EU AI Act for Biotech and Pharma: Three Routes, Not One

It depends on what the AI is — and biotech AI splits three ways under Regulation (EU) 2024/1689, the EU AI Act. AI that is, or is built into, a medical device or in-vitro diagnostic takes the product route: it is high-risk under Article 6(1) because MDR (Regulation (EU) 2017/745) and IVDR (Regulation (EU) 2017/746) are listed in Annex I, with conformity delivered through the medical-device regime and a deadline of 2 August 2028. Pure drug-discovery and R&D AI may fall outside the Act entirely under the Article 2 scientific-research-and-development exclusion. And clinical-decision-support AI that is not a regulated device can land on the stand-alone Annex III route. Get the route right and the rest follows; get it wrong and you build the wrong programme to the wrong deadline.

This guide distinguishes the three. The single most common error in pharma is treating all AI as one bucket — either assuming the device regime swallows everything or assuming research is a free pass. Neither holds. Start with how Article 6 classification separates the product and stand-alone routes.

---

Route 1: medical-device and IVD AI — the product route via MDR/IVDR

If an AI system is itself a medical device, or is a safety component of one, it is high-risk under Article 6(1), because MDR 2017/745 and IVDR 2017/746 are in Annex I, Section A — the EU product-safety laws with their own conformity-assessment machinery. This is software-as-a-medical-device (SaMD) territory: diagnostic algorithms, AI that interprets medical images, IVD software that analyses a sample to inform a clinical decision, AI that drives or monitors a therapeutic device.

How conformity actually works

The AI Act does not impose a second, parallel conformity assessment on top of the device regime. It integrates with it. For an AI system that is high-risk under Article 6(1) and already requires a notified-body conformity assessment under MDR/IVDR, the AI Act requirements are demonstrated through that single, integrated assessment — the notified body assesses the AI Act high-risk requirements as part of the medical-device conformity route. The European Commission's medical-device guidance (the MDCG interplay guidance) addresses exactly this overlap so manufacturers do not run two disconnected processes. The practical effects:

• The deadline is 2 August 2028 — the Annex I product-embedded date under Article 6(1), not the 2 December 2027 stand-alone date.
• The assessor is the medical-device notified body, working to the MDR/IVDR procedure.
• The technical documentation folds into the device technical file rather than a separate Annex IV pack built from nothing.

The Article 9–15 substantive requirements still apply — risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness — but mapped onto, and largely satisfied through, the device regime the manufacturer already runs. The provider is usually the device manufacturer under Article 16; the hospital or lab operating the system is the deployer under Article 26. See healthcare AI and medical devices and medical-imaging AI.

---

Route 2: drug-discovery and pure R&D AI — the Article 2 exclusion

This is the route most biotech companies hope applies, and for genuine research it often does. Article 2 excludes from the AI Act's scope AI systems and models specifically developed and put into service for the sole purpose of scientific research and development, and it does not apply to research, testing or development activity on AI systems before they are placed on the market or put into service (other than testing in real-world conditions).

For a biotech doing target identification, molecule generation, protein-structure prediction, in-silico screening, or omics analysis purely for internal R&D, this exclusion can take the activity outside the Act altogether. That is a meaningful, real carve-out — drug-discovery AI used solely to advance research, and not yet a product placed on the market, is a strong candidate for the Article 2 R&D exclusion.

Where the exclusion ends

The exclusion is about purpose and stage, not subject matter. It stops applying when:

• The AI is placed on the market or put into service as a product — at that point it is assessed under Article 6 like any other system.
• The activity moves beyond research into real-world testing that the Act specifically does not exempt.
• The same model is repurposed from internal research into a clinical or commercial tool.

So the discovery engine that screens compounds internally may be excluded today, while the diagnostic algorithm that same company commercialises tomorrow is squarely high-risk via the device route. Document the purpose and stage; reassess at the moment of productisation. See Article 2 scope and exclusions.

---

Route 3: clinical-decision-support that is not a device — Annex III

Between the two clear routes sits a middle case. Some clinical-decision-support (CDS) AI is not regulated as a medical device — for example, certain software that supports a clinician without itself making a device-level diagnostic or therapeutic determination, depending on the MDR's qualification rules. Where such a system is not a device, it does not take the Article 6(1) product route — but it may still be high-risk on the stand-alone route if its intended purpose maps to an Annex III area.

