The EU AI Act's Next Deadline Is Weeks Away. Should AI Drug Designers Worry?

A deadline that sounds bigger than it is#

On 2 December 2026, another piece of the EU AI Act clicks into place. If you run a biotech that uses generative models to dream up molecules, you may already have received the slide deck from a consultant: red dates, amber warnings, a suggestion that your chemistry engine is about to become a regulated product.

Take a breath. For most AI in drug discovery, the December date is close to a non-event. That is not the same as saying the EU AI Act does not matter to AI designed drugs. It does, but in odd, specific places that are easy to miss if you only read the headlines. And the rules that will actually decide whether an AI-designed molecule reaches patients come mostly from medicines regulators, not from Brussels' AI rulebook.

This piece works through what the next deadline covers, what the summer's Digital Omnibus changed, and where the compliance work for drug developers really sits.

Background: what the EU AI Act is, in plain terms#

The AI Act is a regulation, which in EU law means it applies directly in every member state without needing national legislation. It entered into force on 1 August 2024 and switches on in stages (Regulation (EU) 2024/1689).

Its logic is risk-based. A short list of practices is banned outright, such as manipulative systems that exploit vulnerabilities. A larger set of "high-risk" systems must meet demanding requirements: risk management, data governance, technical documentation, human oversight, accuracy and cybersecurity, plus a conformity assessment before sale (Regulation (EU) 2024/1689). A third tier carries only transparency duties, for example telling people when they are chatting with a machine. Everything else is left largely alone.

A few terms are worth pinning down before going further.

Provider and deployer. The provider builds an AI system or has it built and places it on the market under its own name. The deployer uses it in a professional setting. A pharma company that licenses a protein-design platform is usually a deployer; the platform's developer is the provider (Regulation (EU) 2024/1689).

High-risk, two routes. A system becomes high-risk either because it is a safety component of, or itself is, a product already covered by EU safety law listed in Annex I (medical devices and in vitro diagnostics are on that list), or because its use case appears in Annex III, which covers areas such as employment, credit scoring, education and access to essential services (Regulation (EU) 2024/1689). Medicinal products are not an Annex I category.

General-purpose AI (GPAI) model. A model that can competently perform a wide range of distinct tasks, such as a large language model. The Commission's guidelines treat a model trained with more than 10^23 floating-point operations that can generate language, images or video as presumptively general-purpose (European Commission GPAI guidelines).

The research exemption. Article 2(6) excludes AI systems and models, including their output, "specifically developed and put into service for the sole purpose of scientific research and development". Article 2(8) separately excludes research and testing of AI systems before they are placed on the market, although testing in real-world conditions is not covered by that exclusion (Regulation (EU) 2024/1689).

AI-designed drug. There is no legal definition. In practice it means a molecule whose target, structure or both were proposed or substantially optimised by machine learning. The best-documented clinical example so far is rentosertib, a TNIK inhibitor for idiopathic pulmonary fibrosis whose target and molecule were both identified with generative AI. In a 71-patient phase 2a trial, the 60 mg once-daily group showed a mean change in forced vital capacity (a lung-function measure) of +98.4 ml after 12 weeks, against −20.3 ml on placebo, with safety comparable across arms (Xu et al., Nature Medicine, 2025). Small, short and early, but real.

The EU AI Act timeline after the Digital Omnibus#

The original calendar had most obligations, including the high-risk regime, arriving on 2 August 2026. That date was moved. In November 2025 the Commission proposed a "Digital Omnibus" package to simplify and delay parts of the Act, and the final text was signed on 8 July 2026 as Regulation (EU) 2026/1744, entering into force on 27 July 2026 (Regulation (EU) 2026/1744).

The headline change: stand-alone Annex III high-risk obligations now apply from 2 December 2027, and Annex I product-route obligations, which include AI in medical devices and diagnostics, from 2 August 2028 (White & Case analysis of Regulation 2026/1744). The Omnibus also softened the AI literacy duty, extended relief for smaller firms and let the Commission limit the Act's reach where sector law already imposes equivalent AI requirements (White & Case).

