Our Alliances

In March we wrote about preparing for the EU AI Act’s August 2026 deadline. That deadline no longer exists in the form we described. On 27 July 2026 the Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force and moved the high-risk obligations back by more than a year. For healthcare and life sciences organisations building or buying AI, the first reaction will be relief, and some of that relief is warranted. What has not changed is the hiring problem the original deadline exposed, which this article sets out.

Key takeaways

• The obligations for stand-alone high-risk AI systems now apply from 2 December 2027, and for AI embedded in regulated products, including medical devices, from 2 August 2028 (European Commission, 27 July 2026).
• The Article 50 transparency obligations were not deferred and have applied since 2 August 2026, with a short grace period to 2 December 2026 for marking AI-generated content in systems already on the market (Council of the EU, 29 June 2026).
• The delay was granted because organisations were not ready. Readiness is a people problem before it is a documentation problem, and the people are scarce.
• The profile that can carry an organisation to December 2027 combines clinical or scientific credibility, machine learning depth and regulatory fluency. It was hard to find in March; it is no easier now, and every regulated sector is drawing on the same pool. A sixteen-month extension is roughly one senior search plus one year in seat.

What actually changed on 27 July

The Omnibus ran from a Commission proposal in November 2025, through a provisional agreement on 7 May 2026, to the Council’s final adoption on 29 June and publication in the Official Journal on 24 July (White & Case). Three changes matter for anyone hiring AI leadership in healthcare or life sciences.

The first is the calendar. Chapter III obligations for stand-alone high-risk systems on the Annex III list now apply from 2 December 2027. Obligations for AI that is a safety component of a product regulated under existing EU product law, where most clinical AI and AI-enabled medical devices sit, apply from 2 August 2028 (European Commission).

The second is scope. AI systems that only assist users or optimise performance will not automatically be treated as safety components if their failure does not create a health or safety risk (White & Case). At the agreement stage this narrowing was described specifically in the context of medical devices (Gibson Dunn, 27 May 2026). For a hospital group or a diagnostics company that means a real classification exercise: which of the tools already in the estate are now out of the high-risk regime, which remain in it, and who is competent to make and defend that call.

The third is the softening of the AI literacy duty. Article 4 now requires providers and deployers to take measures to support AI literacy among their staff rather than to ensure it (White & Case). That reduces legal exposure, but an organisation still needs people who understand what its systems are doing, and the softer wording does not produce them.

What did not change

The transparency obligations in Article 50 applied on 2 August 2026 as originally scheduled. Any organisation that puts an AI system in front of a patient, a trial participant or an employee, whether a conversational agent, a triage assistant or a tool that generates text or images, has been under a live disclosure duty for six weeks. The only concession was a grace period, cut from six months to three, to 2 December 2026, for marking artificially generated content from systems already on the market (Council of the EU, 29 June 2026). Whether a given clinical deployment falls within Article 50 is a question for counsel. What can be said without counsel is that the patient-facing layer of healthcare AI has been regulated since August, so somebody inside the organisation already needs to own it.

Neither did the substance of the high-risk regime change. Risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness are all still coming. The Omnibus moved the date because the harmonised standards, the Commission’s support tools and, in most cases, the organisations themselves were not ready. The requirements that will apply in 2027 and 2028 are the same requirements that were due this August.

Why the delay makes the hiring problem worse, not better

A visible deadline forces a decision. Between January and July, boards in regulated sectors across Europe were deciding who would own AI compliance, and many concluded that the answer was a senior hire rather than a committee. The delay removes that forcing function without removing the competition: financial services, employment, education, critical infrastructure and every product sector with embedded AI have the same new dates and the same shortage. The organisations that hired over the summer have their leader in seat. The ones that paused will re-enter the market in 2027 at the same time as each other.

There is a second-order effect. Systems placed on the market before the new application dates are treated differently from those placed after them, subject to an undefined test of substantial modification (White & Case). In our reading, which is inference rather than legal advice, that gives vendors a reason to place systems on the market before the date, so more systems reach production sooner and each of them needs a competent owner. If that reading is right, the delay increases demand for AI governance leadership in healthcare rather than deferring it.

The US shows what that demand looks like once it is institutionalised. In August, Becker’s identified twenty major health systems, among them Mayo Clinic, Cleveland Clinic, Kaiser Permanente and UCSF Health, with a dedicated AI leader under titles from Chief AI Officer and Chief Health AI Officer to Chief Data and AI Officer (Becker’s Hospital Review, 5 August 2026). Those roles follow scale: a survey in March found three quarters of US health systems using at least one AI application, up from 59% a year earlier (Fierce Healthcare, 24 March 2026). European providers and life sciences companies face the same logic, with a regulator writing the job description for them.

Two smaller changes with hiring consequences

Two provisions have had less coverage than the dates but bear directly on who an organisation needs. The first is supervision. The Omnibus expands the role of the EU AI Office, giving it competence over AI systems built on general-purpose AI models and over systems integrated into very large online platforms (White & Case); the political agreement in May described this as exclusive competence for GPAI-based systems (Gibson Dunn, 27 May 2026). A growing share of clinical documentation, triage and patient-communication tools are built on general-purpose models, so for a health system or a digital-health company the supervisor of record for those tools will be an EU body in Brussels rather than, or as well as, a national authority. The person leading AI governance needs to be comfortable dealing with it.

The second is proportionality. Measures previously reserved for small and medium-sized enterprises, including simplified documentation and proportionate quality-management obligations, are extended to small mid-cap companies (European Commission, 27 July 2026). That matters for the mid-sized diagnostics, medtech and health-data businesses that make up much of the European healthcare AI market: their compliance function can be lighter than a multinational’s, but it cannot be absent, and a lighter function concentrates more of the judgement in one senior person. In practice that raises, rather than lowers, the bar for the individual in the seat.

The profile, revisited

We described in February how a healthcare AI leadership team should be sequenced, and in May why the leaders who take AI from pilot to production differ from the ones who run the pilots. The Omnibus sharpens both arguments. The person who owns the December 2027 date needs three things that rarely coexist: enough clinical or scientific standing to be believed by a chief medical officer, a head of R&D or a notified body when they say a system is or is not a safety component; enough machine learning depth to interrogate a vendor’s claims about accuracy, drift and monitoring rather than accept a conformity assessment at face value; and regulatory fluency across the AI Act, the Medical Device and In Vitro Diagnostic Regulations, GDPR and, for anyone touching the UK, the MHRA’s separate track, because the classification exercise the Omnibus demands sits at the intersection of all of them.

Over 25 years of building data science and AI teams, Fergal Nolan’s experience is that people with all three are not found by advertising a role and waiting. They are identified by name, usually already employed, often outside the obvious pools, and moved by a mandate rather than a package. That is why we run these as retained searches rather than contingent ones, and why we would start now rather than in 2027.

What a board should do this quarter

Re-run the AI inventory that the original deadline prompted, this time against the narrowed safety-component test. The output should be a list of systems, their new application dates and a named owner for each; any gap in the owner column is the hiring brief.

Separate the Article 50 work from the Chapter III work. The transparency duty is live; assign it now, even as an interim responsibility, with 2 December 2026 as the date for content marking.

Decide who carries the organisation to December 2027 and hire them in the next two quarters rather than the last two. A sixteen-month extension used well produces a leader who has completed a full risk-management cycle and built the governance function before the obligations apply. Used badly, it produces the same scramble a year later. If you are a life sciences company with AI in a regulated product, your date is August 2028, but the people who understand AI governance in regulated environments are the same people everyone else needs, and they are not waiting until then.

If you want a second view on the leadership question, talk to us. Our work sits in machine learning, AI and data leadership for healthcare and life sciences, and the searches we are running now are, almost without exception, shaped by this regulation.

Fergal Nolan is the founder of Banba, a specialist executive search firm for Healthcare AI and Life Sciences AI, with offices in New York, London and Berlin. He has spent more than 25 years in talent acquisition, including as a founding team member at SThree / Real Staffing and as founder of Upstream, where he has built Data Science & AI teams and AI leaders for start-ups, scale-ups and global enterprises.