The most relevant Annex III hook is point 5(a): AI used by or on behalf of public authorities to evaluate eligibility for essential public services, including healthcare. CDS deployed in a public health system to determine access to care or triage priority can fall here. The classification turns on the specific intended purpose and the deployment context, and it is genuinely case-by-case — the boundary between "device" (Route 1), "non-device CDS that is Annex III" (Route 3), and "non-device CDS that is neither" requires a careful, documented assessment. Where a CDS tool is neither a device nor an Annex III use, it can be minimal- or limited-risk, still carrying the Article 4 literacy and any Article 50 transparency duties.

---

The horizontal duties across the sector

Two obligations apply regardless of route. Article 4 AI literacy — in force since 2 February 2025, applying to all AI — requires documented measures to support the AI literacy of scientists, clinicians and staff operating AI systems. Article 50 transparency applies where a biotech or pharma company runs a patient-facing or research chatbot (50(1) disclosure) or publishes synthetic media (50(2)/50(4), applying since 2 August 2026; generative systems already on the market before then have until 2 December 2026 for content-marking). And the GDPR governs health data — special-category data under GDPR Article 9 — throughout, as a parallel regime that minimal-risk status does not switch off.

---

Worked example: a clinical-stage biotech classifies its AI

Consider Helixa Therapeutics, a Spanish clinical-stage biotech of about 130 employees and roughly €25M in annual funding. It runs four AI systems: a generative molecule-design engine used purely for internal drug discovery, an AI image-analysis algorithm built into a companion diagnostic it is commercialising under IVDR, a clinical-decision-support tool piloted in a public hospital to prioritise patients for a treatment programme, and a recruitment screener for hiring lab staff.

Walking each system to a route and tier

The molecule-design engine is used solely for internal R&D and is not placed on the market, so it is a strong candidate for the Article 2 scientific-R&D exclusion — outside the Act's scope while it stays research-only; Helixa documents the purpose and commits to reassessing if it is ever productised. The companion-diagnostic image algorithm is high-risk via Article 6(1) because it is built into an IVDR device — the product route, integrated conformity through the IVDR notified body, deadline 2 August 2028; Helixa is the provider under Article 16. The clinical-decision-support pilot, deployed in a public hospital to prioritise patients for an essential health service, is assessed as high-risk on the stand-alone route under Annex III point 5(a) — running to the 2 December 2027 date set by the Digital Omnibus adopted in June 2026. The recruitment screener is high-risk under Annex III point 4 — the ordinary hiring route.

The outcome — three routes in one company

Helixa lands on all three routes plus the hiring case: one system excluded under Article 2 (molecule design), one product-route high-risk system to 2 August 2028 (the IVDR diagnostic), and two stand-alone Annex III high-risk systems to 2 December 2027 (the public-hospital CDS and the recruitment screener). The lesson is that biotech AI almost never sits on a single route — and the most expensive mistake would be to assume the device regime covers the CDS pilot or that "it's research" covers the commercialised diagnostic. As an SME, Helixa benefits from the Article 99(6) fine cap (lower of percentage or fixed amount) and proportionate conformity-assessment fees under Article 62.

---

The biotech AI route-and-tier map

The defining discipline: a device goes via MDR/IVDR to 2 August 2028; genuine research may be excluded under Article 2; non-device CDS and hiring go via Annex III — each assessed on its specific purpose.

Penalties, with the SME cap

High-risk obligation breaches sit at up to €15,000,000 or 3% of total worldwide annual turnover, whichever is higher, under Article 99(4). Article 5 prohibited practices carry up to €35,000,000 or 7% under Article 99(3). Supplying incorrect or misleading information to authorities is up to €7,500,000 or 1% under Article 99(5). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the two. MDR/IVDR carry their own separate penalty regimes — never conflate the AI Act tiers with the device regulations' own enforcement. See the Article 99 penalties.

---

Deadlines and how Confir helps

The dates that govern biotech AI

For device and IVD AI under Article 6(1), the high-risk obligations apply from 2 August 2028 — the Annex I product-embedded date. For non-device Annex III systems (public-health CDS, hiring), the statute originally read 2 August 2026, deferred to 2 December 2027 under the Digital Omnibus, now adopted — the European Parliament passed it on 16 June 2026, the Council on 29 June 2026. The dates are fixed calendar dates, chosen by the co-legislators instead of the Commission's standards-linked "stop the clock" proposal; it was published in the Official Journal on 24 July 2026 and in force since 27 July 2026. Plan against the adopted 2 December 2027 date for Annex III systems. Article 4 literacy applies since 2 February 2025; Article 50 from 2 August 2026. See is the AI Act delayed.

