Authored By: Obakeng Tlapu
University of South Africa
Artificial intelligence is tearing through clinical medicine. Algorithms now read radiological scans, score insurance risks, triage emergency room patients, and automate hospital paperwork. But because these tools directly touch human safety, patient outcomes, and equal access to care, we cannot simply treat them like everyday phone apps[1].Basic product safety rules fail here. To fix this gap, the European Union passed its landmark Artificial Intelligence Act, creating the world’s first sweeping statutory framework for AI[2].Unsurprisingly, legal scholars often point to it as the obvious global blueprint for algorithmic governance[3].
Yet whether Brussels wrote a true “golden rule” remains doubtful. In practice, the law looks more like one rigid experiment inside a fractured global market. Healthcare exposes this reality clearly because clinical AI never enters a legal vacuum. Any new algorithm must fit alongside decades of medical device statutes, hospital liability rules, clinical trial standards, and privacy laws[4].The result is a dense regulatory web where the EU AI Act can set ambitious ideals while proven to be messy and hard to enforce on the ground[5].
Under the AI Act, software is tiered by risk. A massive slice of medical software lands in the “high-risk” bracket[6].An algorithm gets pulled in through, two doors. It either acts as a safety component for a physical medical tool governed by the Medical Device Regulation (MDR) or In Vitro Diagnostic Regulation (IVDR), or it falls under Annex III because of where it gets used[7]. That includes software calculating insurance premiums, evaluating public healthcare eligibility, or prioritizing emergency care[8].
Landing in this high-risk tier triggers heavy administrative work. Before launching, developers must build continuous risk management systems, enforce strict dataset governance, write exhaustive technical files, record audit logs, ensure human oversight, and prove high levels of accuracy, cybersecurity, and technical stability[9].
This setup stems from a strict precautionary principle. European lawmakers prefer to block software bugs and bias upfront rather than relying on lawsuits after a patient gets hurt[10].In medicine,where an incorrect diagnostic output or bad dosage calculation can prove fatal,that logic makes sense.
Yet this layered approach creates severe practical friction. The AI Act doesn’t replace existing medical device law; it sits right on top of it[11].A developer building AI software as a medical device (SaMD) faces two separate compliance hurdles at once, managing different terminologies, duplicate paperwork, and separate testing mandates[12].
Worse, Europe lackes the administrative setup to run its own law. Authorities quickly realized that technical standards and accredited testing bodies were nowhere near ready for the original deadlines, forcing a major legislative delay[13][14].
The original timeline required high-risk rules to bind from 2 August 2026 for Annex III software and 2 August 2027 for Annex I embedded medical devices[15].That plan collapsed. Through the 2026 Digital Omnibus update, lawmakers pushed those enforcement dates back to 2 December 2027 and 2 August 2028, respectively[16][17].This delay reveals a hard truth: writing broad statutory principles is easy, but making them work without freezing medical technology markets is brutally hard[18].
For hospitals, medtech startups, and patients, this delay cuts both ways. Postponing enforcement means strict statutory safety controls arrive years late[19].Officials defended the shift on practical grounds, admitting that standardizing bodies like CEN-CENELEC, national regulators, and testing centers lacked the personnel to process incoming files[20][21].
Industry groups welcomed the extra time to align their testing pipelines[22]. On the flip side, civil rights groups argue that pushing back deadlines leaves health systems using unvetted algorithms right as clinical adoption takes off globally[23][24].
Across the Atlantic, the United States takes a completely different path[25].Washington avoids broad AI statutes, letting sector-specific agencies handle software using existing powers[26].In healthcare, the Food and Drug Administration (FDA) oversees AI tools under traditional device laws, relying on a total product lifecycle model built around post-market tracking[27][28].
