EU AI Act Article 50 and clinic software: what private rooms must do

Provider or deployer: which are you?

The AI Act (Regulation (EU) 2024/1689) puts most duties on the provider, the company that develops an AI system and puts it on the market. The deployer is the person or business using it in their professional work.

A consultant practice using a scheduling, dictation or records system is almost always a deployer. That still leaves a few things to check, but most of the technical work is the vendor's.

What Article 50 requires

The European Commission's quick facts on transparency rules set out four cases.

Who	Duty	Does it affect private rooms?
Provider	Design AI systems so people know when they are interacting with one (Article 50(1))	Matters if you put a chatbot or automated assistant in front of patients. The vendor builds the notice; you check it shows.
Provider	Mark AI-generated or manipulated content in a machine-readable way, so it can be detected (Article 50(2))	The vendor's job. It doesn't apply to assistive functions for standard editing, or where the input isn't substantially changed.
Deployer	Tell people when they are exposed to emotion recognition or biometric categorisation (Article 50(3))	Rarely relevant to rooms software. Check with your vendor if unsure.
Deployer	Disclose deepfakes, and label AI-generated text published to inform the public on matters of public interest, where it had no human review or editorial control (Article 50(4))	Possibly relevant to public website content. Not to a clinic letter the consultant reads and signs.

There is one transitional point. Under Article 50(2) as amended by the AI Omnibus, generative AI systems placed on the market before 2 August 2026 have until December 2026 to apply the marking. That is a provider grace period. It doesn't change deployer duties.

Breaches of Article 50 can lead to fines set as a fixed maximum or a share of worldwide annual turnover, with lower caps for SMEs, according to the Commission's quick facts. Enforcement is by national market surveillance authorities.

The Commission has also published guidelines on Article 50 and a voluntary code of practice on labelling AI-generated content. Both are linked from the quick facts page.

Patient-facing tools

The provider duty under Article 50(1) is the one most likely to touch your patients. If a patient chats with an automated assistant on your website or in a booking app, they should be told it is an AI system, unless that is obvious from the context.

Ask your vendor three questions:

1. Does any part of the system talk to patients directly?
2. If so, where does it tell them it's an AI system, and can I see it?
3. Can a patient reach a person in the practice instead?

Clinic letters and the patient record

A letter or note prepared from a dictation, and read, corrected and signed by the consultant, is a document with an author. It isn't published to the public, and it has had human review. It is very unlikely to fall within the deployer labelling duty in Article 50(4).

Medical Council rules matter more here. The Guide to Professional Conduct and Ethics (9th edition, 2024) says that:

• you must protect patient information in your control "against improper disclosure, access or loss" (paragraph 25.4);
• disclosure within or outside the healthcare team generally needs the patient's consent (paragraph 25.3);
• records must be accurate, show who made them, and be made at the same time as the events they record or as soon as possible after (paragraph 38.1).

So the practical rule is the one most rooms already follow: nothing goes out until the consultant has read it and signed it.

Staff AI literacy (Article 4)

Article 4 has applied since 2 February 2025, and the AI Omnibus, which entered into force on 27 July 2026, simplified the requirement for companies. For a small practice it comes down to making sure the people who use the tools understand what they do and where their limits are. We cover it in full in our post on AI literacy rules for clinic staff.

High-risk rules and medical devices

The high-risk rules are separate from Article 50 and arrive later. After the AI Omnibus, they apply:

• from 2 December 2027 for high-risk systems listed in Annex III. In health, that list includes AI used for emergency patient triage;
• from 2 August 2028 for AI in products covered by EU product law in Annex I, which includes medical devices.

Under Article 6(1), AI is high-risk through the medical device route if it is a medical device, or a safety component of one, and the device needs a third-party conformity assessment by a notified body under the Medical Device Regulation (MDR, 2017/745). In general, that means Class IIa and above. Some Class I devices, such as sterile, measuring or reusable surgical ones, also involve a notified body for those aspects. The joint AI Board and MDCG guidance (MDCG 2025-6) explains how the two laws fit together.

Type of software	Route	Applies from
Admin tools: scheduling, dictation, transcription, invoicing	Not high-risk; Article 50 if relevant	2 August 2026 for Article 50
AI used for emergency patient triage	High-risk, Annex III	2 December 2027
Stand-alone diagnostic software that is a medical device needing a notified body	High-risk, Article 6(1) and Annex I via the MDR	2 August 2028
AI built into a physical medical device, such as imaging equipment	High-risk, Article 6(1) and Annex I via the MDR	2 August 2028

Admin software stays outside the high-risk tiers as long as it doesn't claim diagnostic or treatment functions. If a vendor markets a tool as doing either, ask how it is certified.

A short checklist for your rooms

1. List your software. For each tool, note what it does, whether it uses AI, where it stores data and who in the rooms uses it.
2. Find anything patient-facing. Check that any chatbot or automated assistant tells patients it's an AI system.
3. Check your public website. If AI helps write public content, make sure a person reviews and edits it before it goes up.
4. Keep the review rule. Every letter and note is read and signed by the consultant before it is sent or filed.
5. Read the data processing agreement. Ask your vendor to confirm, in the DPA, where data is processed and that your patients' data isn't used to train AI models. Our post on lessons from a recent health data fine shows why the paperwork matters.

Where Ask Brigid fits

Ask Brigid's Clinical Intelligence transcribes consultations, with the patient's agreement first. Where note assistance is turned on, it prepares the note from what was said, and the note stays marked Unreviewed until the consultant has read and signed it. It doesn't diagnose or make clinical decisions. Records are hosted in AWS Dublin (eu-west-1), and the providers we use are named on our compliance page.

Next step: take ten minutes this week to list every piece of software in your rooms and mark which ones patients see directly.

Ask Brigid is looking for a small number of founding consultant practices. Explore the sample practice (the real app, invented patients, no sign-up) or request early access.