Since 2 August 2026 a patient must be told when an AI is talking to them. Whether the system clears a hospital’s data protection review is decided by where the data goes, who controls the supplier, and who signs off what it says.
In short
European health systems use AI mainly to support clinicians. Patient-facing use is newer and less established. Since 2 August 2026, Article 50 of the EU AI Act requires people to be told when they are talking to an AI. For a hospital, the deciding questions are about where the data goes, who controls the supplier, which national rules apply, and who is accountable when the system says something wrong.
Most AI in European hospitals helps the clinician. The systems a patient talks to directly are the smaller and less mature part of the market. Often the barrier is not the model. It is whether the system can pass a hospital’s data protection review, and what the law now asks of it.
This article sets out the public evidence and the national rules in eight EU countries that decide a procurement. It also covers what the EU AI Act has required since 2 August 2026. It ends with six questions a hospital can put to any supplier before an AI system speaks to a patient.
This article describes our reading of published law, guidance and research. It is not legal advice, and every institution should confirm its own position with its own counsel.
What patient-facing AI means
Patient-facing AI is any AI system a patient interacts with directly, rather than one a clinician uses. Intake, appointment preparation, explaining a procedure and answering routine questions about medication are patient-facing. Diagnostic support and clinical documentation are not.
The line matters for two reasons. A patient-facing system handles health data, a special category under Article 9 of the GDPR.[1] And since 2 August 2026 it falls under the disclosure duty in Article 50 of the EU AI Act.[2]
Why routine patient conversations are where the pressure falls
Administrative work takes a large share of clinicians’ time. In Germany, the Marburger Bund surveyed 9,649 employed physicians online between 27 September and 27 October 2024. They reported losing about three hours a day, on average, to unnecessary bureaucracy. Asked whether they were considering giving up patient care altogether, 28 percent said yes.[3] The respondents are the association’s own members, so this is not a representative sample of all German doctors.
The pattern is not only German. The Commonwealth Fund surveyed 10,895 primary care physicians in ten countries between 12 March and 22 September 2025. For more than two in five burned-out physicians in the United States, Canada, Germany and Switzerland, administrative burden was the main cause.[4] Three of those four countries are outside the EU, so read this as a finding about wealthy health systems in general.
The load is heaviest in routine, repeatable conversations: intake, procedure explanations, and the same preparation question for the twentieth time that week. These are conversations rather than clinical judgements.
How much patient-facing AI do EU health systems use?
Some, and less of it is established than the headline suggests. The WHO Regional Office for Europe surveyed all 27 EU Member States between June 2024 and March 2025. In 63 percent of them, 17 of 27, conversational platforms for patient assistance are in use. Only 30 percent, 8 of 27, describe that use as established. The rest are piloting or using it informally. For comparison, 74 percent use AI in diagnostics.[5]
The European Commission’s Observatory for digital health technologies, written by Capgemini Invent and IDC and published in January 2026, surveyed 300 healthcare providers across the EU. Over 94 percent were already using AI or planned to invest within four years.[6] The same study asked which uses they rank highest.
Top AI Uses Named by EU Healthcare Providers
Share of 300 providers naming each use among their top ones. Respondents could name more than one.
European Commission, Observatory for digital health technologies in Europe, January 2026.
Looking three to four years ahead, 33 percent of healthcare providers plan to invest in AI virtual health assistants and chatbots.[6] On the supply side, the study counted 83 technologies offered in the EU that are aimed at patients, against 289 aimed at providers. The report warns that one technology can sit in more than one group and that the patient count should be read with caution.
Patients themselves are open to it, on conditions. The European Patients’ Forum surveyed patients in 2025 and received 874 responses. KU Leuven analysed them in 2026. 98 percent think AI could bring benefits. 82 percent want to hear about its use from their doctor, and 70 percent fear losing the human touch. Only 17 percent said they had had a care experience involving AI.[7]
Does an AI avatar change what a patient understands?
