The EU delayed its AI Act high-risk rules to 2027 and 2028. What changed, what didn't, and why healthcare AI teams in Asia should still prepare now.
In late July, the European Union changed the timetable for its landmark AI law. The Digital Omnibus on AI, formally Regulation (EU) 2026/1744, entered into force on 27 July 2026, just days before the AI Act's first high-risk rules were due to apply. Most of the headlines that followed were about delay. For healthcare AI teams, the more useful story is about what the extra time is for.
This matters well beyond Europe. Many healthcare AI teams in Asia sell into European markets, work with European pharmaceutical and medical technology partners, or build models whose outputs end up in front of clinicians in Europe. The AI Act applies to providers that place AI systems on the EU market wherever they are based, and it also reaches providers and deployers outside the EU when the output of their AI system is used in the EU. Even for teams with no European exposure today, the Act has become a reference point that regulators, investors and enterprise buyers look to when they ask how AI in high-stakes settings such as healthcare should be governed.
This guide explains what changed, what did not, where healthcare AI sits within the Act, and why we believe data governance is the part of the work that deserves attention now.
The AI Act entered into force on 1 August 2024 and takes a risk-based approach. A small number of uses are prohibited outright. A defined set of uses is classed as high-risk and must meet detailed requirements before and after reaching the market. Some systems, such as chatbots, carry transparency duties. Everything else faces few specific obligations.
Most obligations fall on "providers", the organisations that develop an AI system and place it on the market. Some fall on "deployers", such as the hospitals, clinics, laboratories and insurers that use it. For many healthcare AI companies in Asia, the provider obligations are the ones that matter most.
The AI Omnibus moved the dates on which the high-risk rules begin to apply. Standalone high-risk systems, which are listed by use case in Annex III of the Act, now have until 2 December 2027 instead of 2 August 2026. AI embedded in products already covered by EU product safety law, listed in Annex I and including medical devices and in vitro diagnostics, now has until 2 August 2028 instead of 2 August 2027.
The reason given was readiness. Neither industry nor the European standards bodies were expected to be ready in time, and the conformity assessment infrastructure the Act relies on was not yet fully in place. The Omnibus also gave smaller companies lighter documentation and quality management requirements, and softened, without removing, the duty to ensure staff have adequate AI literacy.
What it did not do is change the architecture. The Act still has the same risk classes and the same high-risk requirements.
Several obligations kept their original schedule. The prohibited practices have applied since February 2025, the obligations on general-purpose AI model providers since August 2025, and the Article 50 transparency duties since 2 August 2026.
That last point is easy to overlook. If your organisation offers a patient-facing chatbot, a symptom checker or a tool that generates content for patients, the transparency duties already apply, including making clear to people that they are interacting with an AI. Some requirements on marking AI-generated content follow in December 2026.
Healthcare AI can become high-risk through two routes, and it helps to know which one applies before planning anything else.
The first route is through medical device regulation. AI that is, or forms a safety component of, a medical device or in vitro diagnostic regulated under the EU's device rules is high-risk under Annex I. The political agreement on the Omnibus confirmed that AI-enabled medical devices and IVDs remain subject to the AI Act's high-risk requirements, in parallel with the device rules. For these products, the requirements now apply from 2 August 2028. In practice, legal advisers recommend building the AI Act's requirements into the existing quality management system and device technical documentation, rather than creating a separate compliance programme.
The second route is through specific use cases listed in Annex III. Three matter most for healthcare. The first covers AI used by or on behalf of public authorities to decide eligibility for essential public services, which explicitly includes healthcare services. The second covers AI used for risk assessment and pricing in life and health insurance. The third covers AI that evaluates and classifies emergency calls or dispatches emergency services, as well as emergency healthcare patient triage systems. These fall under the 2 December 2027 date.
