Clinical AI Obligations That Never Moved to 2027
A political agreement pushing the EU AI Act’s high-risk obligations out to December 2027, and to August 2028 for AI embedded in regulated medical devices, has led a lot of health systems to file the whole regulation under “next year’s problem.” That reading is wrong. The deferral covers specific chapters of the Act. Several other obligations were never touched by it, and some are already in force for clinical AI tools today.
The practical risk is a health system that quietly stops all AI governance work, only to discover that transparency duties and obligations on general-purpose AI providers, whose models often sit underneath clinical decision-support tools, were never part of the postponement. This article sets out what the deferral actually covers, what it leaves untouched, and what that means for AI governance work that should already be underway.
Executive Summary
The Digital Omnibus amendment to the EU AI Act deferred high-risk system obligations, currently to December 2027 for standalone systems and August 2028 for AI embedded in regulated medical devices, in response to unfinished technical standards. That deferral does not touch the Act’s prohibited-practice bans, its obligations on providers of general-purpose AI models, or its transparency requirements, several of which are already binding on health systems today. For compliance leaders, the 2027 and 2028 dates are the wrong deadlines to plan around if the goal is treating every obligation as still-pending.
Key Takeaways
- Only Chapter III high-risk system obligations, and Annex I embedded medical device obligations, were deferred, not the whole Act.
- Transparency obligations under Article 50 were not delayed and are already active. Disclosing AI interaction to patients is a current obligation.
- Obligations on general-purpose AI model providers were untouched by the deferral. Many clinical AI tools sit on top of general-purpose models.
- Prohibited AI practices remain banned regardless of the high-risk timeline.
- Governance infrastructure built now for transparency and documentation carries forward into any future high-risk classification.
What the Digital Omnibus Actually Deferred for Clinical AI
The deferral mechanism was introduced because the technical standards needed to operationalise high-risk obligations were not ready in time.
A Targeted Delay to Chapter III and Annex I, Not a Reset of the Act
The postponement applies to conformity assessment and the fuller compliance regime that high-risk and embedded medical device systems are subject to. Everything outside those categories proceeds on the timeline the Act originally set.
Backstop Dates Exist Precisely Because Standards Are Still Catching Up
The new dates function as backstops, with 2027 and 2028 as the outer limits regardless. Regulators expect health systems to keep preparing during the extension.
What Is Already in Force for Health Systems, Deferral or Not
Several obligations sit outside the deferred categories entirely and have applied on their original schedule.
General-Purpose AI Model Obligations Predate the Deferral Entirely
Providers of general-purpose AI models, which underpin many clinical decision-support tools, have been subject to documentation and transparency obligations since before the Digital Omnibus was proposed.
Transparency and Disclosure Duties Are Live Now
Requirements that patients be told when they are interacting with an AI system applied on the Act’s original schedule and were not moved by the Omnibus.
Why Treating the Delay as a Pause Costs More Later
A health system that stops all AI governance work is discarding groundwork that would have made the eventual high-risk deadline easier to meet.
Documentation and Logging Built Now Are Not Wasted Work
The record-keeping and access control capability that high-risk systems will eventually need overlaps substantially with what transparency obligations already require.
Building AI Governance Around What Actually Applies Today
The practical starting point is separating the obligation calendar into what is live now and what is on a backstop timeline, prioritising governance work against the first list immediately.
How a Data Control Plane Supports AI Governance Obligations Already in Force
The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every action any user or AI agent takes across every channel, and captures each one in a tamper-proof, unthrottled audit log that feeds directly into SIEM tooling, giving health systems the detailed, queryable record current transparency obligations expect.
Health systems that want to see how this applies to their current AI deployments can schedule a custom demo.
Frequently Asked Questions
Only Chapter III high-risk system obligations and Annex I embedded medical device obligations were deferred, to December 2027 for standalone systems and August 2028 for AI in regulated medical devices. The rest of the Act proceeds on its original timeline.
Yes. Transparency obligations under Article 50 were not delayed by the Digital Omnibus and are already active, requiring health systems to disclose when patients are interacting with an AI system.
Yes. Obligations on providers of general-purpose AI models were untouched by the deferral and have applied on the original schedule, which is relevant because many clinical decision-support tools rely on these models.
Prohibited AI practices remain banned, transparency duties are already in force, and documentation and logging built now for current obligations will carry forward and reduce effort when high-risk requirements eventually apply.