All posts
Aniva
11
 min read

Diagnostics as a Service and the EU AI Act: which deadlines apply to a blood test product

The July 2026 regulation changed most of the AI Act dates, and a diagnostic product is almost always on the later of the two. Here is when each date applies, why the low-risk exception is closed on that route, and why the safe assumption is that the full duties apply.
Blog post cover image
Written by
Robert Jakobson
Published on
October 2, 2026

Somewhere between the kit and the result the customer reads, a Diagnostics as a Service product runs software that makes a judgement. Where that software meets the Act's own definition of an AI system, the EU AI Act applies to it. When it applies is the harder question, because in July 2026 the European Parliament and the Council changed the two deadlines that decide it for most systems.

This article gives the dates as they now stand. It then works out which of the two routes into the high-risk class a diagnostic product is on, and ends with the one question that is still open. Every date below comes from the regulation texts on EUR-Lex rather than from a summary of them.

Which dates did the new regulation change?

The two deadlines for high-risk AI systems. Both were moved by Regulation (EU) 2026/1744, called the Digital Omnibus on AI. That regulation was adopted on 8 July 2026, published on 24 July 2026 and entered into force on 27 July 2026.1

Which of the two deadlines applies depends on why a system is high risk. A system that is high risk because of what it is used for now has until 2 December 2027. A system that is high risk because it is part of a product the EU already regulates has until 2 August 2028.2

Two other dates did not change at all, because they concern general-purpose AI models rather than high-risk systems. Those models have been covered since 2 August 2025. A model that was already on the market by then has until 2 August 2027 to comply.3

What already applies?

More of the law than the two high-risk deadlines suggest, starting with the bans. The bans in Article 5 have applied since 2 February 2025, and two further bans, on intimate imagery made without consent and on child sexual abuse material, apply from 2 December 2026.4

The transparency duty in Article 50 has applied since 2 August 2026. A system that generates synthetic audio, image, video or text and was already on the market before that date has until 2 December 2026 to meet the machine-readable marking requirement in Article 50(2).5

The AI literacy duty in Article 4 has applied since 2 February 2025, but its wording changed in July 2026. It now asks providers and deployers to take measures to support AI literacy among their staff. It also says plainly that they do not have to guarantee any particular level in any individual.6

The dates as they now stand The dates under the EU AI Act after July 2026. The bans and the AI literacy duty have applied since 2 February 2025. General-purpose AI models have been covered since 2 August 2025. The transparency duty has applied since 2 August 2026. Two further bans and the marking deadline for existing systems fall on 2 December 2026. High risk by use case begins on 2 December 2027, and high risk inside a regulated product on 2 August 2028. The dates as they now stand The EU AI Act after the changes made in July 2026. The last two dates are the ones that changed. 2 February 2025 The bans in Article 5, and the duty to support AI literacy in Article 4. 2 August 2025 General-purpose AI models. 2 August 2026 The transparency duty in Article 50. 2 December 2026 Two further bans, and the deadline for marking output from systems already on the market. 2 December 2027 High risk because of what the system is used for. 2 August 2028 High risk because the system is part of a product the EU already regulates. Sources: Regulation (EU) 2024/1689, Article 113 and Article 111, in the version consolidated on 27 July 2026, and Regulation (EU) 2026/1744, the Digital Omnibus on AI, published in the Official Journal on 24 July 2026.

The bans and the AI literacy duty have applied since 2 February 2025, general-purpose AI models since 2 August 2025, and the transparency duty since 2 August 2026. Two further bans and the marking deadline for existing systems fall on 2 December 2026. The two dates that changed in July 2026 are 2 December 2027 for high risk by use case and 2 August 2028 for high risk inside a regulated product. Sources: Regulation (EU) 2024/1689, Articles 111 and 113, consolidated 27 July 2026, and Regulation (EU) 2026/1744, Official Journal 24 July 2026.

Which route is a diagnostic product on?

The route through product law rather than the route through the use-case list. An AI system is high risk under Article 6(1) where it is a safety component of a product, or is itself a product, covered by one of the EU product laws listed in Annex I. A second condition applies as well. The product has to be one that needs a conformity assessment by a third party.7

The first condition is met, because the laws in Annex I include the In Vitro Diagnostic Regulation.7 Whether a given blood test product is on that route therefore turns on the second condition, the third-party assessment.

