EU AI Act for hospitals

Which AI in a hospital is high-risk?

Use	Classification	From
Drafts of doctor’s letters and findings, summaries, questions on guidelines, translations	not high-risk, as long as there is no medical intended purpose	Art. 4 already applies
AI as a medical device assessed by a notified body (MDR class IIa and above), such as image analysis or diagnostic suggestions	high-risk under Art. 6(1) and Annex I	2 August 2028
Triage of patients in the emergency department, classification of emergency calls	high-risk under Annex III point 5(d)	2 December 2027
Screening job applications, allocating shifts or tasks, monitoring performance	high-risk under Annex III point 4	2 December 2027
Biometric identification, emotion recognition	high-risk under Annex III point 1; emotion recognition of staff is prohibited, except for medical or safety reasons (Art. 5)	prohibition since 2 February 2025, otherwise 2 December 2027

The deadlines were postponed by Regulation (EU) 2026/1744 (Digital Omnibus, in force since 27 July 2026). Whether software is a medical device depends on its intended purpose under the MDR. See the guide Is AI a medical device?.

What must hospitals already do today?

• AI literacy (Art. 4): Train medical staff, nursing, administration and IT who use AI, and document it. Templates in the guide AI literacy under Art. 4.
• Transparency (Art. 50, since 2 August 2026): A chatbot for patients, relatives or referring doctors must be recognisable as AI. Published AI texts on matters of public interest without editorial review are labelled. See Transparency obligations under Art. 50.
• Create an AI inventory: Which systems are running, for what, with which data, and how are they classified?

In addition, the GDPR, § 203 StGB (German criminal law on professional secrecy), § 393 SGB V for cloud services with health data, and co-determination by the works council or the employee representation body (MAV, in church-run organisations) apply.

What applies when you deploy high-risk AI?

As a deployer, under Art. 26 you must, among other things, use the system in line with the instructions for use, assign human oversight to competent people, check input data for suitability, monitor operation and report serious incidents, keep logs for at least six months, and inform staff and their representatives in advance. Publicly owned hospitals and private hospitals with a public healthcare mandate usually need a fundamental rights impact assessment for Annex III systems.

If your hospital builds its own AI application with a medical intended purpose, it is a manufacturer under the MDR and therefore also a provider under the AI Act. Special rules apply to in-house manufacturing in health institutions (Art. 5(5) MDR).

What changes for university hospitals?

AI developed and put into service solely for research and development does not fall under the regulation (Art. 2(6)). The boundary is use in patient care: if a research model is used for treatment decisions, the MDR and the AI Act apply.

How does this work with basebox?

basebox is a platform, not a high-risk system, and not a medical device: it serves general tasks such as drafting letters or searching guidelines. For tasks involving patient data, basebox delivers drafts and summaries with sources, no diagnosis and no therapy suggestion; every result is checked by the doctor or nurse. If your hospital builds its own medical device and uses models from basebox through it, your hospital is the manufacturer; for the technical documentation, basebox provides the information of a supplier: model register with version and licence, software bill of materials and ISO 27001 certificate. For the EU AI Act, you receive training, logs and the model register. More under AI for hospitals and Security.

Not legal advice: As of 11 October 2026. The boundary between the MDR and the AI Act is being clarified further by guidelines from the Commission and the Medical Device Coordination Group. Check uses with a clinical connection in advance with your legal department and your data protection officer.