A key piece of the FDA’s strategy is its Predetermined Change Control Plan (PCCP) framework[29].Through a PCCP, developers can pre-clear a structured roadmap for future model updates,like retraining an algorithm on new demographic data,allowing adaptive systems to update in live clinical settings without filing a brand-new application for every minor tweak[30]. That makes the US approach far more flexible for iterative software development than the EU’s front-loaded compliance model[31][32].
The United Kingdom has also chosen a decentralized, pro-innovation route instead of a single AI law[33].The Medicines and Healthcare products Regulatory Agency (MHRA) relies on targeted guidance alongside sandbox programs like its “AI Airlock,” where developers test how learning algorithms generate real-world evidence safely post-launch[34].By coordinating closely with the US FDA, Health Canada, and Australia’s TGA, London is building its regulatory future around an agile, lifecycle-focused network rather than Europe’s statutory framework[35].
China presents another governance model entirely[36].Beijing combines medical device oversight from the National Medical Products Administration (NMPA) with targeted state rules on recommendation engines, deepfakes, and generative AI[37].The driver here is completely different from Western regimes. Where Europe centers its law on individual human rights, China’s framework prioritizes state authority, content moderation, societal stability, and data sovereignty[38].These ideological differences confirm that global regulatory convergence is limited by deep political values, not just technical disagreements over software code.
Legal scholars who argue that Europe leads the global agenda point to the “Brussels Effect”,the theory that because the EU market is so massive, global tech companies find it cheaper to adopt strict European standards worldwide than to build separate regional products[39].We saw this happen after the GDPR reshaped global privacy standards, and similar patterns show up today as developers adopt EU-aligned watermarking, data tracking, and synthetic content labeling globally[40]
Yet medicine shows why the Brussels Effect has clear limits. For one, key healthcare provisions in the AI Act are currently paused due to legislative delays, softening its immediate global reach[41][42].
More importantly, clinical alignment is already happening through international technical bodies outside European control. Groups like the International Medical Device Regulators Forum (IMDRF) and the World Health Organization (WHO) are actively setting shared guidelines, reliance systems, and evaluation metrics designed specifically for medical software[43][44]. What is forming globally isn’t a single rulebook exported from Brussels, but a distributed network driven by technical coordination, market pressures, and cross-border agency cooperation[45][46].
For patients, Europe’s precautionary approach offers genuine shields against unsafe or opaque clinical tools[47].Those protections matter deeply when algorithms handle high-stakes decisions like cancer screening, emergency triage, or insurance access, where errors directly cause harm[48][49].
CONCLUSION
For health systems and software developers, however, the compliance burden is heavy. The financial cost of compiling technical files, building logging systems, and paying for third-party audits creates steep entry barriers that hit university spinoffs, small startups, and underfunded public hospitals the hardest[50][51].
The decision to delay enforcement creates a clear trade-off. In the short term, it gives hospitals, developers, and regulators essential breathing room to build compliance systems and test tools without facing immediate market withdrawals or liability threats[52].Over the long term, however, it leaves patients exposed to unverified algorithms during a period of rapid adoption, postponing the transparency rules and legal rights the Act was written to guarantee[53][54].
This friction gets at the central dilemma of medical AI governance. A strict regulatory gatekeeper can successfully shield patients from bad software, but it can just as easily block or delay access to tools that save lives[55][56].
In the end, the EU AI Act is easily the most detailed, ambitious attempt to regulate artificial intelligence on record[57][58].In healthcare, it raises the bar for transparency, safety, and individual rights protection, forcing foreign regulators and international developers to re-examine their own policies[59][60].In that sense, Europe is leading the global conversation.