That condition is easy to mistake for a limit on the high-risk class. For in vitro diagnostics it is not one. A device in class B, C or D needs a notified body. Only a class A device that is not sterile can be declared conform by the manufacturer alone.8

On that wording a blood test product whose AI affects safety is on the Annex I route, with the 2 August 2028 date rather than the 2 December 2027 one. That is our reading of the two texts together. A notified body is the body that settles it for a given device.

The routes into high risk The two routes into the high-risk class, as we read Article 6. A system is high risk by use case if it appears in Annex III, which begins on 2 December 2027 and allows the Article 6 paragraph 3 exception. A system is high risk as part of a regulated product if the product law is listed in Annex I and the product needs a third party, which begins on 2 August 2028 and allows no such exception. Under the In Vitro Diagnostic Regulation only a class A device that is not sterile can be declared conform by the manufacturer alone, which is why we read a blood test product onto the second route. The routes into high risk Which of the two applies decides the date, and decides whether the low-risk exception is available at all. Because of what it does The system appears in the use-case list in Annex III, such as pricing for life and health insurance. 2 December 2027 The Article 6(3) exception is open. Because of what it is part of The system is a safety component of a product covered by a law in Annex I, and that product needs a third party. 2 August 2028 No such exception. On our reading a blood test product is on the second route Under the In Vitro Diagnostic Regulation, only a class A device that is not sterile can be declared conform by the manufacturer alone. Classes B, C and D all need a notified body. Sources: Regulation (EU) 2024/1689, Articles 6 and 113 and Annexes I and III, in the version consolidated on 27 July 2026, and Regulation (EU) 2017/746, Article 48, in the version consolidated on 10 January 2025.

A system is high risk by use case if it appears in Annex III, which begins on 2 December 2027 and leaves the Article 6(3) exception open. A system is high risk as part of a regulated product if the product law is in Annex I and the product needs a third party, which begins on 2 August 2028 and allows no such exception. Under the In Vitro Diagnostic Regulation, only a class A device that is not sterile can be declared conform by the manufacturer alone. Sources: Regulation (EU) 2024/1689, Articles 6 and 113 and Annexes I and III, consolidated 27 July 2026; Regulation (EU) 2017/746, Article 48, consolidated 10 January 2025.

An amendment that narrows the third-party condition, and why it does not help

The July 2026 regulation did narrow the third-party condition, so it is worth checking whether the narrowing helps a blood test product. It does not, for the following reason. Under the amendment, a product that needs a third-party assessment only because of risks other than health and safety, such as radio interference, no longer meets the condition. An in vitro diagnostic assessment is about health and safety, so as we read Article 6(1c) the narrowing changes nothing for a blood test product.9

Can you use the low-risk exception?

Not on the route through product law, as we read the wording. Article 6(3) lets a provider treat a system as not high risk where it does not pose a significant risk. That exception is written as an exception to Article 6(2), though, which is the use-case list rather than the product route.10

No regulator has published a statement confirming that reading.

For the systems that can use the exception, the July 2026 regulation did make one thing easier. It removed two of the items a provider has to file when registering a system it has declared not high risk. The provider must still document the assessment behind the declaration before the system is placed on the market.10

Does the AI Act cover selling to insurers?

Yes, through the use-case route rather than the product one. Annex III point 5(c) covers AI used for risk assessment and pricing for people in life and health insurance.11

Because that is the use-case route, the date is 2 December 2027 and the Article 6(3) exception is available. Where test results are supplied into an insurer's pricing model, the obligation under that point belongs to the insurer that runs the model rather than to the supplier of the results. That is our reading of the point. What an insurer then asks its supplier about is the data behind the results.

What is still open?

One thing, and it may never be settled, because it depends on an act the Commission has not yet adopted. The July 2026 regulation added Article 2(13), which lets the Commission limit how far Articles 9 to 15 and 17 to 25 apply to a product-route system, where the product law already gives an equal or higher level of protection.12

Those articles matter for a diagnostic product because they cover risk management, data governance and the technical file. They also cover the logging you keep, the human oversight you build in and the quality system behind it. Much of that already exists under the In Vitro Diagnostic Regulation, which is why the overlap is worth limiting.

