{"id":3449,"date":"2026-09-23T12:18:39","date_gmt":"2026-09-23T10:18:39","guid":{"rendered":"https:\/\/www.bayoocare.com\/?p=3449"},"modified":"2026-09-23T12:18:42","modified_gmt":"2026-09-23T10:18:42","slug":"the-ai-regulation-and-the-ai-act-why-the-digital-omnibus-helps-the-large-medical-ai-providers-not-the-small-ones","status":"publish","type":"post","link":"https:\/\/www.bayoocare.com\/en\/regulatory-newsletter\/the-ai-regulation-and-the-ai-act-why-the-digital-omnibus-helps-the-large-medical-ai-providers-not-the-small-ones\/","title":{"rendered":"The AI Regulation and the AI Act: Why the Digital Omnibus Helps the Large Medical AI Providers, Not the Small Ones"},"content":{"rendered":"

What is the Digital Omnibus?<\/h2><\/h2><\/div>

The Digital Omnibus is not a single law, but rather a bundle of EU simplification packages that harmonize several sets of digital regulations. It is important to note that there are currently two parallel strands. The general Digital Omnibus primarily concerns the GDPR and the ePrivacy rules, while the specific Digital Omnibus on AI specifically aligns the deadlines of the AI Regulation\u2014which is the subject of this article. Both packages are moving through the legislative process simultaneously but address different matters.<\/p>\n<\/div>

How the Digital Omnibus Act Is Changing High-Risk AI in the Healthcare Sector<\/h2><\/h2><\/div>

The Digital Omnibus on AI distinguishes between two groups of high-risk AI systems, and this is the crucial point for medical device manufacturers. Standalone high-risk AI systems as defined in Annex III are granted a grace period until December 2, 2027. AI embedded in products that are already regulated\u2014such as medical devices under the MDR\u2014falls under Annex I and will not be subject to these requirements until August 2, 2028, a good two years later than originally planned. By contrast, the transparency requirements under Article 50 remain unchanged and will continue to apply starting August 2, 2026, regardless of the risk class.<\/p>\n

For manufacturers of medical AI, this means, specifically, that the substantive requirements for risk management, conformity assessment, and post-market surveillance under the AI Regulation will take effect later, but the obligation to label AI-generated content and automated decisions remains unaffected by the timeline.<\/p>\n<\/div>

The Study: Why Small Medical AI Companies Are Voluntarily Investing in Security<\/h2><\/h2><\/div>

Wiens and Dieler model the conformity assessment process using game theory as a competition between a small or medium-sized enterprise, a Notified Body\u2014that is, the certification body responsible for external auditing\u2014and the regulator. All three also compete for the same scarce resource: qualified AI specialists. The study\u2019s findings may seem surprising at first glance, but upon closer inspection, they make sense: companies voluntarily invest in product safety even though such an obligation does not yet exist.<\/p>\n

There are three reasons behind this. First, to protect themselves against future liability risks, which will increase even further with the equally new Product Liability Directive (EU) 2024\/2853. Second, a safety-focused unique selling proposition (USP) for customers, precisely because sector-specific standards for AI liability and data security are still lacking\u2014a niche that can be filled. Third, well-calibrated regulatory incentives that reward early investment. The second point is particularly interesting for European providers: those who can present robust security evidence even before the mandatory deadline will stand out from the competition.<\/p>\n<\/div>

<\/span><\/div>

When Safety Becomes an Afterthought: The Downside of Procrastination<\/h2><\/h2><\/div>

According to the study, the delay undermines precisely this advantage. If the high-risk requirements do not take effect until 2028, competition will shift away from safety and toward speed. Anyone who brings their product to market before the regulations take effect secures a first-mover advantage without bearing the costs of regulation.<\/p>\n

This structurally favors larger competitors and, above all, non-European providers. In AI diagnostics, these are primarily U.S. and Chinese platforms, which launch earlier in their home markets anyway and can secure a customer base and lock-in effects before European SMEs even consider entering the market. The time that the Omnibus Directive supposedly grants is therefore not distributed equally among all market participants.<\/p>\n<\/div>

The real bottleneck isn’t the deadlines, but the testing capacity<\/h2><\/h2><\/div>
According to the study, the real bottleneck isn\u2019t time anyway, but rather staffing. Companies and Notified Bodies are competing for the same small pool of AI specialists. More time does not create additional qualified inspectors. The standardized application and evaluation procedure enshrined in the Omnibus Regulation helps somewhat in terms of process efficiency because it reduces duplication of effort, but it does not solve the actual capacity problem faced by the Notified Bodies.<\/section>\n<\/div>

The New Small-Mid-Cap Category: Relief with Side Effects<\/h2><\/h2><\/div>

Caution is also warranted when it comes to the SME privileges themselves. The Omnibus Act extends relief regarding fees, documentation, and access to real-world testing facilities to a new category called \u201cSmall Mid-Cap Companies\u201d\u2014firms with up to 750 employees and annual revenue of 150 million euros, which is three times the traditional SME threshold. While small and micro-enterprises benefit additionally from a 50 percent or 75 percent reduction in fines, the new, significantly larger category dilutes the targeted support intended specifically for the small, resource-constrained companies for which it was originally designed.<\/p>\n<\/div>

<\/span><\/div>

What Medical AI Companies Should Do Now<\/h2><\/h2><\/div>

In practical terms, a few concrete conclusions can be drawn from the study:<\/p>\n