What was not deferred are the Article 50 transparency rules. They have applied since 2 August 2026, with one grace period: generative systems already on the market before that date have until 2 December 2026 to comply with the machine-readable marking duty in Article 50(2) (European Commission, Article 50 FAQ). That is the "next deadline". The chart below puts it in context.

Figure: EU AI Act timeline as amended by the Digital Omnibus. Dates from Regulation (EU) 2024/1689, Regulation (EU) 2026/1744, the Commission's Article 50 FAQ and its GPAI guidelines.

What 2 December 2026 actually asks for#

Article 50(2) says providers of systems that generate synthetic audio, images, video or text must mark the output in "effective, reliable, robust and interoperable" machine-readable ways, so that it can be detected as AI-generated (European Commission, Article 50 FAQ). Think invisible watermarks and signed metadata.

So does a model that emits a SMILES string (a line of letters and symbols that encodes a chemical structure) or an amino-acid sequence have to watermark it? The Commission's reading suggests not. Its guidance places outside the marking duty "a short sequence of numbers, symbols or letters", "source code", outputs "exclusively communicated from machine-to-machine", and outputs "only used in closed loop industrial and product development environments", unless they are the final output (European Commission, Article 50 FAQ). A design-make-test loop in which a generative model proposes candidates, a scoring model ranks them and a robot synthesises the top hits looks a lot like that closed loop.

Two caveats. First, Commission guidelines are not binding law; only the Court of Justice gives the final word. Second, the transparency rules also bite on deployers. Article 50(4) requires labelling of AI-generated or manipulated text published to inform the public on matters of public interest, and law firm analyses of the July 2026 guidelines note that scientific developments are explicitly within that trigger, unless a human has genuine, documented editorial control (Paul, Weiss analysis; Commission guidelines). A biotech that lets a language model write its patient-facing trial updates, unreviewed, has a problem. One that runs a patient support chatbot must also tell users they are talking to an AI under Article 50(1) (Regulation (EU) 2024/1689).

The voluntary Code of Practice on AI-generated content, which the Commission and the AI Board have assessed as adequate, gives providers a practical route to compliance (European Commission, Code of Practice). For most drug designers, this is a problem for whoever supplies their language models, not for the chemistry team.

Is a molecule-design model "high risk"? Usually not#

The more consequential question for founders is whether their discovery platform could ever be classed as high-risk. Here the answer is mostly reassuring. Drug discovery appears in neither Annex III's list of use cases nor, via medicinal products, in Annex I (Regulation (EU) 2024/1689). The European pharmaceutical industry body EFPIA argued in 2024 that AI tools used only for research fall under the Article 2(6) exemption, and that R&D tools outside it generally do not meet the high-risk criteria anyway (EFPIA statement, April 2024). That is an industry position, not a ruling, but it matches the text.

The exemption has edges, though. "Sole purpose" is doing heavy lifting. A platform built in-house for research sits comfortably inside it. The same platform licensed commercially to other companies is arguably being placed on the market for a business purpose, and the exemption's protection becomes less certain. Article 2(8) protects testing of an AI system before launch, but explicitly not testing in real-world conditions (Regulation (EU) 2024/1689).

The genuine high-risk exposure for drug developers lies next door to discovery. An AI companion diagnostic that selects which patients receive a targeted drug is likely to be an in vitro diagnostic requiring notified-body assessment, which makes it high-risk under the Annex I route. Guidance from the EU's Medical Device Coordination Group and AI Board says this applies to most devices of MDR class IIa and above and IVDR class B and above (MDCG 2025-6 / AIB 2025-1). That document still cites August 2027; the Omnibus has since moved the date to 2 August 2028 (White & Case). Corporate functions such as AI-driven recruitment screening are Annex III high-risk in any sector, pharma included (Regulation (EU) 2024/1689).