The European Commission's draft guidelines on classification, published in June 2026, add useful detail. Where a triage tool also qualifies as a medical device, both routes apply at the same time rather than one or the other. Tools used to manage medical appointments, identify patients or transcribe emergency calls are excluded from the triage use case. The draft also treats AI that uses physiological signals such as gait, ECG or EEG to infer a person's health status as high-risk under the biometric categorisation use case. These guidelines are still in draft, so teams should follow them as they are finalised.
Many healthcare AI tools, such as those that summarise documentation or support administrative work, will fall outside both routes. They are not free of expectations, however. Transparency duties may still apply, and buyers are increasingly likely to ask the same questions about data and oversight whatever the legal classification.
The deadlines moved because the detailed standards and guidance were not ready, not because the expectations were lowered. When those standards arrive, what "good" looks like will become more concrete, and teams will need evidence rather than intentions.
Evidence takes time to build, and some of it is very hard to create after the fact. A model trained this year on data whose origin, preparation and gaps were never documented may be the same model that needs to meet the requirements in 2028. Reconstructing that history later is far more difficult than recording it now. Product and certification cycles also matter: for medical device manufacturers, the practical deadline is often set by the next conformity assessment or certificate renewal, not only by the date in the regulation.
Of all the high-risk requirements, data governance under Article 10 is the one most closely tied to the raw material of healthcare AI. It asks that training, validation and testing data be governed through documented practices covering where the data came from and its original purpose, how it was prepared (including annotation, labelling, cleaning, updating, enrichment and aggregation), what assumptions were made, how possible biases were examined and addressed, and what gaps remain.
It also sets a quality standard. The data should be relevant, sufficiently representative, and, to the best extent possible, free of errors and complete for the intended purpose. It should also reflect the geographical, contextual, behavioural or functional setting in which the system will be used.
For clinical data, each of these phrases carries real work. Laboratory results for the same test are often named in several ways across providers, with different units and reference ranges. Medications appear under brand names, generic names and local inventory codes. Diagnoses are frequently captured as free text, and discharge summaries, imaging reports and clinical notes hold vital context in narrative form. Records may arrive as structured messages, PDFs or scanned pages, and in more than one language. Many institutions also maintain their own internal code sets. Before data like this can reasonably be described as relevant, complete and as free of errors as possible, it needs to be made consistent, reviewed and mapped to medical coding standards, and the Act expects each of those preparation steps to be traceable.
The geographical point deserves particular attention for teams in Asia. A model trained mainly on data from one country, one hospital group or one laboratory network may not reflect the patients, laboratory methods or practice patterns of the place it is later sold into. That applies in both directions: to Asian teams entering European markets, and to European and global models being deployed across Asia. Documenting where your data comes from, and where it falls short, is both a regulatory requirement and simply good clinical practice.
Privacy runs alongside all of this. Under EU data protection law, pseudonymised data is still personal data, so the choice of technique affects what you can do with a dataset and under what conditions. We explain the distinctions in De-identification, Pseudonymisation and Anonymisation: What the Difference Means for Your Health Data.
AI can do much of this preparation at speed, and at Jonda Health we use it extensively. Our experience is that speed on its own is not enough. Teams that build this layer in-house often find that costs climb as models are run repeatedly over the same documents, that general-purpose AI tools raise questions about where patient data is processed, and that without clinical review and quality checks, errors pass quietly into the data a model learns from. This is why we argue that healthcare AI will not work without trusted data infrastructure. The same theme runs through Singapore's new health data law, where data quality requirements sit alongside connection and security obligations, as we explored in Singapore's Health Information Act: What Healthcare Providers Need Ready by 2027.
A separate proposal to revise the EU's medical device rules could change how the AI Act applies to devices. It would move the device regulations into a part of Annex I where most of the AI Act's high-risk requirements do not apply directly, leaving the device rules as the primary framework, while the Commission would keep the power to reinstate specific AI Act requirements. That proposal is still being negotiated, so it should be followed closely rather than planned around. Whatever the outcome, the underlying questions about data quality, representativeness and clinical evidence remain, because the device rules already demand them.
