The EU AI Act — Implications for Pharmacovigilance

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) is the world’s first comprehensive AI regulation, classifying AI systems by risk level with different requirements per tier. For pharmacovigilance, the critical classification is high-risk — which covers signal detection algorithms, causality assessment support tools, case prioritisation and triage AI, and AI-assisted benefit-risk tools.

High-risk requirements apply to any AI tool a MAH or CRO deploys for EU-connected PV activities: implementing a risk management system across the AI’s lifecycle, ensuring training data is relevant and representative, maintaining technical documentation covering architecture and performance metrics, enabling human oversight and override capability, meeting accuracy/robustness/cybersecurity standards, and registering the system in the EU AI database before deployment.

Limited-risk AI — such as chatbots used for patient ADR reporting guidance — only requires transparency disclosure that the system is AI. Minimal-risk tools, like spam filters or basic formatting automation, carry no specific requirements.

It’s worth being precise about why signal-detection AI lands in the high-risk tier rather than limited or minimal: the EU AI Act classifies by the real-world consequence of an error, not by how sophisticated the technology is. A chatbot that gives a slightly wrong answer to a patient is limited-risk because a human downstream can catch and correct it. A signal-detection algorithm that misses or misclassifies a genuine safety signal can delay action on a real patient harm at population scale — that asymmetry of consequence, not the AI’s complexity, is what earns the high-risk label.