There is early evidence that the format matters, not only the content.
At the ESTRO 2026 congress in May, a team from ChristianaCare in Delaware presented a pilot study of 1,464 patients preparing for radiotherapy. 506 watched a standard educational video. 958 watched a video presented by an AI avatar with personalised scripts. The avatar group reported a better understanding of their treatment plan, a greater ability to engage in decisions about their care, and less stress.[8]
Both groups watched pre-recorded video, so a real-time conversation is still to be tested. What the study does suggest is that how information is delivered may change what a patient takes away. That is worth testing properly, and the sector has barely started. It is one reason AI avatars in healthcare deserve their own assessment, separate from text chat.
Why data sovereignty decides patient-facing AI procurement
A hospital data protection officer looking at a patient-facing system will ask the same things every time. Where does the data go, and who processes it? Is there a transfer outside the EU, and who are the sub-processors? Is the data used to train anyone’s model?
Many products answer with a cloud region and a contract. That is often enough for a scheduling tool. For a system that hears a patient describe symptoms, a data protection officer will also ask whether the protection sits in the network or only in the contract.
“No data leaves during inference” is a common supplier claim. Inference is the model producing each answer. It is a claim about one path. The inference loop can sit entirely inside the hospital while other channels still cross the boundary.
What Crosses the Hospital Network Boundary
The inference path is the one suppliers tend to describe. The other two groups are where a buyer has to ask separately.
InferenceStays local
With local models, this loop never leaves the network.
Data the system keepsStored
- Transcripts
- Session logs
- Prompt caches
- Vector stores
- Backups
- Support snapshots
Ask where each one lives, and for how long.
- TelemetryUsage metrics
- Licence serverHeartbeat and entitlement
- Model updatesNew weights and versions
- Remote supportScreen, shell and logs
- Offsite backupEncrypted archives
Each one should be named in the contract, and disabled or closed. Each is a separate answer.
The supply side is not yet organised around this. Of 70 EU digital health vendors surveyed for the Commission’s Observatory, only 20 percent implement data sovereignty measures such as EU-based sourcing or local data storage. 13 percent use standards-based or open-source technologies.[6] That is a small sample, and it should be read as one.
There is a second layer, which is corporate rather than technical. A disclosure order follows the provider, not the server. A provider can be reached through its place of incorporation, its parent company or its business presence, wherever the data sits. We set out that argument, and the three tests a sovereign deployment has to pass, in What Is a Sovereign AI Avatar? The EU scales that can now be used to grade a provider are in Sovereign AI Avatars: The EU Criteria That Decide.
National rules for AI in EU hospitals
Sovereignty is one gate. National rules are another, and they differ by country. The table covers eight EU markets, and each one has a different first rule.
