Clean before AIENSL
AI for business · Industry guide

🩺 AI rules: Healthcare

Medical AI is usually a medical device and high-risk; health data is a special category under GDPR. The European Health Data Space will open access to data for AI development.

Typical AI uses and their risk level

High risk
AI that supports diagnosis or treatment decisions

Medical device (MDR) and high-risk under the AI Act (Annex I) from 2 Aug 2028.

High risk
Triage of emergency calls

High risk (Annex III).

Minimal
AI transcription of consultations into the medical record

Not high-risk by itself, but health data: DPA, EU hosting, patient information, doctor checks the text.

Transparency
Appointment chatbot

Must say it is AI; no medical advice without safeguards.

What to do

  • Check whether an AI tool is CE-marked as a medical device for your intended use.
  • Never paste identifiable patient data into consumer AI tools.
  • DPIA for any AI processing of health data.
  • Keep the clinician responsible and document review of AI outputs.

Common pitfalls

  • General chatbots are not medical devices — using them for diagnosis shifts liability to you.
  • Emotion recognition of staff is prohibited even in hospitals (except for safety or medical reasons).

Examples

A private clinic wants AI dictation

Choose a provider with a DPA and EU data storage, inform patients, let doctors review each note — then it is an efficient, low-risk use.

Rules that apply

Applies in phasesAI Act

Applies to anyone who develops AI (provider), uses AI in their business (deployer), imports or distributes it in the EU — also to companies outside the EU if the output is used in the EU. Private, non-professional use is excluded.

In forceGDPR

For most companies GDPR matters more than the AI Act: it decides whether you may put customer or employee data into an AI tool at all. In Slovenia it is supplemented by ZVOP-2 and supervised by the Information Commissioner.

Applies in phasesEHDS

Health AI developers will be able to request access to anonymised or pseudonymised health data through national health data access bodies — under strict conditions and in secure environments.

In forceZVOP-2

AI on cameras (face recognition, behaviour analysis) and biometric attendance systems fall under strict ZVOP-2 rules — often they are simply not allowed. The Information Commissioner has published opinions on AI, e.g. on misleading use of AI systems and on accountability.

Get your full list of obligations →
Other industries
👥 HR and recruitment🏦 Banks, insurers, leasing📣 Marketing, media and design🛒 Retail, e-commerce, customer service🏛️ Public sector and municipalities🎓 Schools, universities, training🏭 Manufacturing, machines and products💻 Software and IT services⚖️ Lawyers, accountants, consultants

General information, not legal advice — consult a lawyer for borderline cases. Regulations reviewed on 29 Sep 2026.