The European Union has reached an important milestone in the regulation of artificial intelligence.
From 2 August 2026, the European Commission’s AI Office, together with national competent authorities, has begun enforcing relevant provisions of the EU Artificial Intelligence Act. At the same time, important new transparency requirements for certain AI systems have become applicable.
For pharmaceutical companies, this development deserves attention even though the AI Act is not a GMP regulation.
As artificial intelligence becomes increasingly embedded in pharmaceutical manufacturing, quality systems, regulatory affairs, medical information, pharmacovigilance and other business processes, companies may need to manage two parallel regulatory layers:
AI regulation and pharmaceutical/GxP regulation.
Compliance with one does not automatically demonstrate compliance with the other.
What Changed on 2 August 2026?
The European Commission confirmed that from 2 August the AI Office and national authorities started enforcement of the AI Act.
The same date also marked the application of transparency obligations under Article 50 of the Act. These requirements apply to defined categories of AI systems and are intended to make it clear when individuals interact with AI or encounter AI-generated or manipulated content.
For example, certain interactive AI systems such as chatbots must inform users that they are interacting with AI rather than a human.
The rules also introduce requirements concerning machine-readable marking of certain AI-generated or manipulated content and disclosure requirements for areas such as deepfakes and specified AI-generated content.
These obligations can be relevant to pharmaceutical companies operating public-facing AI applications, including potentially:
- patient or healthcare-professional chatbots;
- automated medical-information interfaces;
- AI-supported customer-service systems;
- externally published AI-generated material;
- interactive digital-health applications.
The precise obligation depends on the role of the company, the AI system and its intended use.
General-Purpose AI Is Also Entering a More Serious Enforcement Phase
There is another important change.
Obligations for providers of general-purpose AI (GPAI) models have applied since August 2025. However, from 2 August 2026, the European Commission’s enforcement powers concerning these obligations became applicable, including the possibility of fines.
This primarily affects companies that provide general-purpose AI models rather than ordinary users of commercially available LLM services.
Nevertheless, pharmaceutical companies should understand where they sit in the AI value chain.
A company using a third-party foundation model will normally be in a very different regulatory position from the original model provider. However, sufficiently significant modifications of a model may affect whether an organisation itself becomes a provider under the AI Act.
This distinction may become increasingly relevant as pharmaceutical companies move from simply using commercial AI services toward fine-tuning, adapting or integrating models into proprietary systems.
Why This Matters for GMP
The EU AI Act and GMP answer different regulatory questions.
The AI Act primarily addresses risks associated with placing AI systems and models on the European market and using them in the EU.
GMP, by contrast, asks whether a system used in pharmaceutical operations is suitable and controlled for its intended GxP use and whether product quality, patient safety and data integrity are protected.
A pharmaceutical company could therefore theoretically have an AI system that meets applicable AI Act requirements but is still unsuitable for a critical GMP process.
The reverse is also possible: a technically well-validated internal GxP application may still need assessment against applicable AI Act obligations.
This creates a new governance challenge.
Instead of asking only:
“Is this AI validated?”
pharmaceutical companies increasingly need to ask:
“Which regulatory frameworks apply to this particular AI use case, and what evidence is required under each?”
One AI Inventory – Several Regulatory Assessments
A practical consequence is that pharmaceutical companies should avoid maintaining completely separate inventories for AI Act compliance, IT governance and GxP validation.
A single corporate AI inventory can identify, for every AI use case:
- intended use;
- system owner;
- provider and underlying model;
- users and affected persons;
- GxP relevance;
- potential impact on product quality and patient safety;
- company role under the AI Act;
- applicable transparency requirements;
- level of human oversight;
- model version and configuration;
- third-party dependencies;
- required validation or qualification;
- lifecycle monitoring and change-control requirements.
This provides a common starting point from which Legal, Quality, IT, Data Privacy, Cybersecurity and business functions can perform their respective assessments.
Supplier Governance May Become Even More Important
Most pharmaceutical companies will not build frontier AI models themselves. They will increasingly rely on external providers.
This makes supplier governance critical.
For GxP-relevant AI, pharmaceutical companies may need sufficient information to understand matters such as:
- which model and version are being used;
- when the model changes;
- known limitations;
- security controls;
- data handling;
- retention of prompts and outputs;
- auditability;
- availability of technical documentation;
- incident notification;
- mechanisms for monitoring performance.
The AI Act strengthens regulatory attention to transparency throughout the AI value chain. For pharmaceutical Quality organisations, this reinforces a familiar GMP principle:
An outsourced technology does not outsource the regulated company’s responsibility for its intended use.
Important: The AI Act Is Not Fully Applicable All at Once
The 2 August 2026 milestone should not be interpreted as meaning that every requirement of the AI Act suddenly became applicable to every AI system.
The Act follows a phased implementation timetable, and requirements depend on the type of system, the role of the organisation and the relevant provision.
Companies should therefore avoid simplistic statements such as:
“All AI systems must now comply with the full AI Act.”
Instead, each use case should be classified against the applicable provisions and implementation dates.
What Pharmaceutical Companies Should Do Now
For organisations already implementing AI, seven actions appear particularly useful:
- Maintain a controlled inventory of AI use cases.
- Determine the organisation’s regulatory role for each system.
- Identify whether Article 50 transparency requirements apply.
- Separately determine whether the use case is GxP-relevant.
- Define supplier, model-version and change-control requirements.
- Document human oversight and accountability.
- Maintain evidence demonstrating both regulatory classification and ongoing control.
The central lesson is that AI governance in pharma can no longer be treated solely as an IT or innovation activity.
As AI regulation matures alongside emerging pharmaceutical-specific guidance, companies will need an integrated governance model connecting:
AI regulation + GMP + data integrity + cybersecurity + privacy + supplier management + quality risk management.
For pharmaceutical organisations operating in Europe, 2 August 2026 is therefore more than another AI Act implementation date.
It marks the transition from preparation toward active regulatory enforcement.
Sources
European Commission – Commission starts enforcing AI Act rules and new transparency requirements on 2 August:
https://digital-stra … equirements-2-august
European Commission – Guidelines on transparency obligations for providers and deployers of AI systems:
https://digital-stra … deployers-ai-systems
European Commission – Guidelines for providers of general-purpose AI models: