, organisations using AI must take measures to ensure their staff have sufficient AI literacy for their role. That applies whatever the risk level.
Provider or deployer
The Act separates providers, who develop an AI system or put it on the market, from deployers, who use it. Most life sciences companies are deployers of the AI they buy. Deployer duties for high-risk systems include using them according to instructions, assigning human oversight to competent people, monitoring operation and keeping logs.
Be careful with heavy customisation. If you substantially modify a system or put your own name on it, you can become a provider, with much heavier obligations.
A practical first step
Build an inventory of AI in use across the company, not just in quality. For each item, record what it does, who uses it, whether it falls under a high-risk category, and which GxP rules apply. Most companies find the inventory itself is the hardest part, and the most useful.
Our AI governance work starts there, and our guide to AI governance in life sciences covers what to put around it.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.