EU AI Act Governance & Article 50: A Practical Guide for Pharma

Moving from AI policies to practical governance, transparency and accountability.

Artificial intelligence now runs through pharmaceutical operations: medical content, promotional review, patient-support chatbots, clinical workflows and digital health services. Using it responsibly takes more than choosing the right tools. It takes clear accountability, proportionate risk controls, human oversight and transparency. The EU AI Act provides the framework. Article 50 sets transparency duties for certain AI systems, applicable since 2 August 2026.

At a glance: Article 50 applies now. A narrow transition for the machine-readable marking duty under Article 50(2) ends on 2 December 2026 for relevant systems placed on the market before 2 August 2026. It is not a general extension for all Article 50 duties.

Key dates

Date	Milestone
2 February 2025	The original prohibited practices and AI literacy provisions began to apply.
2 August 2025	General-purpose AI model rules and governance provisions began to apply, subject to applicable transitional arrangements.
2 August 2026	Article 50 transparency duties became applicable.
2 December 2026	The Article 50(2) marking transition ends for relevant systems placed on the market before 2 August 2026.
2 December 2027	High-risk requirements apply to Annex III use cases, subject to the Act’s classification and transition provisions.
2 August 2028	High-risk requirements apply to systems covered by Article 6(1) and Annex I, including qualifying medical-device AI.

The high-risk dates reflect the 2026 AI Omnibus amendments. Classification depends on the system and its intended use; using AI in a pharmaceutical company does not itself make it high-risk.

What AI governance means for pharma

Governance tells you where AI is used, what risk it carries, who is accountable and how its use is controlled. Five things need to be in place, proportionate to each system’s purpose and risk. Not every system falls in the same regulatory category.

• AI inventory and risk assessment. Identify AI across Medical Affairs, Marketing, Regulatory, Clinical Operations and Patient Services; assess intended use and risk.
• Clear ownership. Define responsibilities across Compliance, Legal, IT, Medical, Regulatory and the business.
• Human oversight. Put review, approval and monitoring controls around AI-assisted activities.
• Third-party controls. Assess vendors, data handling, security, performance and contractual responsibility.
• Documentation. Retain evidence of decisions, approvals, controls and ongoing performance.

Article 50: the four transparency duties

Do people know when they are dealing with AI, or with AI-generated content? The first two duties below fall on providers; the second two fall on deployers. Establishing which role you hold, system by system, determines which duties apply. A company may hold different roles for different systems.

1. AI interactions: Article 50(1), providers

Systems intended to interact directly with people must be designed so that people are informed they are interacting with AI, unless this is obvious in the circumstances.

Example: a patient-support chatbot should identify itself as AI where the disclosure requirement applies.

2. Marking AI-generated content: Article 50(2), providers

Providers of systems generating synthetic text, images, audio or video must ensure outputs carry machine-readable marking and can be detected as artificially generated or manipulated. The provision includes exceptions, such as certain standard editing functions, and takes technical feasibility into account.

Example: ask your content vendor, in writing, how the tool marks output, which exceptions it relies on, and whether the narrow December 2026 transition applies.

3. Emotion recognition and biometric categorisation: Article 50(3), deployers

Deployers must inform people exposed to relevant emotion-recognition or biometric-categorisation systems and meet applicable data-protection requirements. Check prohibitions before considering disclosure.

AI that infers emotions from biometric data in workplaces or educational institutions is generally prohibited, with limited medical or safety exceptions. Ordinary analysis of the sentiment of written text is not automatically within that prohibition because the biometric-data requirement matters.

Example: a tool that scores a representative’s emotions from vocal or facial characteristics needs a prohibition assessment. Adding a disclosure cannot make a prohibited use lawful.

4. Deepfakes and public-interest text: Article 50(4), deployers

Deployers must disclose relevant AI-generated or manipulated deepfakes. A separate duty concerns AI-generated or manipulated text published to inform the public on matters of public interest.

For that text duty, an exemption applies where the content undergoes human review or editorial control and a person or organisation holds editorial responsibility. This is not a blanket exemption for deepfakes or for the provider’s machine-readable marking duty.

Example: for medical or promotional text, document substantive review, who holds editorial responsibility, what was approved and when. A spelling check alone is not substantive human review.

Article 50 is not a standalone labelling exercise. Governance decides which tools are approved, who reviews output, how accuracy is verified, whether disclosure is required and what evidence is retained. Article 50 is one output of that framework, not a substitute for it. Existing pharmaceutical, advertising and data-protection requirements continue to apply.

A five-step action plan

1. Map AI systems and use cases across the organisation, including tools procured outside IT.
2. Determine whether you act as provider, deployer or both, system by system.
3. Assess applicable obligations, including Article 50 and the Article 5 prohibitions.
4. Embed transparency, human review and approval controls into existing workflows.
5. Document responsibilities, and review periodically whether controls remain effective.

Start with a clear record of the systems you are running, their intended use and their owners. That provides the foundation for a proportionate governance programme.

Frequently asked questions

Does the Act apply to pharmaceutical companies outside the EU?

It can. Article 2 includes providers placing systems on the EU market and providers or deployers outside the EU where system output is used in the EU. Assess the specific activity and role rather than assuming that a UK address takes the company outside scope.

Is most pharma AI high-risk?

There is no single classification for pharma AI. Content drafting and chatbots are not automatically high-risk, although transparency duties may apply. Medical-device AI can fall within Article 6(1) where the product and third-party conformity-assessment conditions are met. Other use cases, including certain recruitment tools, can fall within Annex III. Assess the intended purpose of each system.

Who is responsible for AI content produced by our agency?

Responsibility depends on the roles and activities of the company, agency and technology provider. Publishing agency-produced AI content does not remove the need to assess your own obligations. Contracts should specify AI use, review, disclosures, marking and evidence, without assuming that a contract transfers statutory duties.

Does the Act require AI training for staff?

Article 4 requires providers and deployers to take measures supporting AI literacy among staff and others operating or using systems on their behalf. The amended provision takes knowledge, experience and context into account and does not require a guaranteed literacy level for each individual. Role-appropriate learning and records of the measures taken provide a practical starting point.

The key takeaway

AI governance defines how AI is controlled; Article 50 ensures transparency where it is required. Neither is satisfied by a policy document alone. The priority is translating regulatory requirements into working processes: clear accountability, embedded controls and evidence you can produce on request.

How Eunomia can help

Eunomia Pharma Services helps pharmaceutical and biotech companies strengthen compliance governance and build practical, scalable compliance operations. If you would like a second pair of eyes on your AI inventory or vendor position before 2 December, we run a short review to support classification and an evidence-based sign-off process.

Explore our Automation of Compliance Operations service or speak with our team. You can also email hello@eunomiapharmaservices.com.

Official sources

• EU AI Act, consolidated text: Articles 2, 4, 5, 6, 50, 111 and 113.
• European Commission guidelines on Article 50 transparency obligations.
• European Commission Article 50 FAQs.
• European Commission AI Act framework and application timeline.
• AI Act Recital 44: workplace and education emotion recognition.

Regulatory information checked on 28 October 2026. This article is for general information and does not constitute legal advice.