On 29 June, the EU Council gave its final approval to a set of changes to the AI Act, known as the "Digital Omnibus on AI." The European Parliament had already approved the text on 16 June, so this step closes the process. The new rules take effect a few days after official publication, expected soon.
The biggest change is a delay for the major requirements regarding AI-based medical devices classified as high-risk AI systems. This deadline shift counts for both the providers as the deployers and is now 2 August 2028.
Other changes important to healthcare include:
- Some requirements for high-risk AI systems that are also medical devices may be limited to prevent overlapping obligations with the MDR/IVDR. More to be announced 2 August 2027. [Article 2]
- AI literacy obligation is softened and changes from being required to "ensure, to their best extent, a sufficient level", to being required to "support the development" of AI literacy. [Article 4]
- The AI act allows processing of special categories of personal data for bias detection [Article 4a]
- Where a Fundamental Rights Impact Assessment (FRIA) overlaps with a Data Protection Impact Assessment (DPIA), deployers may cross-reference the DPIA instead of duplicating the analysis. [Article 27]
- Notified bodies designated under MDR/IVDR have the power to assess AI Act requirements as part of the existing conformity assessment [Article 43(3)]
- No duplication of serious incident reporting for MDR/IVDR devices - no need to report to market surveillance authorities under the AI Act for all serious incidents, only for fundamental rights infringements. [Article 73(10)]
- Guidelines on how to implement AI Act requirements alongside MDR/IVDR obligations - covering risk management, data governance, and quality management systems - to be published by 1 August 2027. [Article 96(g)]
This is the first major update to the AI Act since it was introduced in 2024.