However, calling the AI Act a universal “golden rule” overstates its real-world dominance. Major jurisdictions like the United States, the United Kingdom, and China are proving that alternative, lifecycle-based, or state-directed models offer far more flexibility for adaptive software[61][62][63].Meanwhile, Europe’s internal struggles to build administrative capacity,and its resulting choice to delay key enforcement dates,show that passing ambitious legislation is very different from making it work in clinical practice[64][65].The EU AI Act shouldn’t be viewed as an uncontested global rulebook, but as an influential first draft in a long, complicated international effort to balance technological innovation with patient safety[66][67][68]
Bibliography
Table of Legislation
European Union Legislation
- Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC [2017] OJ L 117/1
- Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in vitro diagnostic medical devices and repealing Directive 98/79/EC and Commission Decision 2010/227/EU [2017] OJ L 117/176
- Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) [2024] OJ L 2024/1689
Secondary Sources
Books
- Bradford A, The Brussels Effect: How the European Union Rules the World (Oxford University Press 2020)
Institutional Reports, Regulatory Frameworks & Official Guidance
European Union
- European Commission, Guidelines on Transparency Obligations for Providers and Deployers of Certain AI Systems under Article 50 of the AI Act (Commission Notice, 2026)
- European Parliament and Council of the European Union, Regulation amending Regulation (EU) 2024/1689 as regards implementation timelines and high-risk classifications (Digital Omnibus on AI) [2026] OJ L (provisional text adopted June 2026)
United States
- US Food and Drug Administration, Artificial Intelligence and Machine Learning (AI/ML)-Enabled Medical Devices: Total Product Lifecycle Approach (FDA White Paper, 2021)
- US Food and Drug Administration, Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning (AI/ML)-Enabled Device Software Functions (Draft Guidance for Industry and FDA Staff, 2023)
United Kingdom
- Medicines and Healthcare products Regulatory Agency, AI Airlock: The MHRA’s Regulatory Sandbox for AI Medical Devices (MHRA Report, 2024)
- Medicines and Healthcare products Regulatory Agency, Software and Artificial Intelligence as a Medical Device Change Programme: Roadmap (MHRA Guidance, 2023)
China
- Cyberspace Administration of China, Provisions on the Management of Algorithmic Recommendations in Internet Information Services (CAC Order No 9, 2022)
- National Medical Products Administration, Key Technical Guidelines for Clinical Evaluation of Artificial Intelligence Medical Software (NMPA Announcement No 28, 2022)
International Bodies
- International Medical Device Regulators Forum, Good Machine Learning Practice for Medical Device Development: Guiding Principles (IMDRF/AI Working Group/N67FINAL, 2021)
- World Health Organization, Ethics and Governance of Artificial Intelligence for Health: Guidance for Large Multi-Modal Models (WHO Guidance, 2024)
[1] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) OJ L 2024/1689; European Commission, ‘Timeline for the Implementation of the EU AI Act’ (2024) <https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act> accessed 22 July 2026.
[2] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council.
[3] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council.
[4] European Union, Regulation (EU) 2024/1689 arts 6, Annex III; A P Olimid, ‘Legal analysis of eu artificial intelligence act (2024): insights from personal data governance and health policy’ Access to Justice in Eastern Europe; T D Naidoo, ‘Overview of AI regulation in healthcare: A comparative study of the EU and South Africa’ South African Journal of Bioethics and Law e2294.
[5] European Union, Regulation (EU) 2024/1689 arts 6, Annex III; A P Olimid.
[6] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council .
[7] European Union, Regulation (EU) 2024/1689 arts 6, Annex III; A P Olimid.
[8] European Union, Regulation (EU) 2024/1689 arts 6, Annex III; A P Olimid.
[9] A G Fraser et al, ‘Artificial intelligence in medical device software and high-risk medical devices – a review of definitions, expert recommendations and regulatory initiatives’ Expert Review of Medical Devices 20(6) 467; S Valente, ‘A Systematic Analysis of the EU Artificial Intelligence Act: Risk Classification, Governance Obligations, and Post-Deployment Challenges in High-Risk Clinical and Social Care Contexts’ (Jan 2026).
[10] A G Fraser et al, ‘Artificial intelligence in medical device software and high-risk medical devices.
