- The AI Act's high-risk obligations apply from December 2, 2027 and August 2, 2028 (Regulation (EU) 2026/1744, 2026).
- An AI tool that helps build an eCRF or review data is not a high-risk system by default.
- An AI-based medical device that requires a notified body becomes a high-risk system on August 2, 2028.
- The sponsor must show that every AI model used in a trial is fit for its intended use (EMA, 2024).
“Since August 2026, the AI Act has required a conformity assessment for the AI tools in your trials.” If a vendor or a consultant told you this, the date is wrong. Regulation (EU) 2026/1744 of July 8, 2026, published in the Official Journal on July 24 and in force since July 27, 2026, pushed the obligations for high-risk AI systems back to December 2, 2027 and August 2, 2028. For a sponsor, a CRO or an academic research team that already uses AI to build its eCRFs or review its data, the question changes: what applies today, and what should you prepare by the end of 2027? Three texts hold the answers: the AI Act, its amending regulation and the EMA reflection paper.
What did Regulation 2026/1744 change in the AI Act timeline?
Regulation (EU) 2026/1744, known as the Digital Omnibus on AI, delays the application of the AI Act's high-risk rules. Systems listed in Annex III fall under these rules on December 2, 2027, instead of August 2, 2026. Systems linked to a regulated product in Annex I, including medical devices, fall under them on August 2, 2028, instead of August 2, 2027.
EU lawmakers postponed these rules because the harmonized standards and the national competent authorities were not ready in time. The rest of the AI Act timeline, set by Regulation (EU) 2024/1689, stays almost unchanged. The table below lists the dates that matter to organizations running clinical research.
| Date | What applies | Who is affected |
|---|---|---|
| February 2, 2025 | Prohibited practices (Article 5) and AI literacy (Article 4) | All providers and deployers |
| August 2, 2025 | Obligations for general-purpose AI models | Model providers |
| August 2, 2026 | General application, including transparency obligations (Article 50) | Providers and deployers of certain systems, such as chatbots |
| December 2, 2026 | Two new prohibitions, unrelated to clinical research, and marking of content generated by systems already on the market | Providers of generative AI systems |
| December 2, 2027 | High-risk rules for Annex III systems | Providers and deployers of these systems |
| August 2, 2028 | High-risk rules for systems linked to Annex I, including medical devices and IVDs | Manufacturers, notified bodies, deployers |
Medical device manufacturers gain one year on their original deadline, and now follow Annex III systems by eight months.
Is an AI tool used in a clinical trial a high-risk system?
No, not by default. Article 6 of the AI Act classifies a system as high-risk in two cases: it is a product, or the safety component of a product, covered by Annex I and subject to assessment by a notified body, or it falls within one of the eight areas of Annex III. Running a clinical trial appears on neither list.
In Annex III, health appears under point 5: access to public healthcare services, pricing of health insurance and emergency patient triage. An assistant that generates an eCRF from the protocol, suggests data management queries or summarizes an audit trail fits none of these cases. Its obligations are then limited to those of any AI system: AI literacy, prohibited practices and transparency.
Two situations call for closer attention.
- AI-based medical devices. Software that helps detect an arrhythmia and falls under the Medical Device Regulation is a high-risk system under the AI Act when its class requires a notified body. Its manufacturer prepares the required documentation for August 2, 2028. Data from the clinical investigation will feed this file: medical device teams should record, from the start of the investigation, the version of the model tested and the datasets used.
- Models developed for research. Article 2(6) excludes from the AI Act systems “specifically developed and put into service for the sole purpose of scientific research and development.” An academic research team that trains its own model for a project can rely on this exclusion. A commercial tool bought from a vendor does not qualify: it was not developed for research alone.
What already applies to a sponsor that uses AI?
Three obligations apply today: AI literacy, the prohibitions in Article 5 and the transparency rules in Article 50. For a sponsor, the heaviest constraint comes from elsewhere: Good Clinical Practice and the EMA reflection paper, adopted by the CHMP on September 9, 2024, apply to any AI model used in a trial.
AI literacy. Since Regulation 2026/1744, Article 4 requires providers and deployers to “take measures to support the development of AI literacy” of their staff. The text states that this obligation does not require them to guarantee a given level for each individual. Training for the data managers and CRAs who use the EDC's AI assistant, recorded in their training records, meets this requirement.
Transparency. Since August 2, 2026, Article 50 requires that anyone who interacts with an AI system be informed of it, unless the context makes it obvious. A chatbot that helps participants complete their ePRO questionnaires falls into this case: the screen has to tell participants they are talking to an AI system.
Good Clinical Practice. The EMA reflection paper sets a principle: the sponsor must ensure that every algorithm, model and dataset it uses is fit for its intended use. When the use has a high regulatory impact or a high risk for patients, the EMA warns that inspectors may request the model architecture, development logs and training data during a GCP inspection. For a confirmatory analysis, the EMA asks that models be frozen and documented in the statistical analysis plan before database lock.
