Does the EU AI Act apply to AI used in pharmaceutical manufacturing and quality?

1What the AI Act covers.

The AI Act, Regulation (EU) 2024/1689, entered into force on 1 August 2024 and has applied since 2 August 2026, with earlier and later dates for some parts.¹² It applies to providers that place AI systems on the EU market or put them into service, wherever they are established; to deployers established or located in the EU; and to providers and deployers in third countries “where the output produced by the AI system is used in the Union”.³

A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer is anyone “using an AI system under its authority”, other than in a personal non-professional activity.⁴ A pharmaceutical company that uses a vendor’s AI tool is a deployer; one that builds its own AI system and puts it into service under its own name is a provider.

The Act does not apply to AI systems or models, including their output, “specifically developed and put into service for the sole purpose of scientific research and development”, nor to research, testing and development before a system is placed on the market or put into service. Testing in real-world conditions is not covered by that exclusion.³

2When an AI system is high-risk.

The Act’s strictest obligations, from risk management and data quality to logging and human oversight, fall on high-risk systems.¹ There are two routes to that status.⁵

The first is product law. An AI system is high-risk if it is a product, or a safety component of a product, covered by the legislation listed in Annex I, and that product needs a third-party conformity assessment.⁵ Annex I includes the Medical Devices Regulation (EU) 2017/745 and the In Vitro Diagnostic Medical Devices Regulation (EU) 2017/746. It does not list EU medicinal products legislation.⁶ The AI Omnibus added Article 6(1a), which says that AI systems “solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control shall not qualify as safety components”, unless their failure or malfunction would endanger health and safety.⁵

The second is Annex III, a list of uses in eight areas: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and border control, and the administration of justice and democratic processes. Pharmaceutical manufacturing and quality are not among them. Employment is: AI used to recruit people, or to “monitor and evaluate the performance and behaviour of persons” at work, is high-risk.⁷ An Annex III system is not high-risk where it poses no significant risk of harm, for example because it performs a narrow procedural task, unless it profiles natural persons.⁵ The Commission’s guidelines on classifying high-risk systems are still a draft; their consultation closed on 23 July 2026.⁸

3What applies to a pharmaceutical company, and when.

4What the AI Omnibus changed.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, is dated 8 July 2026, was published in the Official Journal on 24 July and entered into force on 27 July 2026.¹³¹⁴ It moved the high-risk dates to 2 December 2027 for Annex III uses and 2 August 2028 for AI in Annex I products.² It rewrote Article 4, so that providers and deployers “shall take measures to support the development of AI literacy” of their staff, a duty that “does not require providers or deployers to guarantee any specific level of AI literacy of any individual”.⁹ It also lets the Commission limit some high-risk requirements where legislation in Annex I Section A, which includes the device regulations, already gives equivalent or higher protection, through delegated acts due by 2 August 2027.³ And it moved the Machinery Regulation (EU) 2023/1230 from Section A to Section B of Annex I, so that for high-risk AI in machinery only Article 6(1), Article 60a and Articles 102 to 112 of the Act apply, with the AI requirements to be built into the machinery rules instead.¹³⁶³

5How the AI Act sits beside GMP.

The AI Act does not replace GMP. EMA’s reflection paper on AI in the medicinal product lifecycle, adopted in September 2024, says it should be read alongside EU legislation on AI, “including the AI act”, and medicines regulation. It makes the manufacturer responsible for ensuring that “all algorithms, models, datasets, and data processing pipelines used are fit for purpose” under EU legislation, GxP standards and EMA guidelines. For AI in manufacturing it points to quality risk management and ICH Q8, Q9 and Q10, “awaiting revision of current regulatory requirements and GMP standards”.¹⁵

Part of that revision is the draft Annex 22, published for consultation in July 2025.¹⁶ It uses the same definition of an AI system as Article 3(1) of the AI Act. Its scope is set by GMP impact: AI models used in critical applications “with direct impact on patient safety, product quality or data integrity”. It says generative AI and large language models should not be used in them.¹⁷⁴ Annex 22 is still a draft. An HPRA inspector said in May 2026 that it was under revision, with further focused consultations planned for 2026.¹⁸

6How it runs in Seal.

Neil, Seal’s AI agent, drafts and proposes; people sign, approve and release. As the regulatory overview sets out, Neil is not used in GMP execution: it helps set up configuration that your team verifies and releases under change control. Under Seal’s agreements, customer data is not used to train the underlying AI models.

For a deployment review, the validation and AI assurance guide covers where AI processing happens, what is sent to the model and retained, the evidence to keep for an AI-assisted decision and how a change of model is assessed. AI can be limited or switched off for the organisation.