| Country | Rule | What it asks for |
|---|---|---|
| France | HDSLegal requirement | A supplier that hosts patient data for a hospital needs HDS certification, and hosting must be in the EU or EEA. It does not apply when the hospital hosts on its own systems.[9] |
| SecNumCloudNot named for hospitals | A government decree of April 2026 makes it binding on State bodies. Hospitals are not on the list, so it is not a legal requirement for them.[10] | |
| Germany | §391 SGB VBinds hospitals | Hospitals must keep their IT security state of the art. The usual route is the hospital sector standard, B3S Krankenhaus.[11][12] |
| §393 SGB VCloud processing | Cloud processing of health data is allowed in the EU or an adequate country. The supplier needs an office in Germany and a current C5 attestation.[13][14] | |
| §203 StGBBinds the clinician | Medical secrecy is criminal law. The hospital must bind any external provider to secrecy, on top of the GDPR contract.[15] | |
| Italy | ACN cloud rulesPublic hospitals | Public hospitals and local health authorities may only use cloud services qualified by ACN, the national cybersecurity agency.[16] |
| Law 132/2025, Art. 7AI in healthcare | Patients have the right to be told that AI is used. AI supports care, and the decision stays with the doctor.[17] | |
| Spain | ENSPublic hospitals and suppliers | Suppliers to public hospitals must meet the National Security Framework. Systems in the Medium and High categories need an audited certificate.[18] |
| National AI lawNot passed | Spain has not passed its national AI law, and parliament was dissolved in October 2026. The EU AI Act applies directly, supervised by AESIA.[19] | |
| Netherlands | NEN 7510Binds care providers | Care providers must secure their systems to NEN 7510 and log access to NEN 7513. The 2024 edition applies from 1 June 2026. Suppliers meet it through the contract.[20] |
| Greece | Law 5321/2026Public sector bodies | Public bodies must enter each AI system in a central register before use. Systems already running must be registered by 31 December 2026.[21] |
| Poland | Patient Rights Act, Art. 24All care providers | A hospital may outsource processing of medical records under a GDPR processor contract. The processor must keep them confidential. The contract must not delay access to them.[22] |
| AI Systems Act 2026In force | Sets up national enforcement of the EU AI Act. A new commission, KRiBSI, is the market surveillance authority.[23] | |
| Cyprus | eHealth Law 59(I)/2019National health record | Data in the national electronic health record must be stored in Cyprus. Encrypted copies are also kept at an approved site in the EU.[24] |
| Patients’ Rights Law 1(I)/2005Binds hospitals | Patient information stays confidential, and the hospital is responsible for keeping medical records safe.[25] | |
| EU | NIS2Applies to hospitals | Medium and large healthcare providers are in scope. Germany, Italy, the Netherlands, Greece, Poland and Cyprus have transposed it. France and Spain have not. Both were referred to the Court of Justice on 8 July 2026, with the Netherlands, which transposed in August.[26] |
For a supplier, the practical reading is short. Germany makes a C5 attestation a condition for cloud processing of health data. France requires HDS wherever the supplier does the hosting. Italy already gives patients a legal right to be told that AI is used. Greek public bodies must register an AI system before it goes live. ISO 13485 matters only if the product is a medical device, which is a separate question below.
One more instrument is coming. The European Health Data Space Regulation, (EU) 2025/327, has been in force since March 2025. Its rules apply in stages. Governance starts on 26 March 2027, and patient summaries and ePrescriptions follow from 26 March 2029.[27] It governs how health records are shared, not how a patient-facing system talks, so it will matter mostly where such a system writes to a record.
What does the EU AI Act require for patient-facing AI?
EU law now requires patients to be told when they are talking to an AI system.
Article 50: telling patients they are talking to an AI
Article 50 of the EU AI Act has applied since 2 August 2026. A provider must design an AI system that interacts directly with people so that they are told they are dealing with an AI. The duty does not apply where this is obvious to a reasonably well-informed, observant and circumspect person, given the context. A breach can cost up to 15 million euro or 3 percent of worldwide annual turnover, whichever is higher. For SMEs and start-ups the lower of the two applies.[2]
EU AI Act Dates for a Patient-Facing System
The AI Omnibus, Regulation (EU) 2026/1744, moved the high-risk dates. It did not move the disclosure duty.
- 2 Aug 2026
Article 50 disclosure appliesPeople must be told they are interacting with an AI.
- 2 Dec 2026
Article 50(2) marking deadlineGenerative systems placed on the market before 2 August 2026 must mark their output in a machine-readable format by this date.
- 2 Dec 2027
High-risk, Annex IIIStand-alone high-risk systems, including human oversight under Article 14.
- 2 Aug 2028
High-risk, Annex IAI built into regulated products such as medical devices.
The Omnibus came into force on 27 July 2026.[28] The disclosure duty sits on the provider. A buyer’s job is to check the provider has designed it in, and to see how it is shown and logged. Which party is the provider is not always obvious. Under Article 25, a hospital that puts its name on a high-risk system, or changes what it is for, can become the provider.
