~ 15 min · confidential · internal use

Assess your compliance with the EU AI Act

This free diagnostic, designed specifically for pharmaceutical laboratories, assesses your readiness for the European AI regulation. In 15 minutes: a maturity score, your main non-compliance risks, and priority recommendations.

Critical deadline: from 2 August 2026, member-state surveillance authorities gain their enforcement powers over Article 4 (AI Literacy), with penalties of up to €7.5M or 1% of global turnover. GPAI obligations are already enforceable.

0 / 22 questions answered0 %

Profile

A few pieces of context (not counted in the score)

What is your role in the organisation?

Organisation size

Main AI activities (multiple selections allowed)

This helps contextualise your regulatory exposure

R&D: drug discovery, molecular designClinical trials: recruitment, monitoring, analysisManufacturing / productionPharmacovigilance and safety signal detectionMedical affairs and marketingMedical devices or IVDs incorporating AI

Your role under the AI Act (multiple possible)

Model provider: you develop or train a general-purpose AI model (GPAI). System provider: you place an AI system on the market (e.g. an MDR/IVDR device embedding AI, under your brand). Deployer: you use, under your authority, an AI system supplied by a third party.

Model providerSystem providerDeployer

AI Governance

Steering, responsibilities and internal policy

AI governance is the organisation you put in place to steer your use of AI: roles and responsibilities, internal policy, review committees and risk monitoring. It is the foundation that lets you demonstrate control and meet the AI Act's obligations over time.

Is there an identified AI compliance officer in your organisation?

Multiple answers possible

No identified officerTopic informally assigned to the DPO or compliance functionOfficer appointed but without a formal mandate or dedicated resourcesAI Officer or equivalent with a formalised mandateDedicated function with a team, budget and reporting to senior management

Do you have an AI governance committee or body?

No AI committeeAd-hoc discussions within the Compliance or Digital committeeAI committee exists but meets irregularlyCross-functional AI committee with regular cadence and minutesAI committee with a formal mandate, metrics and direct link to the Board

Does an internal AI policy exist (acceptable use, ethical principles)?

No formalised policyInternal note or informal guidelinesPolicy drafted but poorly disseminatedFormalised policy, disseminated and aligned with the AI ActEnforceable policy, monitored and reviewed annually

Is AI Act compliance covered by an identified budget for 2026?

No identified budgetBudget under discussionPartial budget drawn from existing resourcesDedicated and approved budget for the financial yearMulti-year budgeted and tracked plan

AI Systems Inventory and Classification

Mapping your actual regulatory exposure

The inventory means listing all your AI systems and classifying them by AI Act risk level (unacceptable, high, limited, minimal). It is the mandatory starting point of any compliance effort: you can only govern what you have mapped.

Do you have an inventory of AI systems used or developed?

No inventoryPartial inventory by silo (IT, R&D, etc.)Centralised inventory but incompleteComplete inventory updated on a regular basisDynamic inventory with a mandatory onboarding workflow

Have you classified your systems according to AI Act risk levels (unacceptable, high, limited, minimal) and your role (provider, deployer)?

No classification performedClassification initiated for a few use casesPartial classification, methodology to be formalisedComplete classification with documented methodologyClassification reviewed by an independent body and audited

Do you use AI in medical devices or IVDs (MDR/IVDR)?

These systems may be classified as high-risk under the AI Act if they serve a safety function

Yes, without a specific AI Act analysisYes, analysis in progressYes, MDR/IVDR + AI Act gap analysis completedYes, compliance plan approved for August 2028Yes, compliance anticipated and QMS processes integratedNo medical device with AI (not applicable)

Do you use AI in pharmacovigilance (signal detection, ICSR processing)?

Multiple answers possible

Yes, without a specific compliance frameworkYes, in pilot mode without documentationYes, partially integrated into the pharmacovigilance QMSYes, validated in accordance with the EMA Reflection PaperYes, validated, monitored and audited on a regular basisNot used in pharmacovigilance (not applicable)

Do you use generative AI tools (ChatGPT, Copilot, Claude, etc.)?

Multiple answers possible

Yes, without governance or inventoryYes, with informal recommendationsYes, a usage policy disseminated but not enforcedYes, approved tools, enforceable policy and controls in placeYes, secure enterprise environment, audit trail and training

Have you analysed whether your systems fall within the high-risk use cases listed in Annex III of the AI Act, and specifically whether they are applied to biometric, recruitment, training, risk assessment or health insurance pricing use cases?

