The EU AI Act for health AI: what applies now and later
Article 50 chatbot transparency since 2 August 2026, high-risk duties moved to December 2027 and August 2028, and how medical devices fit in.
- EU
Key takeaways
- Article 50 chatbot transparency has applied since 2 August 2026: users must be told they are interacting with AI.
- Breaching transparency duties can cost up to €15 million or 3% of total worldwide turnover.
- High-risk obligations now apply from 2 December 2027 for standalone systems and 2 August 2028 for AI in regulated products such as medical devices.
- Prohibited practices (since 2 February 2025) and general-purpose model rules (since 2 August 2025) were not delayed.
- GDPR Article 9 still governs health data, whatever the AI Act risk class.
What parts of the AI Act apply to health AI today?
Three sets of rules already apply. Prohibited practices have been banned since 2 February 2025. Duties for general-purpose AI model providers have applied since 2 August 2025. And Article 50 transparency, including telling users they are talking to an AI, has applied since 2 August 2026.
What did the Digital Omnibus change?
The Digital Omnibus on AI entered into force on 27 July 2026. It moved high-risk obligations from 2 August 2026 to two later dates and left transparency in place, apart from a short grace period to 2 December 2026 for marking AI-generated content in systems already on the market.
| Obligation | Applies from |
|---|---|
| Prohibited AI practices | 2 Feb 2025 |
| General-purpose AI model duties | 2 Aug 2025 |
| Article 50 chatbot disclosure | 2 Aug 2026 |
| Marking AI-generated content (existing systems) | 2 Dec 2026 |
| High-risk, standalone (Annex III) | 2 Dec 2027 |
| High-risk, in regulated products (Annex I, including medical devices) | 2 Aug 2028 |
When is health AI “high-risk”?
Mainly when the AI is, or is a safety component of, a medical device that needs third-party conformity assessment under the MDR or IVDR. Some Annex III uses, such as triage of emergency calls or decisions about access to essential services, are also high-risk. Most wellness apps fall outside these categories but still carry transparency duties.
What should a health AI team do now?
Make AI disclosure explicit at the start of every conversation and every channel. Document which AI Act category your product falls into and why. If you may be high-risk, start risk management, data governance and logging now, because MDR timelines are long. Keep GDPR Article 9 consent and data protection impact assessments current.
Frequently asked questions
Is a symptom-checker chatbot high-risk under the EU AI Act?
If it qualifies as a medical device under the MDR and needs a notified body, its AI is treated as high-risk, with duties from 2 August 2028. A general wellness chatbot usually is not high-risk, but Article 50 transparency already applies.
What does Article 50 require from a chatbot?
Providers must design the system so people are informed they are interacting with an AI, clearly and from the start, unless it is obvious from context. The Commission published guidelines on transparency in July 2026.
Sources
- Regulation (EU) 2024/1689, the Artificial Intelligence ActEUR-Lex · 2024-07-12
- EU AI Act: AI Omnibus formally adoptedAddleshaw Goddard · 2026-07
- EU AI Act Article 50: new AI transparency rulesPotter Clarkson · 2026
- Time running out as AI transparency guidelines publishedWilliam Fry · 2026
Found something out of date? Write to contact@brandlabs.app and we will fix it.