The EU AI Act for health AI.

Health AI is the one sector where the EU AI Act lands on top of an existing, mature regulatory regime rather than on empty ground. If your product is a medical device, you are already inside MDR or IVDR — and the AI Act attaches through Annex I, not the Annex III list everyone else is reading. That single distinction changes your deadline, your assessment route, and who signs off.

Annex I systems were deferred to August 2028 by the June 2026 Omnibus — a year later than the Annex III date of December 2027. Health teams reading generic AI Act guidance are usually reading the wrong deadline for themselves.

Which route applies to you

The line that catches health teams

Documentation versus decision. An ambient scribe that transcribes a consultation and drafts a note is documenting a completed human activity — a strong Article 6(3) position. The same product, extended to suggest a diagnosis or flag a patient for escalation, is evaluating the person. That is profiling, and profiling closes the 6(3) exit absolutely.

"Wellness, not medical." Positioning a product as wellbeing rather than clinical is a device-classification argument, and it does not travel to the AI Act unchanged. A symptom checker with a wellness disclaimer can still be evaluating a natural person's access to healthcare.

Hospitals are deployers, not providers. A hospital buying an AI triage tool takes on Article 26 deployer duties: human oversight, monitoring, input-data relevance, logging. It does not inherit the provider's Chapter III duties — those stay with the vendor. Getting this backwards in either direction is the most common error in health procurement. Provider vs deployer.

What the double regime actually costs

Less than teams fear, in the specific case where you are already MDR-compliant. Article 8(2) is designed so AI Act requirements are met through the existing sectoral conformity assessment rather than a parallel one — your quality management system, technical documentation, risk management and post-market surveillance largely absorb the AI Act's equivalents. The genuinely new work is usually data governance under Article 10, logging under Article 12 and human oversight design under Article 14.

What you still owe today, regardless of the 2028 date: Article 50 disclosure on anything patient-facing that converses, Article 4 AI literacy for clinical and operational staff touching the systems, and Article 5 — which prohibits emotion inference in the workplace, a live issue for staff-monitoring tools sold into hospital operations.

GDPR does most of the heavy lifting here already. Health data is Article 9 special category data, so if you have a lawful basis, a DPIA and data governance that survive scrutiny, a large share of AI Act Article 10 is evidenced by work you have done. Reglynn reports flag these overlaps explicitly so you are not billed twice for the same control.