EU AI Act – Current Status
As mentioned, EU member states voted unanimously to adopt the text of the AI Act on 2nd February, despite several indicating earlier opposition to the proposed text. There are still some additional steps to be completed before the EU AI Act can become law, including votes by The European Parliament’s Internal Market and Civil Liberties Committees on 13th February, followed by a plenary vote scheduled for 10-11 April. However, further significant opposition is no longer expected. The proposed text of the Regulation has now been published and reflects the political agreement announced in December with some important additions, including obligations on the Commission to develop guidelines on the practical implementation of the Act.
Timeline
Once adopted, the Act will enter into force twenty days after publication in the Official Journal, which is expected to be in 2024, but the majority of general obligations won’t be applicable until 2026. There are exceptions however, with prohibitions coming into effect after six months and rules on general purpose AI systems, governance and governance structures after twelve months. The Regulations governing medical devices that fall within the scope of the AI Act and are classed as high-risk AI, will come into force after thirty-six months.
Impact for Medical Devices and In-Vitro Diagnostic Medical Devices (IVDs)
The Act is likely to have a significant impact for the medical device industry as many AI systems used in medical devices fulfil the conditions in the Act for and would therefore be classified as high-risk AI systems. As such, medical devices and IVDs of class IIa and above (which require a Notified Body to be involved in the conformity assessment procedures) will be subject to the requirements of the AI Act applying to high-risk AI systems.
Although it has been agreed that the AI Act will not require a separate conformity assessment for in-scope medical devices (the AI Act assessment of conformity will be embedded in the Medical Device Regulation/In-Vitro Medical Device Regulation assessment), as high-risk AI systems, in-scope medical devices and IVDs will be subject to a raft of risk management obligations, including testing procedures, technical documentation, audits, monitoring and record keeping obligations, amounting to a very robust compliance system. As well as the obligations on providers, there are also specific obligations for importers, distributors and even on users of such systems.
Impact on Other Relevant AI Systems and Applications
Companies will need to undertake a comprehensive review of all existing AI systems and applications to determine whether these may also be covered by the new Regulation. This will require assessment of the requirements for each AI system based on its categorisation under the AI Act. For instance, clinical decision support software used in clinical trials i.e. to enhance trial design, predict drug efficacy and safety or conduct real world data analysis, which is classified as a medical device and uses an AI system will also be considered a high-risk AI system and subject to the regulations for high-risk AI systems.
Fines for Failure to Comply with the Obligations in the AI Act
It is worth noting that the proposed AI Act carries significant fines if prohibited AI systems are used or if high-risk AI systems do not comply with the requirements of the AI Act. For instance, the Regulation foresees a maximum fine for use of prohibited AI systems of up to EUR 35 million or (if the offender is a company) up to 7% of total worldwide annual turnover, whichever is higher.
Extra-territorial Effect
The AI Act will have an extra-territorial effect as the Regulation will apply to companies that place on the market or put into service AI systems in the EU, irrespective of where they are established. It will also apply to providers and users of AI systems located outside the EU where the output produced by the AI system is used in the EU.
Next Steps
Companies will need to consider both the scope and extra-territorial effect of the new Act, as well as undertake a comprehensive review of all their existing AI systems and applications to determine their level of risk associated with each application under the Act.
Familiarity with the requirements of the Act as well as an understanding of regulatory expectations is going to be critical to build appropriate compliance systems and AI governance frameworks and early investment to develop these structures is strongly recommended. Guidance aimed at helping companies with the practical implementation of the Act, including guidance on how the obligations on high-risk AI systems should be applied is expected and will be hugely welcome to help the medical device industry prepare for the implementation of this significant new Regulation.
Please contact info@lslawservices.com if you require our advice or guidance to help you navigate and prepare for the implementation of the AI Act.