The AI Act is the first European regulation specifically designed to govern artificial intelligence using a risk-based approach. The legislature aims to ensure an innovative yet secure European AI market.

The regulation is based on four risk levels:

• Unacceptable risk: prohibited use of an AI system (e.g., systems that manipulate behavior).
• High risk: AI systems posing risks to individuals’ rights, health, or safety, including many e-health systems, which are therefore subject to enhanced obligations
• Limited risk: transparency requirements for AI systems that interact with the public or for labeling AI-generated content.
• Minimal-risk use: no obligations, but companies may adopt voluntary codes of conduct.

In the healthcare sector, this means that many diagnostic support systems, clinical decision-support tools, AI systems integrated into medical devices, or patient monitoring systems are likely to be classified as high-risk AI systems and subject to stringent requirements, thereby strengthening the compliance standards expected for each use case.
 

Startups and AI system providers or implementers: What are the obligations, and what does the legislation say?

Providers of artificial intelligence systems, system integrators, and healthcare facilities must comply with specific obligations, including:

• Establishment of a risk management system.
• Comprehensive technical documentation.
• Quality and governance of training data.
• Transparency toward users.
• Mandatory human supervision for certain uses.
• Post-market procedures to monitor system behavior.

Developers of general-purpose AI models are also subject to compliance requirements.
 

Consequences of Non-Compliance

The AI Act provides for penalties proportionate to the risk and severity of violations. For example, placing a prohibited AI system on the market is subject to an administrative fine of up to 35 million euros or 7% of global annual revenue.
Failure to apply the rules or insufficient compliance therefore exposes companies, both in France and throughout the European Union, to financial and reputational risks, particularly in cases of inappropriate use or non-compliance.
 

Key Dates and Timeline

The law will be implemented gradually.

Key milestones:

• February 2, 2025: Ban on AI systems posing unacceptable risks
• August 2, 2025: Rules for general-purpose AI models take effect
• August 2, 2026: Transparency and labeling requirements take effect (Article 50)
• December 2, 2027: Entry into force of obligations for sector-specific high-risk AI systems (Annex III, including biometric AI systems used for access to essential public and private services, etc.)
• August 2, 2028: Entry into force of obligations for high-risk AI systems integrated into regulated products (Annex I, including medical devices and in vitro diagnostic devices).
   

Companies must begin planning now to ensure compliance with the regulation.
 

A Major Impact on e-Health

E-health is directly affected:

• heavy reliance on sensitive data;
• AI systems likely to be high-risk if used for diagnoses, prescriptions, and patient care pathways.

Europe is setting an ambitious vision here: AI in healthcare that remains reliable, explainable, controlled, and focused on patient safety.
France, which is already committed to digital regulation in healthcare, will need to align some of its requirements with this European framework, particularly regarding the use of artificial intelligence technologies.
 

How can companies prepare?

Here are the priorities to consider in anticipation of implementation:

• Map all deployed AI systems and their risk levels.
• Assess the applicable regulatory requirements for each use case.
• Integrate compliance requirements from the design phase onward.