The EU AI Act After the Delay: What Doctors, Lawyers and Students Need to Know
For two years the EU AI Act was described as the strictest technology law in the world. In June 2026 Europe gave itself more time to apply its hardest parts. The delay changed the calendar. It did not change who will answer when an algorithm harms a patient or misleads a court.
La risposta breve
The EU AI Act already bans certain practices and requires AI literacy, and the transparency obligations of Article 50 apply from 2 August 2026. The Digital Omnibus adopted in June 2026 moved obligations for stand-alone high-risk systems to 2 December 2027 and for AI in regulated products, including medical devices, to 2 August 2028. Liability for harm runs mainly through product liability and professional negligence law.
The EU AI Act was due to switch on its rules for high-risk systems on 2 August 2026: AI used in hiring, lending, education, essential services and medicine. Weeks earlier the European Parliament and the Council adopted the Digital Omnibus, a package that moved those deadlines. Stand-alone high-risk systems listed in Annex III now have obligations from 2 December 2027. AI built into regulated products under Annex I, including medical devices, follows on 2 August 2028. Lawyers called it a delay, not a repeal.
What the EU AI Act already requires
Much of the law already applies. Since February 2025 certain practices have been prohibited, and every organisation using AI has had obligations on AI literacy under Article 4, a duty that reaches hospitals, law firms and universities; the Omnibus softened it into a duty to support the development of AI literacy among staff rather than to guarantee a set level. Rules for general-purpose models have applied since August 2025. And since 2 August 2026 the transparency obligations of Article 50 are in force: people must be told when they are dealing with an AI system, AI-generated content must be marked and emotion recognition must be disclosed. Fines for breaches reach €15 million or 3 per cent of worldwide annual turnover.
| Date | What applies under the EU AI Act | Who it affects |
|---|---|---|
| 2 February 2025 | Prohibited practices; AI literacy (Article 4) | All providers and deployers, including hospitals and law firms |
| 2 August 2025 | Obligations for general-purpose AI models | Developers of large models |
| 2 August 2026 | Transparency under Article 50; penalties | Chatbots, content generators, emotion recognition |
| 2 December 2026 | End of grace period for marking AI-generated content (Article 50(2)) for systems already on the market | Generative AI already in use |
| 2 December 2027 | High-risk systems in Annex III | Recruitment, credit, education, essential services |
| 2 August 2028 | High-risk AI in regulated products (Annex I) | Medical devices and other regulated products |
What the EU AI Act means for doctors
Most diagnostic and triage software that qualifies as a medical device will be high-risk under the Act, but its specific obligations now arrive in 2028. Until then, safety is governed by the Medical Device Regulation, and the doctor is bound by the ordinary duty of care. A doctor who relies on an AI finding without the judgment the profession expects remains responsible for the outcome. The AI literacy duty already requires hospitals to train the people who use these tools.
Who is liable when AI gets it wrong?
In 2025 the European Commission withdrew its proposed AI Liability Directive. Liability will therefore run through old and new channels. Professional negligence law still applies to the doctor and the lawyer. The new Product Liability Directive, which applies from December 2026, treats software, including AI, as a product and lets courts presume defect or causation when technical complexity makes proof excessively difficult. Contract law covers the rest.
Every one of these routes depends on evidence, and the Act contains an underrated provision. Article 12 requires high-risk systems to keep logs of their operation automatically. Deployers must keep them. When something goes wrong, those logs will be the record.
Legal Smart has seen what happens when one side holds the record. In Projektili pravde (2024) Srđan Aleksić documents how the map of sites struck with depleted uranium in Kosovo reached the United Nations more than a year after the 1999 war, and how Italian courts, faced with soldiers whose exposure was documented, placed the burden on the state that held the files. The same principle will decide AI cases: the side that keeps the logs will be asked to explain them.
What students should take from the EU AI Act
For law and medical students, this Act is not a niche field. It joins data protection and product safety as a framework every professional will meet. Three habits will matter: know which systems you use and how they are classified, record how an AI output influenced a decision, and never present an output as verified when it is not.
For more on how evidence decides liability, see our reports on the state’s duty to protect and on tissue evidence years after exposure.
Frequently asked questions
When does the EU AI Act apply?
In stages. Prohibitions and AI literacy from 2 February 2025, general-purpose AI rules from 2 August 2025, transparency obligations from 2 August 2026. Rules for high-risk systems were moved to 2 December 2027 and 2 August 2028.
Is medical AI high-risk under the EU AI Act?
AI that is, or is part of, a medical device requiring third-party assessment is high-risk under Annex I. After the Digital Omnibus those obligations apply from 2 August 2028.
Who is liable if AI makes a wrong diagnosis?
Usually the doctor or hospital under negligence law, and the manufacturer under product liability law. The EU’s new Product Liability Directive treats software, including AI, as a product from December 2026.
What does Article 50 of the EU AI Act require?
That people are told when they interact with AI, that AI-generated content is marked, and that deepfakes and emotion recognition are disclosed, with fines of up to €15 million or 3 per cent of turnover.
Sources
- S. Aleksić, Projektili pravde (Niš, 2024), chapter 7 and annex (records and burden of proof)
- Regulation (EU) 2024/1689 (Artificial Intelligence Act)
- Gibson Dunn, EU AI Act Omnibus agreement: postponed high-risk deadlines (2026)
- Future of Privacy Forum, the AI Act implementation timeline under the AI Omnibus (2026)
- Pinsent Masons, rules on high-risk AI to be delayed under EU omnibus deal (2026)
- Directive (EU) 2024/2853 on liability for defective products
