Regulatory dates correct as of 26 October 2026.
Most of what has been written about the EU AI Act this year has been about deadlines, and in particular the sixteen-month delay the EU agreed in June. For most pharma marketing and insight teams the Act matters less than that coverage suggests, because very little of the AI they use falls under its strictest rules. In six years of pharma conference transcripts we’ve analysed at Buzz Radar, compliance is one of the most-discussed themes and whether AI actually works is the least, as if being allowed to use AI settled whether it was any good.
What is the EU AI Act?
The AI Act is the EU’s law on artificial intelligence, passed in 2024 and coming into effect in stages. It sorts AI by how much harm it could do. A handful of uses are banned outright and most carry light duties or none, while the heaviest obligations fall on “high-risk” systems, the ones that could damage people’s health, safety or rights if they get things wrong. Before a high-risk system can be used, its provider has to document how it was built, test it, manage its risks and put a named person in charge of overseeing it.
UK companies shouldn’t assume they’re outside it. Article 2 applies the Act to providers and deployers outside the EU whenever their AI’s output is used inside it.
Which pharma AI counts as high-risk?
A system gets there by one of two routes. Either it is, or is part of, a product covered by EU safety legislation, which includes AI that qualifies as a medical device under the MDR or IVDR, or its use case is listed in Annex III. The health entries in Annex III are narrow: emergency triage and dispatch, risk pricing for life and health insurance and decisions about access to public healthcare benefits. The Commission’s draft classification guidelines, published in May 2026, work through the medtech and triage examples in detail.
Drafting tools, social listening and audience analysis aren’t on either list, and between them they cover most of the AI in commercial pharma. The EU’s 2026 amendments also narrowed the definition of a “safety component”, which takes some systems off the product route altogether.
When do the rules apply?
The bans have applied since February 2025. Most of the rest of the Act has applied since 2 August 2026, including the transparency duties in Article 50 and the Commission’s power to fine general-purpose AI providers up to €15 million or 3% of global turnover under Article 101.
The high-risk rules for stand-alone systems were due on that date too, until the EU’s Digital Omnibus pushed them back to 2 December 2027. It became law on 27 July 2026 as Regulation (EU) 2026/1744, after the Council signed it off on 29 June. High-risk AI built into regulated products such as medical devices, which was already on a later timetable, now follows on 2 August 2028. What those systems will have to do hasn’t changed, only when.
The date closest to pharma’s content teams is 2 December 2026. Generative AI systems that were on the market before 2 August 2026 have until then to mark their output in a machine-readable way under Article 50(2). That duty sits with providers, which mostly means the vendors, but a company that has built its own content tool could count as a provider too.
Does the timetable reward shipping early?
For AI that is high-risk, it can. Under Article 111(2), a system already on the market before the rules apply only has to meet them if its design later changes significantly, and the Omnibus confirmed that one unit of a given type and model being on the market first is enough. The Centre for Democracy and Technology argues that this rewards getting systems out early, though how much of pharma it reaches depends on how each system is classified.
What the Act won’t check
Our transcripts cover 475 pharma conference sessions since 2020, 1.73 million words of the industry talking to itself. Compliance is the fifth most-discussed theme across them and has gone up every year since 2023, by 108% in total. Proof, by which we mean whether something actually delivered, comes twenty-first out of the 21 themes with a real signal this year. Across the whole dataset there are roughly 100 mentions of AI for every one asking whether it worked.
A conformity assessment checks that a high-risk system was built and tested to a set standard and that someone is accountable for it. It doesn’t check whether the answer it gives about a particular therapy area is right, and the drafting, listening and audience tools that make up most of pharma’s AI never face an assessment at all.
Talk of trust, brand damage and AI slop has gone up 227% in our data since 2024 and now ranks third, above compliance. The Act sets rules for systems, and nothing in it covers whether an HCP believes what you publish. When that goes wrong there’s no fine to wait for, just a headline that afternoon or a clinician who stops reading what your medical team sends out.
Who checks the work?
For most of what pharma runs, someone in-house, and not Compliance on its own, because passing review and being right are different tests. Has anyone with clinical knowledge checked what the AI is claiming? Is it reporting what the audience actually said, or what a model guessed they’d say? Could the team show its working if Medical asked? That last one carries more weight now that Medical Affairs is the second most-discussed topic in our corpus, because Medical has always wanted more evidence than Marketing.
It’s the question we built BRIANN, our audience intelligence, to answer. Every insight links back to the conversation it came from, and an Audience Intelligence Engineer, one of our pharma specialists, checks the output before it goes anywhere near a decision. If the signal isn’t there, BRIANN says so rather than making one up.
Where that leaves pharma
The AI Act will eventually ask a small part of pharma’s AI to show how it was built and who is responsible for it. The rest is down to the companies using it: a baseline, a named person checking the output and an honest record of how often the models get things wrong. Nobody outside the building is going to ask for that record, which is the best reason to start keeping one. The companies that do will be glad of it the first time a clinician writes in to say the AI got something wrong.
Marc Burrows Published on October 26, 2026 4:15 pm
Frequently Asked QuestionsFAQs
Is pharma's AI high-risk under the EU AI Act?
Only some of it. AI that is itself a medical device is high-risk, and so are systems used for emergency triage, life and health insurance pricing or decisions about access to public healthcare benefits. Content drafting, social listening and audience analysis are not. Classification depends on each system's intended purpose.
When do the EU AI Act's high-risk rules apply?
From 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for AI built into regulated products such as medical devices, following the Digital Omnibus that became law in July 2026. The bans, transparency duties and general-purpose AI rules already apply.
What is the difference between AI compliance and AI proof?
Compliance shows that a system is allowed and properly documented. Proof shows that its outputs are accurate and that someone with the right expertise has checked them. A compliant system can still get things wrong.