[11] European Union, Regulation (EU) 2024/1689 arts 6, Annex III; A P Olimid, ‘Legal analysis of eu artificial intelligence act (2024): insights from personal data governance and health policy’ Access to Justice in Eastern Europe; T D Naidoo, ‘Overview of AI regulation in healthcare: A comparative study of the EU and South Africa’ South African Journal of Bioethics and Law e2294.
[12] European Union, Regulation (EU) 2024/1689 arts 6, Annex III; A P Olimid.
[13] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council .
[14] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI – Carriages preview | Legislative Train Schedule’ <https://www.europarl.europa.eu/legislative-train/theme-internal-market-and-consumer-protection-imco/file-digital-omnibus-on-ai> accessed 22 July 2026; Digital Watch Observatory, ‘Digital Omnibus on AI: The EU’s AI Act simplification and new powers’ (14 July 2026) <https://dig.watch/updates/digital-omnibus-eu-ai-act-new-ai-office-powers> accessed 22 July 2026.
[15] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) OJ L 2024/1689; European Commission, ‘Timeline for the Implementation of the EU AI Act’ (2024) <https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act> accessed 22 July 2026.
[16] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council.
[17] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI .
[18] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI – Carriages preview.
[19] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI – Carriages preview.
[20] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council.
[21] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI – Carriages preview.
[22] E G Bignami, M Russo, F Semeraro and V Bellini, ‘Balancing Innovation and Control: The European Union AI Act in an Era of Global Uncertainty’ JMIR AI e75527; M Quaranta, I A Amantea and M Grosso, ‘Obligation for AI Systems in Healthcare: Prepare for Trouble and Make it Double?’ The Review of Socionetwork Strategies 17 275.
[23] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI – Carriages preview.
[24] E G Bignami, M Russo, F Semeraro and V Bellini, ‘Balancing Innovation and Control.
[25] Congressional Research Service, FDA Regulation of AI-Enabled Devices (Congress.gov) <https://www.congress.gov/crs-product/IF13245> accessed 22 July 2026.
[26] Congressional Research Service, FDA Regulation of AI-Enabled Devices (Congress.gov).
[27] Congressional Research Service, FDA Regulation of AI-Enabled Devices (Congress.gov).
[28] US Food and Drug Administration, ‘Predetermined Change Control Plans for Medical Devices’ (21 August 2024) <https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-medical-devices> accessed 22 July 2026; US Food and Drug Administration, ‘Final Guidance: PCCPs for AI-Enabled Devices’ (3 December 2024) <https://content.govdelivery.com/accounts/USFDA/bulletins/3c4fe04> accessed 22 July 2026.
[29] US Food and Drug Administration, ‘Predetermined Change Control Plans for Medical Devices’.
[30] US Food and Drug Administration, ‘Predetermined Change Control Plans for Medical Devices’.
[31] Congressional Research Service, FDA Regulation of AI-Enabled Devices (Congress.gov).
[32] US Food and Drug Administration, ‘Predetermined Change Control Plans for Medical Devices”.
[33] Medicines and Healthcare products Regulatory Agency, AI Airlock programme materials; RegDesk, ‘MHRA Guidance on Software and AI as a Medical Device’ <https://www.regdesk.co/blog/mhra-guidance-on-software-and-ai-as-a-medical-device/> accessed 22 July 2026; DLRC, ‘AI Airlock: MHRA’s Approach to AI in Healthcare’ <https://dlrcgroup.com/ai-airlock-mhras-approach-to-ai-in-healthcare/> accessed 22 July 2026.
[34] Medicines and Healthcare products Regulatory Agency, AI Airlock programme materials; RegDesk.
[35] Medicines and Healthcare products Regulatory Agency, AI Airlock programme materials.
[36] D Tang, X Xi, Y Li and M Hu, ‘Regulatory Approaches Towards AI Medical Devices: A Comparative Study of the United States, the European Union and China’ Health Policy; PMC, Artificial intelligence in Chinese healthcare: a review of applications and future prospects <https://pmc.ncbi.nlm.nih.gov/articles/PMC12638562/> accessed 22 July 2026; Health Policy Watch, ‘China’s Massive AI Rollout In Healthcare Spurs Urgent Need For Global Guardrails’ <https://healthpolicy-watch.news/china-long-term-care-ai/> accessed 22 July 2026.
