“AI in healthcare” covers very different things: software that analyses X-rays as well as an assistant that books appointments. Legally the two are treated very differently. This article explains which rules apply to which kind of AI and from when, so a practice can judge what to look for when choosing a system. It describes the legal situation in the EU and, where national rules are mentioned, in Germany. As of: 20 October 2026.
Where is AI used in healthcare?
Broadly there are two areas. Medical AI supports diagnosis, therapy or monitoring, for example when analysing images or measurements. Organisational AI handles processes without medical decisions: answering calls, assigning appointments, sorting requests, summarising conversations. For a practice this distinction is the most important first step, because it determines which regulations apply.
When is AI software a medical device?
Under Article 2(1) of the Medical Device Regulation (Regulation (EU) 2017/745), a medical device includes software intended by the manufacturer to be used for human beings for a specific medical purpose, such as diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease. What counts is the intended purpose set by the manufacturer, not the technology used. Software that books appointments or transfers calls has no medical purpose. Software that derives urgency or a suspected diagnosis from symptoms, on the other hand, may fall under the regulation.
Which healthcare AI does the AI Act classify as high-risk?
The AI Act (Regulation (EU) 2024/1689) has two routes into the high-risk category. First, AI systems that are themselves a product covered by the legislation listed in Annex I, or a safety component of such a product; this includes the Medical Device Regulation (Article 6(1) and Annex I, point 11). Second, the use cases listed in Annex III. For healthcare, point 5(d) is relevant: AI systems intended to evaluate and classify emergency calls or to establish priority in dispatching emergency services, including emergency healthcare patient triage systems (source: Annex III, retrieved 20 October 2026).
When do the AI Act obligations apply?
The regulation applies in stages. Since 2 February 2025, the prohibitions and the AI literacy obligation apply (Articles 4 and 5). Since 2 August 2026, the transparency obligations under Article 50 apply, among others: an AI that talks to people must disclose that it is an AI. For high-risk systems, the implementation timeline on artificialintelligenceact.eu (retrieved 20 October 2026) now lists later dates than the original text of Article 113: 2 December 2027 for Annex III systems and 2 August 2028 for systems under Article 6(1) and Annex I, which includes AI in medical devices. Anyone relying on these dates should check the current status in the Official Journal of the EU before deciding.
What does this mean for an AI phone assistant in a practice?
A phone assistant that books appointments, answers questions about opening hours and records prescription requests for the team is organisational AI. The main obligations are transparency (disclosing the AI at the start of the call), AI literacy of the practice team, the GDPR and professional secrecy. The boundary is where the assistant would make a medical assessment: it does not rate urgency based on symptoms and does not recommend treatment. For emergencies the greeting refers callers to the emergency number 112 and, in Germany outside surgery hours, to the on-call medical service at 116117. How a practice sets this up is described in the article Automated patient communication by phone.
Which questions should a practice ask an AI vendor?
- What is the intended purpose of the software, and is it a medical device?
- How does the AI disclose itself to patients?
- Does the system make medical assessments or prioritisations, or does it always pass such cases to people?
- Is there a data processing agreement under Article 28 GDPR and, in Germany, a confidentiality obligation under Section 203 StGB?
- How long are recordings and transcripts stored, and are they used to train models?
- What training or documentation is available so the team can build AI literacy under Article 4?
What mediOne is, and what it is not
mediOne is the practice edition of voiceOne for medical practices and physiotherapy practices and belongs to organisational AI. The AI phone assistant answers calls, introduces itself as an AI at the start, gives information, books appointments in Google, Outlook, CalDAV or eTermin calendars, records prescription and referral requests for the team to review and transfers calls. It does not diagnose and does not make medical decisions. Audio files are deleted after 30 days, transcripts after 180 days; call data is not used to train language or AI models. More on the page Data protection on calls.
You can hear how it sounds: on +49 951 16092950 the voiceOne assistant answers, in German or English.
Summary
Whether strict rules apply to AI in healthcare depends on its purpose. Medical AI can be a medical device and therefore high-risk under the AI Act; the same applies to emergency patient triage. Organisational AI such as a phone assistant does not fall into this category, but since 2 August 2026 it must disclose that it is an AI, and it is subject to the GDPR and professional secrecy. According to the current implementation timeline, high-risk obligations only start at the end of 2027 or in 2028.
Sources
All sources retrieved on 20 October 2026.
- Regulation (EU) 2024/1689 (AI Act), Article 4, Article 6, Article 50, Article 113, Annex I and Annex III; official text: eur-lex.europa.eu
- AI Act implementation timeline, artificialintelligenceact.eu
- Regulation (EU) 2017/745 (Medical Device Regulation), Article 2(1), eur-lex.europa.eu
- National Association of Statutory Health Insurance Physicians (KBV), on-call medical service, 116117.de
AI textThis article was created with the support of AI. voiceOne editorial team · published on 14 July 2026 · updated on 20 October 2026.