Whether it will be limited depends on the Commission. It has until 2 August 2027 to adopt the delegated acts that would set the limit, and it has to issue guidelines by 1 August 2027.12

What a Diagnostics as a Service provider should plan for

Plan as though the Commission publishes nothing, because no limit exists today and none may ever be granted. Unless and until those delegated acts are published, the full set of duties applies from 2 August 2028.12

What is still undecided What is still undecided about how much of the AI Act a diagnostic product will have to meet. Article 2 paragraph 13, added in July 2026, lets the Commission limit how far Articles 9 to 15 and 17 to 25 apply to a product-route system where the product law already gives an equal or higher level of protection. The Commission's guidelines are due by 1 August 2027 and its delegated acts by 2 August 2027. The rules for this route begin on 2 August 2028. Until the Commission publishes these acts, the full duties apply. What is still undecided How much of the AI Act a diagnostic product will actually have to meet is not settled yet. Article 2(13), added in July 2026 The Commission may limit how far Articles 9 to 15 and 17 to 25 apply to a product-route system, where the product law already gives an equal or higher level of protection. Until the Commission publishes these, the full duties apply. Plan for them rather than for the limit. What has to happen first 1 August 2027 Commission guidelines are due. 2 August 2027 The delegated acts that set the limit are due. 2 August 2028 The rules begin for this route. Source: Regulation (EU) 2024/1689, Article 2(13) and Article 96(1)(g), as inserted or amended by Regulation (EU) 2026/1744, in the version consolidated on 27 July 2026. None of these acts had been published when this article was written.

Article 2(13) lets the Commission limit how far Articles 9 to 15 and 17 to 25 apply where the product law already gives an equal or higher level of protection. The guidelines are due by 1 August 2027 and the delegated acts by 2 August 2027, and the rules for this route begin on 2 August 2028. Until the Commission publishes these, the full duties apply. Source: Regulation (EU) 2024/1689, Articles 2(13) and 96(1)(g), as inserted or amended by Regulation (EU) 2026/1744, consolidated 27 July 2026. None of these acts had been published when this article was written.

What are the fines?

There are three tiers, with caps on what smaller firms can be fined. A banned practice is up to 35 million euro or 7 percent of worldwide annual turnover, whichever is higher. Most other breaches are up to 15 million euro or 3 percent.13

The third tier is 7.5 million euro or 1 percent. It applies to giving a notified body or an authority information that is incorrect or misleading.13

The caps are the part the July 2026 regulation changed. It added a cap on fines for small mid-cap firms, to match the one small firms already had.13

What to ask a Diagnostics as a Service supplier

The dates and routes above turn into four questions for a supplier. Listen for whether each answer comes from the law or from a summary of it.

  • Which parts of the product use AI, and which of those change a result?
  • Does the device need a notified body, and for which class?
  • What is the Article 6 classification, and where is the reasoning written down?
  • What happens to the overlap if the Commission's delegated acts change it in 2027?

Only the last one has no answer in any published text. What you are listening for there is whether the supplier says so.

Where Aniva is on this

The delegated acts that would set the overlap are not published. Until they are, no supplier's classification under Article 2(13) can be called settled.

What can be said is how the service is put together. One supplier covers the ordering, the kits, the collection, the accredited laboratory work and the results interface, on a single contract. The collection runs on Aniva's own network rather than a subcontracted one. The customer sees the partner's name rather than ours.

Book a demo if you want to go through how the routes and dates above apply to a blood test product.

