Today marks an important milestone for the European Union (EU). After a three year development period, the EU AI Act (Artificial Intelligence Act) enters into force. The European Union is the first jurisdiction to put in place a strong regulatory framework to govern the artificial intelligence (AI) systems.
With the AI regulation entering into force, the timelines for implementation have started to count down.
Prohibited AI Systems (February 2025)
Per the second of February 2025, all AI systems that are prohibited under the Artificial Intelligence Act must be taken from the market, or be adjusted to comply with the AI Act. Article 5 of the EU AI Act further clarifies which systems will be considered prohibited.
Codes of Practice (May 2025)
Per the second of May 2025, Codes of Practice should be available. Codes of practice will play a crucial role for demonstrating compliance with the transparency requirements set out in the AI Act and for providers of General Purpose AI Models (GPAI models) to demonstrate compliance with the requirements as applicable to those models.
This will specifically be of interest to providers of General Purpose AI models which will be considered to exercise systemic risk as defined in Article 51 of the AI Act.
Governance of GPAI (August 2025)
Per the 2nd of August 2025, requirements specific to General Purpose AI Models are becoming applicable. This includes the requirements stipulated in Chapter V of the AI Act,
In addition, requirements for notifying authorities, governance bodies, and the penalty clauses (more on the penalties at the end) become applicable with regards to the management of General Purpose AI Models.
This effectively means that compliance timelines for providers of General Purpose AI Models are extremely short, especially considering the potential availability of codes of practice by May 2025.
High-Risk AI per Annex III (August 2026)
Per the 2nd of August 2026, the requirements set out in Chapter III of the Artificial Intelligence Act will apply to all High-Risk AI systems (per Annex III) which are currently not governed by existing legislative frameworks covered under Annex I.
If there are no harmonized standards available to support the EU AI Act by this date, devices listed in Annex III section 1 need to have undergone notified body conformity assessment prior to this date, or otherwise be taken from the market (unless to be communicated otherwise).
High-Risk AI per Annex II (August 2027)
Per the 2nd of August 2027, all AI systems must comply with the requirements set out in the AI Act of the European Union, and specifically all High-Risk AI systems set out in Annex II, including Medical Devices and In-Vitro Medical Devices, must comply with the requirements set out in Chapter III.
If there are no harmonized standards available to support the EU AI Act by this date, devices listed in Annex II who do not undergo conformity assessment through a Notified Body must have undergone notified body conformity assessment prior to this date, or otherwise be taken from the market (unless to be communicated otherwise).
Penalties
Organizations involved in the manufacture, making available as economic operators (e.g. authorized representatives, distributors, providers and deployers) should pay close attention to all specified requirements and timelines applicable to the AI Act.
Non-compliance with certain AI practices can potentially result in fines up to 35 million EUR or 7% of a company’s annual turnover. Other violations can result in fines up to 15 million EUR or 3% of a company’s annual turnover.
If you would like to learn more about the implications of the AI Act on the field of medical devices and in-vitro medical devices, please refer here.
