← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for pharma and life sciences

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Honest answer first: most pharma AI is not high-risk under the AI Act.

• Research is excluded. AI developed and put into service for the sole purpose of scientific research and development is outside the Act (Art. 2(6)), and so is research, testing and development before a system is placed on the market, except testing in real-world conditions (Art. 2(8)). Target discovery, molecule generation and literature mining for internal R&D usually sit here.
• Annex III does not list drug development, pharmacovigilance or manufacturing batch release.
• Device software is the exception. AI that is itself a medical device or in vitro diagnostic, or a safety component of one, and needs third-party conformity assessment under the MDR or IVDR, is high-risk under Art. 6(1) and Annex I. Companion diagnostics and digital therapeutics can land here. See healthtech.

What applies regardless: AI literacy for staff using AI (Art. 4, since 2 February 2025) and Article 50 transparency from 2 August 2026, for example a medical-information chatbot answering healthcare professionals must say it is an AI.

The logging duties that follow

Where a product is high-risk:

• Art. 12 (providers): automatic event recording over the lifetime of the device software.
• Art. 19 (providers): logs kept for at least six months, alongside device vigilance records.
• Art. 26 (deployers), such as hospitals and labs: human oversight (Art. 26(2)) and log retention of at least six months (Art. 26(6)).

On timing: the Digital Omnibus agreement moves Annex I (product-embedded) obligations to August 2028 (details and caveats).

What counts as evidence

Outside the Act, pharma already lives under audit-trail expectations: data integrity in GxP systems, signal detection in pharmacovigilance. An LLM that codes adverse event reports is not high-risk, but an inspector will still ask what it did to each case.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.call","data":{"name":"ingest_icsr","input":{"case":"AE-2026-081244","source":"hcp_email"}}}
{"seq":2,"type":"tool.result","data":{"name":"meddra_coder","output":{"pt":"Hepatotoxicity","seriousness":"serious","model":"pv-coder-4"}}}
{"seq":3,"type":"policy.decision","data":{"kind":"tool.result","action":"warn","hits":[{"rule":"serious-case-needs-safety-physician"}]}}
{"seq":4,"type":"tool.call","data":{"name":"route_case","input":{"to":"safety_md_03","clock_day":1}}}

Tamper-evidence answers the data-integrity question directly: was the coding changed after the fact, and by whom.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 29 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign pharmacovigilance and medical-information runs daily, and store attestations with the case or inquiry records. Pseudonymise patient data before export; the attestation itself covers only a digest.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the coding or answer was medically correct, and it is not a GxP validation. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 29 USD.
• Compare approaches: vs. WORM storage, vs. RFC 3161 timestamping.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.