Human oversight is Article 14, not Article 50. It is a high-risk obligation, so it applies only on a high-risk classification and only from the dates above. It is still worth designing in now.
What the Commission has said about compliance
The Commission published its guidelines on the Article 50 transparency duties on 20 July 2026.[29] They are the reference for the disclosure a patient-facing system owes.
The Code of Practice on Transparency of AI-generated Content, published on 10 June 2026, covers less than its name suggests. In July 2026 the Commission found it adequate for Article 50(2), (4) and (5). It does not cover Article 50(1), the duty to tell people they are dealing with an AI.[30] It matters for an avatar in a different way. An avatar generates synthetic speech and video. Article 50(2) requires that output to be marked in a machine-readable format, so it can be detected as AI-generated.
The Commission has also published three EU icons for labelling AI-generated content. They are meant for deep fakes and AI-generated text on matters of public interest under Article 50(4). Using them is optional, and they are not the tool for telling a patient they are talking to an AI.[31]
For a buyer this turns a vague question into three specific ones. How is the AI disclosure shown at the start of a conversation, and is it logged? Does the supplier follow the Code of Practice for marking generated speech and video? And can you read that marking back without the supplier’s help?
Is a patient chatbot or AI assistant a medical device?
It depends on the intended purpose. A system that gives patients information and guidance is not the same regulated object as one that suggests a diagnosis or performs triage. The second has a medical purpose and engages the Medical Device Regulation. The first, on that purpose, generally does not.
A stated purpose does not override what the software actually does. The boundary under MDR Annex VIII Rule 11, and the MDCG 2019-11 rev.1 guidance of June 2025, is fact-specific.[32] Ask suppliers to state in writing which of the two they are selling, and which guidance they rely on.
Which GDPR legal basis applies to health data?
Explicit consent under Article 9(2)(a) is a weak basis in a hospital. The EDPB has said consent is not freely given where there is a clear imbalance of power. An inpatient about to undergo a procedure is close to the textbook case.[33]
Article 9(2)(h), the provision of health care and the management of health systems, is the more realistic route. It needs a basis in Union or Member State law, or a contract with a health professional. It needs an Article 6 basis alongside it. Under Article 9(3) the data must be processed by or under the responsibility of a person bound by professional secrecy.[1] It does not stretch to purposes outside care, such as model training. Those need their own basis. Article 35(3)(b) of the GDPR also requires a data protection impact assessment for large-scale processing of health data. Settle both before the pilot.
Which Rules Apply to Your System?
Answer five questions about the system you plan to deploy. Each yes adds a set of rules.
- 01Does it talk to patients directly?Yes AI Act, Article 50Tell people they are dealing with an AI. Applies since 2 August 2026.
- 02Does it generate speech, video or text?Yes AI Act, Article 50(2)Mark the output in a machine-readable format so it can be detected as AI-generated.
- 03Does it have a medical purpose, such as triage or diagnosis?Yes MDR, Annex VIII Rule 11It is likely a medical device. Information and guidance alone generally is not.
- 04Does it process health data?Yes GDPR, Article 9It needs a legal basis, usually Article 9(2)(h), with an Article 6 basis alongside it.
- 05Is the hospital a public body?Yes National public sector rulesCheck cloud qualification, security frameworks and AI registers, as in section 06.
Most patient-facing avatars answer yes to the first, second and fourth questions.
What on-premise deployment moves to the hospital
On-premise deployment answers the data question in the network rather than in the contract. It also moves cost and work from the supplier to the hospital, and that belongs in the decision.
Real-time avatar inference needs compute, and someone has to run it.
What the Hospital Takes On
On-premise moves five kinds of work from the supplier to the hospital.
In a cloud deployment the supplier carries all five and prices them into the subscription.