One question separates the uses: does the model produce a record that will go into a regulatory submission? A protocol summary for the project team does not. An endpoint calculated by AI does, and it requires the same validation as a computerized system.
How can you prepare for 2027 and 2028 now?
Preparation starts with an inventory of the AI tools in each ongoing study, followed by a classification of each use by its regulatory impact. This work already helps with GCP inspections, and it gives you the basis for your AI Act documentation if a use turns out to be high-risk in 2027 or 2028.
The table follows the order in which a quality team can carry out this work.
| Step | What you do | What you get |
|---|---|---|
| 1. Inventory | For each study, list the AI tools, their vendor, their use and the data they touch | A complete view, often missing from the trial master file (TMF) |
| 2. Classification | For each use, note whether the output goes into a regulatory submission | The list of uses with high regulatory impact |
| 3. Vendor qualification | Ask which model version is running, what the audit trail records and who validates each output | Evidence you can reuse in audits and inspections |
| 4. Protocol and analysis plan | Describe the high-impact uses and freeze the models before database lock | Results that regulators can accept as confirmatory evidence |
| 5. Training | Train each user on the tool they work with and document it | Your answer to Article 4 of the AI Act |
| 6. Medical devices | Check with your notified body whether your AI software falls under Annex I | A dated plan for August 2, 2028 |
Two cases from the field show the difference in workload. A CRO that uses an assistant to suggest data management queries, each reviewed by a data manager before it goes out, covers its obligations with steps 1, 3 and 5. A sponsor that calculates a secondary endpoint with a machine learning model goes through all six, and the EMA reflection paper recommends discussing it early with regulators. Nearly all AI use cases in clinical trials fit one of these two profiles.
[[cta]]
How Datacapt puts guardrails around AI in the EDC
Datacapt AI builds the study, reviews data as it comes in and monitors sites, under four safeguards that answer the questions in step 3. The agent runs with the permissions of the user who launches it. It writes in draft mode, never to a study in production. Every action goes into the audit trail with its origin, and every suggestion waits for approval by a clinical research professional.
Datacapt also exposes its EDC through an MCP server: you can connect the model your organization has already qualified and keep control over the level of access you give the agent. These safeguards do not replace your risk assessment. They provide the records it needs.
See an agent build an eCRF in Datacapt
Conclusion
The AI Act imposes no high-risk obligations on clinical trials before December 2, 2027, and none before August 2, 2028 for medical devices. The EMA reflection paper already applies, though: a GCP inspector can ask today for the documentation of a model used in your trial. An inventory of AI tools for each study, kept up to date in the TMF, meets both texts at once. Another timeline runs until 2031 for your data: the one set by the EHDS for clinical trials.
Frequently asked questions
[[faq]]
Sources
- European Parliament and Council, Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), 2026
- European Parliament and Council, Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), 2024
- European Medicines Agency, Reflection paper on the use of Artificial Intelligence (AI) in the medicinal product lifecycle, 2024
Does the AI Act apply to clinical trials as of August 2026?
Not its high-risk obligations. August 2, 2026 marks the general application of the AI Act, including the transparency rules in Article 50. Regulation (EU) 2026/1744 pushed the high-risk rules back to December 2, 2027 for Annex III and to August 2, 2028 for Annex I, which covers medical devices.
Is an EDC with AI features a high-risk AI system?
No, not by default. An EDC is neither a medical device that requires a notified body nor a system in one of the Annex III areas. Its AI features fall under the general obligations: AI literacy, prohibited practices and transparency. The sponsor still has to validate how it uses them under Good Clinical Practice.
When does the AI Act apply to AI-based medical devices?
On August 2, 2028. Regulation (EU) 2026/1744 sets this date for systems linked to the products in Annex I of the AI Act, which include medical devices and in vitro diagnostic medical devices. The system is high-risk when the device has to go through a notified body.
Is academic research exempt from the AI Act?
In part. Article 2(6) excludes systems developed and put into service for the sole purpose of scientific research. A model that an academic team trains for its own project qualifies. A commercial tool used in an academic trial remains subject to the AI Act.
What does the EMA expect from a sponsor that uses AI in a trial?
The reflection paper adopted by the CHMP on September 9, 2024 makes the sponsor responsible for ensuring that each model is fit for its intended use. For a use with high regulatory impact, the sponsor may have to provide the model architecture, logs and training data during a GCP inspection.
With over 10 years of experience working in CROs, Khalil brings deep expertise in clinical trials and a clear understanding of the daily challenges faced by research professionals. His insights are grounded in real-world operations, making his perspective both practical and strategic.
Blog & News Datacapt
News, Articles, Resources et Tutorials.
