The global regulatory patchwork for AI in pharma

• Medical device law (does it qualify as SaMD, a standalone software product regulated like a device because it diagnoses, treats, or informs clinical management)
• AI-specific horizontal law (does it meet criteria for "high-risk" under general AI regulation, independent of what industry it's in)
• Sector-specific guidance (does the medicines regulator have separate expectations because the tool touches drug safety, trial data, or manufacturing)

The EU stacks these three layers. The US mostly separates them into device law (existing FDA authority) and voluntary or emerging AI-specific frameworks. That structural difference is the source of most cross-border friction.

The EU AI Act: classification by risk tier

The EU AI Act (entered into force 2024, with obligations phasing in through 2026-2027) classifies AI systems into risk tiers: unacceptable, high-risk, limited-risk, and minimal-risk.

Most clinical AI used for diagnosis, treatment recommendations, or triage falls into high-risk, either because it's a safety component of a regulated medical device, or because it independently meets high-risk criteria (Annex III lists health-related uses explicitly).

High-risk status means, before deployment:

• A conformity assessment (documented proof the system meets EU requirements)
• A risk management system maintained across the model's lifecycle, not just at launch
• Data governanceData governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.Voir la définition complète → requirements (training data must be relevant, representative, and checked for bias)
• Human oversight measures, meaning a clinician must be able to meaningfully override or ignore the output
• Technical documentation and logging sufficient for a regulator to audit decisions after the fact
• Post-market monitoring, with mandatory incident reporting for serious malfunctions

The Act applies to any provider placing the system on the EU market, regardless of where the company is headquartered. A US-based CDS vendor selling into German hospitals is in scope.

FDA's evolving approach: GMLP and the SaMD lens

The FDA (Food and Drug Administration) doesn't have a single "AI Act." Instead it extends existing device and drug frameworks, plus emerging guidance specific to machine learning.

Key building blocks as of 2026:

SaMD framework: if the software's function is to diagnose, treat, or drive clinical management and it isn't merely supporting a hardware device, it can be regulated as software as a medical device, subject to the same premarket pathways (510(kkThe average number of new users each existing user generates through referrals. Above 1.0, growth compounds on itself and becomes exponential.Voir la définition complète →), De Novo, PMA) as physical devices.

CDS carve-out: under the 21st Century Cures Act, certain clinical decision supportdecision supportTechnologies and processes that turn raw data into actionable insights via reporting, dashboards and analysis, so teams can decide based on facts rather than intuition.Voir la définition complète → tools are exempt from device regulation, specifically where the software displaysdisplaysThe total number of times an ad or piece of content is displayed, regardless of clicks. Each display counts as one impression, even to the same person.Voir la définition complète → information without solely relying on it, and a healthcare provider can independently review the basis for the recommendation. This exemption is narrower than most vendors assume; the FDA has clarified that many "black box" scoring tools do not qualify because the clinician cannot actually see or verify the underlying rationale.

GMLP (Good Machine Learning Practice): a set of guiding principles, developed jointly with Health Canada and the UK's MHRA, covering the full ML lifecycle: representative training data, rigorous testing, human factors consideration, and monitoring for real-world performance drift. GMLP is not a binding regulation itself but shapes what the FDA expects to see in submissions. See the FDA's AI/ML-based SaMD action plan for the source framework.

Predetermined Change Control Plans (PCCPs): a newer mechanism letting manufacturers pre-specify how a model is allowed to update itself (retraining, recalibration) without triggering a fresh submission every time, a direct response to the fact that ML models drift and improve in ways static devices never did.

The FDA's posture is more case-by-case and precedent-driven than the EU's categorical risk tiers. That flexibility can mean faster approval for well-documented tools, but also more ambiguity for anyone trying to self-assess before talking to the agency.

EMA's reflection paper: the third layer

The EMA doesn't regulate AI generally. Its reflection paper on AI in the medicinal product lifecycle sits on top of the AI Act and applies specifically where AI touches drug development, manufacturing, or pharmacovigilance (safety monitoring after approval).

Distinct EMA expectations include:

• AI used in clinical trial design or patient selection must be explainable enough to support regulatory submissions, a stricter bar than general "human oversight"
• Models used in pharmacovigilance signal detection need validation against known safety signals before regulators trust their outputs
• Sponsors are expected to document AI use in regulatory dossiers even when the AI isn't the medicinal product itself, just a tool used to develop it

This means a CDS model built by a pharma company's R&D arm to help select trial cohorts is doing double duty: it may be high-risk under the AI Act as a health-related AI system, and separately scrutinized by EMA reviewers assessing the trial data package it helped generate.

Reading the same model through three lenses

Take our relapse-prediction model again:

| Question | EU AI Act | FDA | EMA |

|---|---|---|---|

| What triggers scrutiny? | Health-related use case, high-risk classification | Function: diagnose/treat vs. inform | Use within regulated drug lifecycle activity |

| Core requirement | Conformity assessment, documented risk management | Premarket pathway or CDS exemption check | Explainability sufficient for submission review |

| Ongoing obligation | Post-market monitoring, incident reporting | PCCP-governed updates, real-world performance tracking | Validation against safety signal benchmarks |

| Who enforces | National market surveillance authorities | FDA | EMA plus national medicines agencies |

A practical rule of thumb for 2026 deployments: if the model informs clinical decisions and operates anywhere in the EU, assume AI Act high-risk obligations apply by default, then check for exemptions. If it's used in the US for direct patient management, check the CDS exemption criteria literally, wording of the interface (does it show underlying data and let clinicians override) often determines the regulatory bucket more than the model's sophistication. If it touches drug development or safety data anywhere in Europe, add EMA's documentation expectations regardless of AI Act status.

🎬 [VIDEO: "How the EU AI Act Classifies Medical AI" - youtube.com - search for recent explainer content from law firms or regulatory consultancies walking through the Annex III high-risk criteria for health AI]

A minimal technical checklist before deployment

Pre-deployment governance checklist (illustrative, not exhaustive):
[ ] Document intended use and target population explicitly
[ ] Confirm jurisdiction(s) of deployment and map applicable regimes
[ ] Verify human-override capability is real, not cosmetic
[ ] Log training data provenance and known demographic gaps
[ ] Define drift-monitoring thresholds and retraining triggers
[ ] Pre-register update plan if using FDA PCCP pathway
[ ] Prepare explainability documentation for EMA-facing submissions

Key Takeaways

• The same AI model can face three overlapping regimes: the EU AI Act's risk-tier classification, the FDA's device and GMLP-based approach, and EMA's lifecycle-specific reflection paper, so jurisdiction mapping must happen before deployment, not after.
• The EU applies categorical, upfront obligations for high-risk health AI; the US relies more on case-by-case classification (SaMD vs. CDS exemption) plus evolving mechanisms like PCCPs for model updates.
• EMA's expectations are additive, not a substitute for the AI Act. AI used anywhere in drug development or pharmacovigilance in Europe should assume both apply.
• Small interface decisions (does the clinician see the underlying rationale, can they override the output) can determine which US regulatory bucket a tool falls into, often more than model complexity does.
• Building a lightweight, jurisdiction-aware governance checklist before launch is cheaper than retrofitting compliance after a regulator asks questions.