High-risk use case analysis not performedAnalysis initiated for a few use casesPartial analysis, methodology to be formalisedComplete and documented analysis for all systems in useDocumented analysis, reviewed by an independent body and audited

Have you implemented systematic controls for the prohibited practices under art. 5 (social scoring, manipulation, emotion recognition in the workplace, etc.)?

No controlsGeneral awareness, without formalised controlsControls being definedSystematic controls documented upon onboarding of each systemSystematic controls, tracked and reviewed periodically

AI Literacy (Article 4)

Training and awareness for staff

AI literacy means the skills, knowledge and understanding that allow your staff to deploy and use AI systems knowingly, and to be aware of both their opportunities and risks. Since 2 February 2025, Article 4 of the AI Act requires every provider and deployer to ensure a sufficient level of AI literacy among its staff, proportionate to the systems used, the context of use and the people affected.

Have your employees using AI received AI literacy training?

Multiple answers possible

No trainingGeneral communication (newsletter, intranet)Generic e-learning for volunteersMandatory role-targeted trainingStructured programme with certification and annual refresh

Are training modules proportionate to the risk level of the systems used?

No differentiation, or no trainingDifferentiation planned but not implementedUniform basic modulesModules differentiated by role and risk levelAdaptive learning paths with competency assessment

Do you track coverage and effectiveness indicators for training?

No indicatorsCompletion rate tracked on an ad-hoc basisCompletion rate tracked systematicallyCompletion + knowledge testsCompletion tracking, tests, usage surveys and continuous improvement

Data and Quality

Governance of data intended for use in AI systems

Data governance covers the quality, traceability and protection of your proprietary data used in production as input to your generative AI (prompts, RAG corpora, shadow AI).

Do you have data governance defining what your employees may or may not process using the AI systems available to them?

Multiple answers possible

No specific governanceA few informal rulesGlobal data governance framework, not AI-specificAI-specific governance with catalogue and lineageEnd-to-end certified and auditable data governance

Do you have data lineage mechanisms covering production data, and in particular the use made by your employees of the AI systems available to them?

Multiple answers possible

No specific traceabilityPartial traceability, manually documentedTooling being deployedTooled traceability for critical systemsComplete, automated and auditable lineage

AI Vendors and GPAI

Due diligence on models and systems provided by your vendors

This section covers AI models and systems supplied by third parties, including general-purpose AI (GPAI) models. The AI Act allocates responsibilities along the value chain, so you must carry out due diligence on your suppliers and secure your contracts to inherit their compliance guarantees.

Do you conduct AI Act due diligence on your AI vendors and GPAI models?

Multiple answers possible

No specific due diligencePartial due diligence, standard contractualisationAI vendor questionnaire being deployedSystematic due diligence with a dedicated AI Act questionnaireOngoing assessment, vendor audits, management of critical dependencies

Do your vendor contracts include specific AI Act clauses (responsibilities, documentation, audit)?

Multiple answers possible

No AI Act clausesStandard data protection clauses onlyAI Act clauses being added to new contractsSystematic AI Act clauses on new contracts and renewalsAll contracts remediated, AI Act clause template deployed

Are you familiar with the GPAI Code of Practice and have you integrated it into your vendor selection criteria?

Multiple answers possible

Limited awarenessGeneral awarenessIntegration in progress in procurementExplicit criterion in RFPsBlocking criterion, verification of Code adherence and transparency

When acquiring or modifying an AI system, do you assess the risk of becoming a 'provider' yourself under art. 25 (affixing your own brand, substantial modification, change of intended purpose)?

Multiple answers possible

Risk not identifiedRisk known but not assessedCase-by-case assessment, undocumentedSystematic assessment documented at each projectAssessment integrated into the procurement process, with tracked legal arbitration

EMA Compliance and Pharma Quality

Alignment with the EMA Reflection Paper and GxP requirements

This section connects the AI Act with the healthcare framework: the EMA Reflection Paper on the use of AI across the medicinal product lifecycle and GxP requirements (validation, quality, pharmacovigilance). The goal is to keep AI compliance consistent with pharmaceutical obligations.

Have you integrated the EMA Reflection Paper (September 2024) into your AI practices?

Document not read / not disseminatedDocument shared internallyImpact analysis in progressPrinciples integrated into the relevant SOPsInternal framework aligned, updated and teams trained

Have you engaged with the EMA, a national authority or a certification body regarding your MDR/IVDR devices integrated into AI systems?

No engagementRegulatory watch onlyParticipation in consultations or working groupsInformal exchanges with authorities on use casesEMA scientific advice or formal interaction on conformity assessment