The table below summarises where common uses tend to land. Treat it as orientation, not legal advice; classification always depends on the facts.

Use of AI in the medicines lifecycle	Likely EU AI Act status	Relevant date	Main rules that actually bite
Generative chemistry or protein design used only in-house for R&D	Likely excluded under Article 2(6) research exemption	None under the AI Act	Good scientific practice; EMA reflection paper if data reach a dossier
Same discovery platform licensed to third parties	Not high-risk on current lists; exemption less certain	Article 50 if it generates text or images for people	Contract terms; Article 50 for any human-facing outputs
AI analysing trial data or images to support a regulatory submission	Not listed as high-risk	None specific	EMA reflection paper; FDA credibility framework; EMA-FDA principles
AI in GMP manufacturing (e.g. visual inspection, process control)	Generally not high-risk unless a machinery safety component	Possible Annex I date (2 Aug 2028) for machinery	EU GMP Annex 11 and draft Annex 22
AI companion diagnostic or clinical decision software sold as a device	High-risk via Annex I (MDR/IVDR)	2 Aug 2028	MDR/IVDR plus AI Act requirements, assessed by notified body
Patient-facing chatbot or AI-written public updates	Transparency tier (Article 50)	Applies now; marking by 2 Dec 2026 for legacy systems	Disclosure, labelling, provider marking duties
AI CV screening for recruitment at a biotech	High-risk via Annex III	2 Dec 2027	Full high-risk regime for deployers

Sources: Regulation (EU) 2024/1689; Regulation (EU) 2026/1744; MDCG 2025-6; EMA; EFPIA.

Where the real rulebook lives: the medicines regulators#

If the AI Act mostly waves discovery tools through, who checks them? The answer is the same people who have always checked drug evidence.

The European Medicines Agency adopted its reflection paper on AI across the medicinal product lifecycle in September 2024 (EMA). Its message is that companies carry responsibility for any algorithm whose output feeds into the benefit-risk case, and that scrutiny scales with how much influence the model has on a regulatory decision. In March 2025 the agency issued its first qualification opinion on an AI tool, AIM-NASH, which reads liver-biopsy images to score disease activity in clinical trials for a fatty liver disease (EMA qualification opinion). That is what serious validation looks like: a defined task, a defined context, evidence that the tool performs.

In January 2026 the EMA and the US Food and Drug Administration published ten joint guiding principles for good AI practice in drug development. They cover a risk-based approach, a clearly defined context of use, data governance, life-cycle monitoring for problems such as data drift, and plain-language information about a model's limitations (EMA-FDA guiding principles). They are not binding, but they show where both agencies are heading.

The FDA's own January 2025 draft guidance sets out a seven-step "credibility" framework: define the question, define the context of use, assess model risk, plan, execute, document and decide whether the model is adequate (FDA draft guidance). Notably, it explicitly does not cover AI used in drug discovery, a scope choice that tells you something. Regulators care about evidence that reaches a decision, not about how a chemist got the idea.

In manufacturing, the draft EU GMP Annex 22 on AI went out for consultation in 2025. The draft said dynamic, adaptive and probabilistic models, including generative AI and large language models, should not be used in critical GMP applications. Consultation feedback pushed back, the EMA held an expert workshop in June and July 2026, and the agency says it is "still considering the implications" (EMA Annex 22 workshop). For a company scaling an AI-optimised process, Annex 22 will matter more than anything in the AI Act.

The evidence question nobody can legislate away#

Regulation can demand documentation. It cannot make a molecule work. An analysis of AI-native biotech pipelines published in 2024 found that AI-discovered molecules succeeded in phase I at 80 to 90 per cent, well above historical industry averages, but at around 40 per cent in phase II, roughly the industry norm, on a small sample (Jayatunga et al., Drug Discovery Today, 2024). The authors' reading is that AI is good at designing molecules with drug-like properties. Whether it is better at picking the right biology is a separate, unanswered question.

