EU AI Act for Life Sciences: What You Must Complete by 2027

The EU AI Act Is Here - and Life Sciences Is in the Spotlight

Since August 2024, the EU AI Act has been in force. For most companies, concrete obligations begin in August 2026 (high-risk AI systems). Life sciences companies are particularly affected because many of their AI applications fall into the high-risk category - from diagnostics to clinical decision support to automated quality control.

Which AI Systems in Life Sciences Qualify as High-Risk

The AI Act defines high-risk AI systems in Annex III. Relevant for life sciences are: AI systems classified as medical devices or in-vitro diagnostics (MDR/IVDR). AI-powered clinical decision support systems. Automated systems for evaluating regulatory submissions. And - often overlooked - AI systems in recruitment and HR that also affect pharma companies.

Concrete Obligations for Providers of High-Risk AI

Risk management system: a documented system for identifying, assessing, and mitigating risks throughout the AI system's lifecycle. Data quality: demonstrable quality standards for training, validation, and test data. Technical documentation: detailed description of the AI system, its intended purpose, performance metrics, and known limitations. Logging: automatic recording of events during operation. Transparency: clear instructions for the operator with information about capabilities and limitations. Human oversight: measures enabling effective human control.

Timeline Overview

February 2025: Ban on AI systems with unacceptable risk (social scoring, real-time biometrics in public spaces, etc.). August 2025: Obligations for general-purpose AI (affects LLM providers). August 2026: Obligations for high-risk AI systems - this affects most life sciences applications. August 2027: Full applicability of all provisions.

What You Should Do Now: The 5-Point Checklist

First: Inventory your AI systems. Create a complete list of all AI applications in your company - including those you don't consider "real AI." Machine learning-based forecasting models, NLP systems, automated decision systems - everything goes on the list.

Second: Risk classification. Assign each system to a risk category: minimal, limited, high, or unacceptable risk. For life sciences, the majority will fall into "high."

Third: Gap analysis. Compare your current documentation and processes with AI Act requirements. Where do you already have a good foundation (e.g., through GxP validation), where are there gaps?

Fourth: Clarify responsibilities. The AI Act requires clear assignment of responsibilities. Who in your company is responsible for AI compliance? In many pharma companies, this will be an interface between Regulatory Affairs, IT, and Quality Management.

Fifth: Create a roadmap. Prioritize measures by risk and deadline pressure. Start with high-risk systems already in use.

The Connection with GxP

The good news for GxP-regulated companies: many AI Act requirements overlap with existing GxP obligations. Your computer system validation program (CSV) already covers parts of the required technical documentation. Your risk management per ICH Q9 can be extended to AI risks. And your change control processes are a solid foundation for the required lifecycle management.

The bad news: GxP alone is not enough. The AI Act places additional requirements on transparency, explainability, and human oversight that are not provided for in the classical GxP world.

Why Waiting Is Not an Option

The fines are substantial: up to EUR 35 million or 7% of global annual revenue - whichever is higher. But the real reason to act now is different: companies that make their AI systems compliant early build trust with customers, patients, and regulators. That's a competitive advantage that cannot be caught up on later.