News 13.08.2026 AI governance is becoming hospital governance: what the EU AI Act means for hospital leaders now

The EU AI Act entered a new implementation phase on 2 August 2026. For hospitals, the immediate priority is not simply legal compliance: it is establishing the governance needed to adopt AI safely, transparently and with clear accountability.

European Union | 14 August 2026

On 2 August 2026, the European Union Artificial Intelligence Act moved into a new phase. The transparency obligations under Article 50 became applicable, national authorities assumed broader supervisory responsibilities, and the European AI Office entered a new stage of enforcement.

Only days earlier, on 27 July 2026, the AI Omnibus entered into force, extending the timetable for high-risk AI requirements and introducing several simplifications.

For hospital leaders, the message should be neither panic nor postponement.

Hospitals are already using AI in areas that affect patients, professionals and organisational decisions: diagnostic support, clinical documentation, triage, workforce management, bed planning, procurement, patient communication and administrative workflows.

What already applies?

Several relevant parts of the AI Act are already applicable.

Prohibited practices

Certain prohibited practices have been banned since February 2025. These include harmful manipulation, social scoring and, subject to limited exceptions for medical or safety purposes, emotion recognition in the workplace.

Hospitals should ensure that experimental systems, human-resources tools and staff-monitoring applications do not introduce prohibited capabilities.

AI literacy

The AI literacy obligation has also applied since February 2025. Following the AI Omnibus, providers and deployers must still take measures to support AI literacy, but the legislation does not prescribe a uniform level or a single mandatory training format. The appropriate approach depends on the system, its users, the context and the risks involved.

For hospitals, a generic online course will rarely be enough. Clinical professionals using diagnostic support, procurement teams buying AI services, communication teams using generative AI and staff responsible for human oversight require different knowledge and guidance.

Transparency

Since 2 August 2026, Article 50 transparency obligations apply to certain interactive and generative AI systems, deepfakes, emotion-recognition tools and biometric-categorisation systems.

An exception may apply to public-interest text that has undergone meaningful human review or editorial control and for which a person or organisation assumes editorial responsibility.

Hospitals should translate these requirements into practical decisions. Does a patient chatbot identify itself clearly? Is a synthetic voice used in patient communication disclosed? Are AI-generated images or videos appropriately labelled? Is public-facing health information subject to real editorial review rather than a superficial approval?

Not every hospital AI system is high-risk

The classification depends on the intended purpose of the system, its effect on decisions and, in some cases, its classification under other EU product legislation.

An AI system may be high-risk when it is itself a medical device, or a safety component of a medical device, and the relevant product requires third-party conformity assessment. AI-based medical software can therefore be high-risk, but not every digital or AI tool used in a clinical environment automatically falls into this category.

The AI Act also identifies specific high-risk uses outside medical-device regulation. Hospital-relevant examples may include:

• AI used to evaluate or classify emergency calls, determine dispatch priorities or support emergency healthcare patient triage;
• systems used by public authorities to determine eligibility for essential public services, including certain healthcare services;
• AI used for recruitment, candidate selection, task allocation, performance monitoring or other significant employment decisions;
• certain biometric, emotion-recognition and critical-infrastructure applications, where they are not prohibited.

Some systems listed in Annex III may be exempted from high-risk classification when they do not pose a significant risk and do not materially influence a decision. This requires a documented, case-specific assessment. Systems that profile individuals receive stricter treatment.

Hospitals are usually deployers — but not always

A hospital that purchases and uses an AI system will generally be a deployer under the AI Act. The technology supplier will generally be the provider.

That distinction should not be taken for granted.

A hospital may assume provider responsibilities if it develops a system internally, places its own name or trademark on a system, makes a substantial modification or changes the intended purpose of an existing system. Customising a general-purpose model for a clinical or operational application can also create additional responsibilities.

Procurement and innovation teams should determine the hospital’s legal role before implementation, not after a problem occurs.

A practical 90-day agenda for hospital leaders

1. Map the AI already in use

For every use case, the hospital should record the system and supplier, the internal owner, its intended purpose, who uses it, who is affected, the data processed, whether it informs or makes decisions, the consequences of error and its preliminary AI Act category.

The inventory must include “shadow AI”: public tools used without formal approval to summarise records, draft clinical correspondence, translate documents or analyse internal information.

2. Strengthen procurement and contracting

Procurement documentation and contracts should address:

• intended purpose and AI Act classification;
• the respective responsibilities of the provider and hospital;
• conformity status and supporting documentation;
• evidence of performance, limitations and performance across relevant patient groups;
• data governance, confidentiality and cybersecurity;
• model updates, subcontractors and change notification;
• incident reporting and cooperation;
• audit, access, data-return, portability and termination rights.

3. Make human oversight operational

Human oversight should not be reduced to the presence of a professional somewhere in the workflow. The hospital should define who is responsible, what information that person receives and whether they have sufficient competence, time and authority to challenge the output.

Staff should know when an AI recommendation must be disregarded, how to intervene or stop the system, how overrides are documented and how automation bias will be addressed.

4. Monitor performance after implementation

Monitoring should cover more than technical availability. Hospitals should track clinical performance, false positives and negatives, subgroup differences, complaints, overrides, unexpected use, cybersecurity events, model changes and signs of performance drift.

Safety, quality, data protection and cybersecurity processes should connect to a single escalation route rather than operate in separate organisational silos.

The implementation timetable

The AI Omnibus provides additional preparation time, particularly for high-risk systems:

The extended deadlines should be treated as an implementation runway. Hospitals need time to classify systems, renegotiate contracts, establish assessment processes, collect evidence, train staff and integrate monitoring into clinical and corporate governance.

Public bodies and private organisations providing public services may also need to conduct a fundamental-rights impact assessment before deploying certain high-risk systems. Where a data-protection impact assessment is also required, the two assessments should be coordinated.

From compliance to trust

AI can improve diagnosis, reduce administrative burden, support workforce planning and help hospitals use scarce resources more effectively. But value will not result from procurement alone.

Trustworthy adoption requires clear purpose, appropriate evidence, competent professionals, human accountability and continuous monitoring.

The most important first step is also the simplest: know where AI is already being used and who is responsible for it.

This article reflects the EU implementation position in August 2026 and provides general information, not legal advice. Healthcare organisations should consider applicable national legislation and obtain case-specific advice where necessary.