The regulatory picture for AI governance in life sciences just got more confusing, not less. In June 2026, the European Union’s Digital Omnibus package pushed back the EU AI Act’s compliance deadline for stand-alone high-risk AI systems from August 2026 to December 2027, with AI embedded in regulated medical devices now given until August 2028. Meanwhile, in the United States, 21 states had already enacted 33 healthcare-specific AI laws by the end of 2025, and lawmakers introduced more than 250 additional bills across 47 states during that same year, with 177 more pending across 31 states in 2026. There is still no comprehensive federal AI statute.
For life sciences leaders, this creates a temptation: if the EU just bought itself another 16 months, and the US hasn’t settled on a single approach, why not wait until the picture clarifies before committing serious resources to AI governance?
That instinct is understandable. It’s also a mistake, and the reasoning behind why matters more than the reasoning that produced it.
Deadlines Move. Consequences Don’t.
The Digital Omnibus extension is real, but the underlying obligations it delays have not changed in substance. Risk management, technical documentation, human oversight, and post-market monitoring requirements remain the eventual standard, only the enforcement date shifted. Notably, the extension did not touch every provision: Article 50’s transparency obligations, requiring disclosure when a person is interacting with an AI system, remain in force on their original August 2026 timeline. Organizations that read the broader delay as license to slow down governance work risk being caught mid-transition when transparency requirements land on schedule while risk-management infrastructure is still unbuilt.
The US picture is arguably less forgiving, not more. Because there is no single federal AI statute, life sciences organizations aren’t waiting for one law to settle, they’re tracking dozens of them simultaneously, each with its own definitions, thresholds, and enforcement mechanisms. California, Colorado, Illinois, and New York have all moved independently on healthcare-specific AI rules, from chatbot disclosure requirements to restrictions on AI making autonomous clinical or therapeutic decisions. A life sciences company operating nationally isn’t choosing which regulation to comply with, it’s building for the strictest applicable standard across every state it touches, because a governance program that only satisfies the most permissive state will fail the moment a patient, a regulator, or a plaintiff’s attorney in a stricter state gets involved.
This is the core argument for why the highest-stakes AI use cases in life sciences, clinical decision support, trial design and patient recruitment algorithms, adverse event detection, and prior-authorization or claims-decision tools, demand real AI governance now, independent of where any single piece of legislation lands. The risk in these use cases was never really about which regulator gets there first. It’s about what happens when an AI system makes or influences a decision that affects a patient’s care, and nobody in the organization can clearly explain how, why, or who is accountable if it’s wrong. That exposure exists today, regulation or not.
The Barrier Isn’t the Model. It’s the Plumbing
If deployment risk is the argument for urgency, data interoperability is the argument for why so many organizations are still unprepared to act on it.
A 2025 CHIME Foundation survey of health IT leaders found that 89% believe vendor consolidation is essential to achieving real interoperability, yet only 16% reported that their core electronic health record system currently provides vendor-agnostic interoperability. Cost, cited by 47% of respondents, and vendor unwillingness or delay, cited by 42%, were named as the two biggest practical barriers, not technical standards disagreements, which is where interoperability conversations traditionally focused. Organizations are increasingly patching around these gaps with bolted-on, one-off integrations rather than solving the underlying fragmentation, which quietly compounds governance risk: a workaround built to move data between two systems today becomes an undocumented, unowned dependency that nobody remembers exists two years from now.
That fragmentation shows up directly in AI governance maturity. A separate industry survey on healthcare AI adoption found that only about 10% of organizations use automated monitoring to track which AI capabilities are actually live across their systems, most rely on informal, ad hoc discovery or vendor release notes to know what AI tools exist in their own environment. Sixty-three percent of organizations surveyed said output quality and hallucination risk was their top concern, and the same proportion plan to move to more autonomous, agentic AI systems within the next 12 months, even as only 8% described themselves as highly confident in their ability to identify emerging AI risks. Put plainly: the organizations racing fastest toward more autonomous AI are, by their own admission, among the least confident they’d catch a problem early.
This is why data interoperability, not model capability, deserves to be treated as the actual AI governance bottleneck. A well-designed AI oversight process is only as good as the organization’s ability to see what data an AI system is actually touching, where that data originated, and whether it’s flowing through a documented, monitored pathway or an informal patch nobody owns. Regulatory compliance frameworks assume that visibility exists. For a meaningful share of life sciences organizations today, based on the survey data above, it doesn’t.
Interoperability figure from a CHIME Foundation survey published in March 2026. Image supplied by the author.
What to Actually Do While the Picture Stays Unsettled
Waiting for regulatory clarity isn’t a neutral choice, it’s a bet that the eventual rules will be lenient enough, and arrive late enough, that catching up won’t be costly. Given the trajectory, tightening state-level activity in the US, a delayed but not diminished EU standard, that bet looks weak.
A more defensible approach for life sciences leaders right now:
Build to the strictest standard you can currently identify, not the most convenient one. Treating the EU AI Act’s risk classification and documentation requirements as a governance floor, even for products not currently sold in Europe, produces infrastructure that’s portable to whatever the US ultimately settles on. Building only to today’s most permissive US state requirement means redoing that work repeatedly as more states legislate.
Inventory before you govern. Given how few organizations currently have automated visibility into their own live AI systems, the first real governance action isn’t writing a policy, it’s building an accurate, current list of every AI system touching patient data or clinical decisions, its purpose, its data sources, and its owner. AI governance frameworks applied to an incomplete inventory create a false sense of coverage.
Treat interoperability spend as governance spend, not just IT spend. Given how directly data fragmentation undermines the ability to monitor and audit AI behavior, investment in cleaner, vendor-agnostic data integration should be evaluated for its governance value, not only its operational convenience.
Assign real authority, not just responsibility. A named owner needs the standing to pause or roll back a deployed AI system without requiring a week of internal escalation first. Given how quickly agentic AI adoption is outpacing organizations’ confidence in identifying risk, the gap between noticing a problem and having someone empowered to act on it is where the most serious failures will occur.
The regulatory endpoint for AI governance in life sciences is still moving. The consequences of an ungoverned AI system making the wrong call about a patient are not waiting for it to arrive.
Author Bio
