The figure often circulates: the AI Act would expose healthcare companies to fines of "6 % of global turnover." It is false. The European regulation on artificial intelligence provides for three distinct caps, and, for healthcare, the main issue is not the amount of the penalties but the timeline: the omnibus regulation adopted in July 2026 postponed to August 2028 the obligations applicable to AI-equipped medical devices. A look back at what the text actually provides for manufacturers, hospitals, and patients.
A frequently misunderstood timeline
Regulation (EU) 2024/1689, known as the AI Act, came into force on 1 August 2024. Its application is gradual: prohibitions since February 2025, obligations for general-purpose AI models since August 2025, general application on 2 August 2026. On that day, the transparency obligations of Article 50 (informing a person that they are interacting with AI, marking synthetic content) as well as the entire market surveillance apparatus became applicable.
The heaviest rules, those for "high-risk" systems, have however been postponed. Regulation (EU) 2026/1744, known as the digital omnibus on AI, adopted on 8 July, published in the Official Journal on 24 July and entered into force on 27 July 2026, sets two new dates:
- 2 December 2027 for high-risk uses listed in Annex III (employment, education, access to essential services, etc.);
- 2 August 2028 for AI systems integrated into already regulated products, including medical devices and in vitro diagnostic devices.
Fines of 7 %, 3 % and 1 %, not 6 %
Article 99 of the AI Act provides for three levels of administrative penalties, each time retaining the highest amount between a fixed sum and a percentage of annual global turnover:
- up to 35 million euros or 7 % for the use of a prohibited practice;
- up to 15 million euros or 3 % for violation of obligations of providers, deployers, importers, distributors, or notified bodies, including transparency rules;
- up to 7,5 million euros or 1 % for providing inaccurate or misleading information to the authorities.
For SMEs and start-ups, the lower of the two amounts applies, and the omnibus extended this treatment to small mid-cap companies for the last two levels. It is the Member States that set the penalty regime and decide to what extent fines may target public authorities, including public hospitals.
Medical devices: double compliance remains
Most AI-based medical software falls within the scope of the AI Act under Article 6, paragraph 1: when a device falls under the Medical Device Regulation (MDR) or the In Vitro Diagnostic Regulation (IVDR) and must go through a notified body, i.e., in practice from class IIa onwards, the AI system is considered high-risk. It will therefore have to comply with both the MDR or IVDR and the requirements of the AI Act: risk management, data quality, logging, transparency, human oversight.
The sector had hoped for better. The omnibus removed industrial machinery from the direct scope of the AI Act by placing it in Section B of Annex I, but not medical devices, which remain in Section A. A proposal to revise the MDR and IVDR presented by the Commission on 16 December 2025 provides for this shift, but it is still under negotiation. Several intermediate deadlines matter: the Commission must publish by 1 August 2027 guidelines to limit duplication, and notified bodies under the MDR or IVDR that wish to assess compliance with the AI Act must submit their designation application before 28 January 2028.
MedTech Europe, which represents the industry, welcomed the postponement to 2028, one of its main demands. However, it regrets that the agreement 'does not fully resolve' the articulation between the AI Act and the MDR/IVDR, and now relies on the revision of these two regulations. The Medical Device Coordination Group and the European AI Committee had published as early as June 2025 a joint FAQ (MDCG 2025-6) to help manufacturers integrate the AI Act requirements into their existing processes.
Hospitals and insurers: what directly concerns them
Healthcare facilities are primarily "deployers." When the high-risk rules apply, they will have to use systems in accordance with their instructions, ensure competent human oversight, and maintain logs. As of today, the transparency obligations of Article 50 may concern them, for example for a reception chatbot.
Annex III also covers health-related uses outside of medical devices: assessment by public authorities of eligibility for essential benefits, including healthcare; risk assessment and pricing in life and health insurance; emergency call triage and patient triage systems in emergency departments. These uses will fall under the high-risk regime as of 2 December 2027.
What the health case reveals
Health illustrates the central tension of European AI regulation. On one hand, risks to patients justify strong requirements on data, traceability, and human control. On the other hand, stacking two compliance regimes weighs particularly on small European companies, already facing saturation of notified bodies since the MDR came into effect.
The postponement to 2028 buys time, but it removes no requirements and does not resolve the fundamental question: should AI rules be integrated into the sectoral law for medical devices, as the machinery industry achieved, or maintain a single horizontal framework? The answer will come from the revision of the MDR and IVDR. For patients, the essential thing is that this debate does not boil down to a race to lighten requirements, and that human oversight and data quality remain at the heart of the system.
Sources: AI Act, Article 99 (sanctions); AI Act, Annex III; Regulation (EU) 2026/1744, Official Journal; QLE, analysis of the omnibus for medical devices; Council of the EU, 7 May 2026; MedTech Europe, 4 June 2026; European Commission, MDCG documents (including MDCG 2025-6).