Notes and sources

  1. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230, the Digital Omnibus on AI. Published in the Official Journal L series on 24 July 2026. Article 4 states that it enters into force on the third day following publication, which is 27 July 2026. eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
  2. Regulation (EU) 2026/1744, Article 1(40)(b), replacing Article 113 third paragraph point (c): Chapter III Sections 1, 2 and 3 apply from "2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III" and from "2 August 2028 as regards AI systems classified as high-risk pursuant to Article 6(1) and Annex I". Article 6(5) is carved out of the delay. eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
  3. Regulation (EU) 2024/1689, Article 113 third paragraph point (b) and Article 111(3), neither amended in July 2026. Consolidated text at 27 July 2026. eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27
  4. Regulation (EU) 2024/1689, Article 113 third paragraph point (a) as replaced in July 2026: Chapters I and II apply from 2 February 2025, "with the exception of Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b) which shall apply from 2 December 2026". eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
  5. Regulation (EU) 2024/1689, Article 113 second paragraph, and Article 111(4) inserted by Regulation (EU) 2026/1744 Article 1(39)(b), which gives providers of systems placed on the market before 2 August 2026 until 2 December 2026 to comply with Article 50(2). The other paragraphs of Article 50 apply in full from 2 August 2026. eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27
  6. Regulation (EU) 2024/1689, Article 4 as replaced by Regulation (EU) 2026/1744: providers and deployers "shall take measures to support the development of AI literacy of their staff", and "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual". eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
  7. Regulation (EU) 2024/1689, Article 6(1), and Annex I Section A point 12, which lists Regulation (EU) 2017/746 on in vitro diagnostic medical devices. Article 6(1) requires both that the AI system is a safety component of, or is itself, a product covered by that legislation, and that the product "is required to undergo a third-party conformity assessment". Consolidated text at 27 July 2026. eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27
  8. Regulation (EU) 2017/746, Article 48. Paragraph 10 lets manufacturers of class A devices issue the declaration of conformity themselves, with an exception for devices placed on the market in sterile condition. Paragraphs 3 to 9 require a notified body for classes B, C and D. Consolidated text at 10 January 2025. eur-lex.europa.eu/eli/reg/2017/746/2025-01-10
  9. Regulation (EU) 2024/1689, Article 6(1c), inserted by Regulation (EU) 2026/1744 Article 1(8): a product required to undergo third-party assessment "solely due to risks other than risks to health and safety, in particular risks relating to the distribution of radio spectrum or electromagnetic interference" does not meet the condition. eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27
  10. Regulation (EU) 2024/1689, Article 6(3), which is written as a derogation from Article 6(2) and so reaches only Annex III systems. Regulation (EU) 2026/1744 Article 1(42) deleted points 7 and 9 of Annex VIII Section B, and recital 22 states that a provider applying Article 6(3) "remains obligated to document its assessment" before the system is placed on the market. eur-lex.europa.eu/eli/reg/2026/1744/oj/eng
  11. Regulation (EU) 2024/1689, Annex III point 5(c), which covers "AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance". Annex III was not amended in July 2026. eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
  12. Regulation (EU) 2024/1689, Article 2(13), inserted by Regulation (EU) 2026/1744 Article 1(3). It allows the application of Articles 9 to 15 and 17 to 25 to be limited where Annex I Section A legislation lays down requirements "providing an equivalent or higher level of protection", and requires the Commission to adopt delegated acts specifying the scope by 2 August 2027. Article 96(1)(g) requires guidelines by 1 August 2027. eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27
  13. Regulation (EU) 2024/1689, Article 99(3), (4), (5), (6) and (6a). The third tier of up to 7.5 million euro or 1 percent covers the supply of incorrect, incomplete or misleading information to notified bodies or national competent authorities, and paragraph (6a), added in July 2026, caps fines for small mid-cap enterprises. Consolidated text at 27 July 2026. eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27

This article summarises the published text of the EU AI Act as it stood on 21 September 2026. It is general information rather than legal advice, and the classification of any particular product is a question for your own adviser.

Add blood testing to your business

Aniva provides the labs, the test kits, the shipping, the software and the data protection paperwork. You offer blood tests under your own brand. Tell us which tests you need and we will show you how it works.

Book a Demo

Your future self is waiting

Start building the healthiest decade of your life.

Join today
Membership
BiomarkersLocationsPricingInsurance (PKV)FAQs
Aniva For
Diagnostics as a ServiceCorporate WellnessLocation PartnersDeveloper APIDevelopersStartupsPractitionersLocation Partners
Legal & Safety
ImprintPrivacy PolicyTerms of ServicePartner & Process Integrity
Resources
CustomersBlogNewsletterBlood Test GlossaryPharmacy GlossaryAniva API Introduction
Ask if Aniva is right for you
Social
© Aniva Health 2026