EU AI Act brings radiology AI oversight into daily practice

Jul 21, 2026

The European Parliament in Brussels approved the EU AI Act in 2024, establishing a risk-based regulatory framework for artificial intelligence, including high-risk medical AI systems.

Foto von Nardos Berehe / Pexels

Article Summary

The EU AI Act requires radiology departments to ensure staff have appropriate AI literacy and implement continuous postmarket monitoring of AI systems, but true patient safety depends on departments building practical competence beyond minimum regulatory compliance, including conducting audits of deployed models and monitoring for performance issues specific to their patient populations.

Article 4 of the EU AI Act requires AI literacy training for employees, effective February 2, 2025, with enforcement beginning August 2026.
Article 72 mandates postmarket monitoring of high-risk AI systems throughout their lifecycle, with medical AI monitoring expected to apply from August 2, 2028.
A 2024 survey found 48% of European radiology departments already use clinical AI, with another 25% planning implementation and CE-marked radiology AI products increasing from 100 in 2021 to 173 in 2025.
Departments should conduct documented audits of deployed models and monitor for performance drift, demographic bias, and calibration issues rather than simply completing compliance training.
Current barriers include lack of standardized audit definitions, limited statistical expertise outside academic centers, and insufficient structured databases linking AI outputs with patient outcomes.

European imaging departments should treat the EU AI Act as more than a regulatory checklist, according to an opinion paper published in the European Journal of Radiology.

Dr. Clemente García-Hidalgo of Hospital General Universitario Morales Meseguer in Murcia, Spain, argues that two provisions of Regulation (EU) 2024/1689 should directly influence how radiology departments train staff and oversee algorithms after deployment.

Meeting the requirements on paper, he wrote, will not be enough. Departments also need the practical ability to identify when an AI system is performing poorly in their own patient population.

From AI literacy to lifecycle monitoring

Article 4 of the AI Act requires providers and deployers to ensure that employees working with AI have an appropriate level of AI literacy. The provision has applied since February 2, 2025, with enforcement beginning in August 2026.

Article 72 requires providers of high-risk AI systems to establish and document postmarket monitoring throughout the systems’ lifecycles. García-Hidalgo argues that imaging departments should translate this requirement into continuous local clinical surveillance.

For medical AI, however, the monitoring requirements are expected to apply from August 2, 2028, following a proposed delay included in the Digital Omnibus amendment provisionally agreed upon in May 2026. The amendment has not yet completed the formal adoption process.

For radiology AI regulated as a medical device, the relevant high-risk requirements will apply from August 2, 2028, when the system meets the AI Act’s classification criteria. The Council gave the Digital Omnibus its final approval on June 29, 2026.

The issue is becoming increasingly relevant as AI adoption grows. A 2024 survey by the the European Network for the Assessment of Imaging in Medicine (EuroAIM) and the European Society of Medical Imaging Informatics (EuSoMII) included 572 European Society of Radiology members from 61 countries. Forty-eight percent reported already using AI in clinical practice, while another quarter planned to introduce it.

An updated analysis identified 173 CE-marked radiology AI products in 2023, compared with 100 in the researchers’ 2020 analysis.

Competence requires local audits

García-Hidalgo draws a distinction between AI literacy and clinical competence. Radiologists may understand concepts such as scanner bias, shortcut learning, poor calibration, and distribution drift without knowing how to determine whether these problems are affecting a model used in their own department.

He therefore proposes that staff demonstrate competence by conducting and documenting an audit of a deployed model, rather than simply completing a course or presentation.

He makes a similar argument for postmarket monitoring. Instead of treating surveillance as a report prepared for regulators, departments should monitor AI systems continuously, much like healthcare systems monitor drugs after approval.

This could include routine checks for performance drift, audits across demographic and clinical subgroups, transparent reporting of failures, and predefined criteria for suspending a system.

García-Hidalgo also calls for audit-focused training programs, standardized reporting of AI failure modes in medical journals, and shared open-source auditing tools connected to the European Health Data Space.

Standards and resources still lag

Several practical questions remain unresolved. Many hospitals do not have structured databases linking AI outputs with diagnoses, outcomes, and follow-up information. An audit that is straightforward in a large academic center may therefore be impossible in a smaller hospital.

Specialist knowledge is another barrier. The statistical expertise needed to design and interpret AI audits remains concentrated in a limited number of institutions.

There is also no agreed European standard defining what a satisfactory audit should include, how often it should be performed, or who should be qualified to approve it. The timeline remains uncertain because the proposed delay for medical AI monitoring has not yet been formally adopted.

For radiologists, the paper’s message is that the AI Act will establish a legal minimum, but patient safety will depend on what departments build beyond it.

“Compliance is what the regulator receives,” García-Hidalgo wrote. “Competence is what the patient receives.”