What Confir does

Confir registers each biotech AI system and classifies it under Article 2, Article 5 and Article 6 — separating the Article 6(1) device-route systems (MDR/IVDR, 2 August 2028) from the Article 2 research-exclusion candidates and the stand-alone Annex III systems, and flagging the moment a research model is productised and the exclusion ends. It runs the Article 6(3) filter, derives provider or deployer roles, and assembles the Article 11 / Annex IV documentation that maps onto the device technical file or stands alone, as the route requires.

The engine is deterministic and rule-based: the same intake produces the same finding, with the rule that fired shown — so a route decision, including the device-versus-CDS-versus-research call that drives the whole programme, is reproducible and audit-defensible, which matters in a sector where the same system can move between routes as it advances toward market. Confir cross-maps to ISO/IEC 42001 and GDPR but does not replace the MDR/IVDR conformity assessment itself.

---

Frequently asked questions

Is biotech and pharma AI high-risk under the EU AI Act?

It depends on what the AI is. AI that is, or is built into, a medical device or in-vitro diagnostic is high-risk via Article 6(1) because MDR and IVDR are in Annex I — the product route, with conformity through the device regime and a deadline of 2 August 2028. Pure drug-discovery and internal R&D AI may fall outside the Act under the Article 2 scientific-research exclusion. Clinical-decision-support AI that is not a regulated device can be high-risk on the stand-alone Annex III route if its purpose maps to an Annex III area, such as public-health access under point 5(a). Classify each system by what it is and does.

Is drug-discovery AI covered by the EU AI Act?

Often not, while it stays purely in research. Article 2 excludes AI systems developed and used for the sole purpose of scientific research and development, and the Act does not apply to research, testing or development before a system is placed on the market (other than real-world testing). So target identification, molecule generation, protein-structure prediction and in-silico screening used solely for internal R&D are strong candidates for the exclusion. The exclusion ends when the AI is placed on the market, moves into exempted real-world testing's limits, or is repurposed into a clinical or commercial tool — reassess at productisation.

How does the EU AI Act apply to AI medical devices?

AI that is or is in a medical device or IVD is high-risk under Article 6(1) because MDR 2017/745 and IVDR 2017/746 are listed in Annex I. The AI Act requirements are demonstrated through the existing medical-device conformity assessment rather than a separate process — where a notified body already assesses the device under MDR/IVDR, it also assesses the AI Act high-risk requirements as part of that route. The deadline is 2 August 2028, the documentation folds into the device technical file, and the manufacturer is normally the provider under Article 16. The Commission's MDCG guidance addresses the interplay.

Is clinical-decision-support software high-risk?

It depends on whether it is a regulated device and what it is used for. If the CDS is a medical device under MDR, it takes the Article 6(1) product route. If it is not a device, it does not take that route — but it can still be high-risk on the stand-alone Annex III route if its intended purpose maps to an Annex III area, most relevantly point 5(a) where it determines access to essential public healthcare. Where it is neither a device nor an Annex III use, it can be minimal- or limited-risk. The classification is case-by-case and turns on the specific intended purpose and deployment context.

What deadlines apply to biotech AI?

For device and IVD AI on the Article 6(1) product route, the high-risk obligations apply from 2 August 2028. For non-device Annex III systems, such as public-health clinical decision support or hiring, the statute originally read 2 August 2026, deferred to 2 December 2027 under the Digital Omnibus — now adopted, European Parliament 16 June 2026, Council 29 June 2026. Plan against the adopted 2 December 2027 date for Annex III systems. Article 4 AI literacy has applied since 2 February 2025, and Article 50 transparency from 2 August 2026.

Does the EU AI Act replace MDR and IVDR for AI medical devices?

No. The AI Act adds high-risk requirements that are demonstrated through the existing MDR/IVDR conformity assessment, but it does not replace those regulations — the device must still meet MDR or IVDR in full, and those regulations keep their own conformity routes and their own separate penalty regimes. The AI Act integrates with the device regime rather than substituting for it, which is why the assessor is the medical-device notified body and the documentation lives in the device technical file. Treat them as two regimes that must both be satisfied through one coordinated process.

---

Related guides

• Article 6 high-risk classification
• Article 2 scope and exclusions
• Healthcare AI and medical devices
• Medical-imaging AI under Annex III
• The conformity-assessment route
• Healthcare AI compliance
• Pharma AI compliance