[37] D Tang, X Xi, Y Li and M Hu, ‘Regulatory Approaches Towards AI Medical Devices.
[38] D Tang, X Xi, Y Li and M Hu, ‘Regulatory Approaches Towards AI Medical Devices.
[39] A Bradford, The Brussels Effect: How the European Union Rules the World (OUP 2020); eyreACT, ‘The Brussels Effect: How the EU AI Act Is Becoming the World’s AI Rulebook’ <https://eyreact.com/eu-ai-act-the-brussels-effect/> accessed 22 July 2026.
[40] A Bradford, The Brussels Effect: How the European Union Rules the World (OUP 2020).
[41] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the council.
[42] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI – Carriages preview.
[43] International Medical Device Regulators Forum, official website <https://www.imdrf.org/> accessed 22 July 2026; RAPS, ‘IMDRF drafts framework on best practices for using AI in medical devices’ <https://www.raps.org/resource/imdrf-drafts-framework-on-best-practices-for-using-ai-in-medical-devices.html> accessed 22 July 2026.
[44] World Health Organization, materials on AI governance in health; IFPMA, ‘79th session of the World Health Assembly (WHA79): Harmonization of regulatory approaches’ <https://www.ifpma.org/news/79th-session-of-the-world-health-assembly-wha79-harmonization-of-regulatory-approaches-governance-and-standards-for-data-digital-health-and-artificial-intelligence-in-the-health-sector/> accessed 22 July 2026.
[45] International Medical Device Regulators Forum.
[46] World Health Organization, materials on AI governance in health; IFPMA.
[47] A G Fraser et al, ‘Artificial intelligence in medical device software and high-risk medical devices.
[48] European Union, Regulation (EU) 2024/1689 arts 6, Annex III; A P Olimid.
[49] A G Fraser et al, ‘Artificial intelligence in medical device software and high-risk medical devices.
[50] European Union, Regulation (EU) 2024/1689 arts 6, Annex III; A P Olimid.
[51] E G Bignami, M Russo, F Semeraro and V Bellini, ‘Balancing Innovation and Control.
[52] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI – Carriages preview | Legislative Train Schedule’ <https://www.europarl.europa.eu/legislative-train/theme-internal-market-and-consumer-protection-imco/file-digital-omnibus-on-ai> accessed 22 July 2026; Digital Watch Observatory, ‘Digital Omnibus on AI.
[53] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI – Carriages preview .
[54] E G Bignami, M Russo, F Semeraro and V Bellini, ‘Balancing Innovation and Control.
[55] A G Fraser et al, ‘Artificial intelligence in medical device software and high-risk medical devices.
[56]E G Bignami, M Russo, F Semeraro and V Bellini, ‘Balancing Innovation and Control.
[57] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council.
[58] A G Fraser et al, ‘Artificial intelligence in medical device software and high-risk medical devices.
[59] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council.
[60] A Bradford, The Brussels Effect: How the European Union Rules the World (OUP 2020).
[61] Congressional Research Service, FDA Regulation of AI-Enabled Devices (Congress.gov).
[62] Medicines and Healthcare products Regulatory Agency, AI Airlock programme materials.
[63] D Tang, X Xi, Y Li and M Hu, ‘Regulatory Approaches Towards AI Medical Devices.
[64] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council.
[65] European Commission, ‘Timeline for the Implementation of the EU AI Act’ (n 1); European Parliament, ‘Digital Omnibus on AI – Carriages preview.
[66] European Union, Regulation (EU) 2024/1689 of the European Parliament and of the Council.
[67] International Medical Device Regulators Forum.
[68] World Health Organization, materials on AI governance in health; IFPMA.