That gap is why the drug regulators' framing makes more sense for this field than the AI Act's. A molecule that a model proposed is still tested in cells, animals and people, and judged on the results. The model's fingerprints matter only where its output becomes evidence: a synthetic control arm, an image-reading endpoint, a dose prediction that replaces a study. There, the EMA's reflection paper and the FDA's credibility steps already ask the right questions.

There is a fair counter-argument. Some lawyers and ethicists worry that the research exemption is too generous, and that the dual-use risks of biological design tools, models that could in principle help design harmful agents, fall through the gaps between AI law and biosecurity law. The AI Act's general-purpose model rules catch big language models, but a specialised protein model trained below the Commission's compute presumption may not meet the GPAI definition at all (European Commission GPAI guidelines). Whether that is a gap or a sensible boundary depends on who you ask, and it is a debate worth watching.

A practical checklist before December#

For a typical AI drug discovery company, the EU AI Act compliance to-do list before 2 December 2026 is short:

Map your systems. Separate pure R&D tools from anything sold, licensed or put in front of patients or the public.
Check your language models. If you deploy chatbots or generate public text, confirm your provider's Article 50 marking plan and set up human editorial review with a paper trail.
Look sideways at diagnostics. If you co-develop an AI companion diagnostic, plan for the August 2028 Annex I date now, because notified-body capacity will be tight.
Do not neglect HR. AI recruitment tools become high-risk on 2 December 2027.
Align with the medicines guidance. Document the context of use and validation of any model whose output will appear in a regulatory submission, following the EMA reflection paper and the EMA-FDA principles.

Penalties are not trivial. Breaching most AI Act obligations can cost up to €15 million or 3 per cent of worldwide annual turnover, rising to €35 million or 7 per cent for prohibited practices, with lower caps for smaller firms (Regulation (EU) 2024/1689). Still, for most teams designing molecules, the December deadline belongs in a calendar reminder rather than a crisis meeting. The bigger work is the one drug developers already know: proving, with data, that the thing works and is safe.

Frequently asked questions#

Does the EU AI Act regulate AI-designed drugs themselves? No. The AI Act regulates AI systems, not the medicines they help create. A drug designed with AI goes through the same marketing authorisation process as any other, under EU pharmaceutical law and EMA oversight (EMA).

What exactly happens on 2 December 2026? Generative AI systems that were already on the market before 2 August 2026 must comply with the Article 50(2) duty to mark their outputs as AI-generated in a machine-readable way (European Commission, Article 50 FAQ).

Do I need to watermark SMILES strings or protein sequences? Probably not. The Commission's guidance excludes short sequences of symbols or letters, machine-to-machine outputs and interim outputs in closed-loop product development from the marking duty, though this guidance is not legally binding (European Commission, Article 50 FAQ).

Is my drug discovery platform a high-risk AI system? On the current lists, almost certainly not. Neither Annex I nor Annex III covers drug discovery, and tools built solely for research are excluded under Article 2(6) (Regulation (EU) 2024/1689). Commercial licensing may weaken the research exemption argument, so take advice if you sell your platform.

When do the EU AI Act high-risk rules start now? After the Digital Omnibus, Annex III stand-alone systems from 2 December 2027 and Annex I product-embedded systems, including medical devices and diagnostics, from 2 August 2028 (Regulation (EU) 2026/1744; White & Case).

What does the EMA expect if AI generates evidence for my submission? A clearly defined context of use, risk-proportionate validation, transparent data governance and ongoing monitoring, as set out in its 2024 reflection paper and the January 2026 EMA-FDA principles (EMA; EMA-FDA guiding principles).

Have any AI-designed drugs shown clinical benefit yet? Early signals exist. Rentosertib improved lung function versus placebo at its highest dose in a 12-week phase 2a trial of 71 patients, but larger and longer trials are needed (Xu et al., Nature Medicine, 2025).

Does the UK follow these rules? The AI Act is not UK law, but it reaches UK and US companies whose AI systems are placed on the EU market or whose outputs are used in the EU (Regulation (EU) 2024/1689).