The AI Act is the first European regulation to specifically regulate artificial intelligence using a risk-based approach. The European Commission wishes to guarantee an innovative, but secure, European AI market.

The regulation is based on four levels of risk:

• Unacceptable risk: prohibited use (e.g. systems manipulating behavior).
• High risk: critical systems, including many e-health systems.
• Limited risk: transparency obligations.
• Minimal risk use: permissive framework.

For healthcare, this means that many diagnostic aid systems, clinical decision support tools, or patient monitoring systems will be classified as "high risk" and subject to strong requirements, reinforcing the compliance expected for each use.

Startups and suppliers: what obligations, what does the legislation say?

Artificial intelligence solution providers, model developers, system integrators and healthcare institutions must comply with specific obligations, including:

• Implementation of a risk management system.
• Complete technical documentation.
• Quality and governance of training data.
• Transparency vis-à-vis users.
• Mandatory human supervision for certain uses.
• Post-marketing procedures to monitor system behavior.

These obligations also concern GPAI (General-Purpose AI) models, whose uses are increasingly affecting e-health, and reinforce the commission's role in supervising each system.

The consequences of non-compliance

The AI Act provides for penalties proportionate to the risk and seriousness of violations. Fines can reach several tens of millions of euros, particularly when fundamental rights or sensitive health data are involved.
Non-application of the rules or inadequate implementation therefore exposes companies, in France as in Europe, to financial, but also reputational risks, particularly in the event of inappropriate use or failure to comply.

Key dates and timetable

The law will be applied gradually.
Main stages:

1. Prohibitions (unacceptable risk): applicable a few months after publication.
2. GPAI rules: rapid entry into force to provide a framework for large models.
3. High-risk systems: obligations applicable 2 to 3 years after publication.
4. Phased implementation of European governance and supervisory authorities.

Companies need to anticipate their regulatory compliance roadmap now.

A major impact for e-health

E-Health is directly concerned:

• strong dependence on sensitive data;
• critical systems for diagnostics, prescriptions, and patient pathways;
• important ethical issues linked to rights and transparency.

Europe is imposing an ambitious vision here: AI in healthcare that remains reliable, explainable, controlled, and focused on patient safety.
France, already committed to digital regulation in healthcare, will have to harmonize some of its requirements with this European framework, particularly in terms of the use of artificial intelligence technologies.

How can companies prepare themselves?

Here are the priorities to consider in anticipating implementation:

• Map all systems and their risk levels.
• Evaluate the impact of the regulation on each use.
• Integrate governance and compliance requirements right from the design stage.
• Frame suppliers and subcontractors in their use.
• Check data quality and prevent bias.
• Provide the technical documentation required by law.
• Implement post-marketing surveillance.

The aim: to build a sustainable, responsible artificial intelligence strategy aligned with European legislation.