The hardware need not be a data centre build. RAVATAR runs real-time interactive avatars with all inference on a single edge device. The work with Intel is described in RAVATAR adopts Intel technologies to bring real-time interactive AI avatars to the edge. That changes the arithmetic for one kiosk or one ward.
The more outbound channels you close, the more of the monitoring falls on your own tools. Hospitals in scope of NIS2 must handle and report significant incidents, whatever the deployment model.[26] A closed system still needs monitoring, and your own team does it.
Cost on-premise over five years, hardware and people included. Then compare it on the same basis with a private cloud or an EU sovereign cloud deployment.
The risk that matters most: being wrong
Most writing about patient-facing AI, including much of this article, is about data protection. That is the compliance risk. The patient safety risk is different, and it is larger.
A system that gives a confident wrong answer about bowel preparation the night before a colonoscopy causes harm that no data protection control prevents.
What a buyer should require is clinical content governance. Who writes what the system says? Which named clinician signs it off? How is content versioned, so that in two years you can prove what a patient was told on a given date? How fast can wrong content be withdrawn from every deployed instance? What does the system do when it does not know, and is that behaviour tested rather than asserted? Ask for the evaluation method and the results.
The other half of the answer is the handover. When a conversation reaches the edge of what the system should answer, it has to reach a person.
How a Conversation Reaches a Clinician
The hospital defines the trigger and the handover. The system follows them.
Outside staffed hours, the patient is told when someone will be available and who to contact in the meantime.
Accessibility and language coverage also matter. Accessibility and language coverage decide whether a system reaches the patients who most need it. Public sector hospitals fall under the Web Accessibility Directive for their websites and apps.[34] Each country adds its own rules, such as BITV 2.0 in Germany and the RGAA in France.
Check staff representation rules before rollout. A system that can monitor staff may need the works council’s agreement. In Germany, for example, the Federal Labour Court applies this to any system objectively capable of monitoring, whatever the employer intends.[35]
Six questions to ask before deploying patient-facing AI
Roughly in the order a hospital asks them. The useful signal is which questions produce a document and which produce a promise to follow up.
- 01
Who legally controls the supplier, and under which jurisdiction?
Ask for the contracting entity, its place of incorporation and its ultimate parent. Get the answer in writing.
- 02
Who writes and signs off what the system says to patients?
Ask who approves the content and how each version is logged. Ask how fast wrong content is withdrawn everywhere.
- 03
Can it run inside our infrastructure, and what does that cost us?
Ask for the hardware list, the power draw and the staffing. Then ask for a five-year total cost of ownership.
- 04
Where does every category of data live, and what leaves the network?
Ask where transcripts, logs, caches and backups are stored. Ask for a diagram of every outbound connection.
- 05
What is the legal basis, and who are the processors?
Ask which Article 9(2) condition applies and who the processors are. Ask how the supplier is bound to medical secrecy.
- 06
How does a conversation reach a human clinician?
Ask who defines the escalation trigger and what the handover carries. Ask what happens outside staffed hours.
Where RAVATAR fits
RAVATAR builds real-time interactive AI avatars for regulated settings, including an AI doctor for patient information and an AI healthcare assistant for hospital front desks and wards.
Four deployment modes
The platform runs on-premise, on the institution’s own servers or on a single edge device. It also runs in the institution’s private cloud, on EU sovereign cloud, or on global public cloud. In the on-premise and private cloud modes it runs local models, so the language model, speech recognition and speech synthesis stay inside the institution’s environment. The steps are in the local deployment guide.
Pluggable components
The language model, speech recognition and speech synthesis layers are pluggable. In the cloud modes the institution chooses the language model in Genesis AI Avatar Studio, or brings its own through its own API key.
An EU provider
RAVATAR is incorporated and headquartered in Cyprus, inside the EU, and customers contract with the Cyprus company.
Put the six questions to us for a specific use case and configuration, and we will answer in writing.
Planning a patient-facing pilot?
Start from the deployment mode and the legal basis, then the content governance. We are glad to work through all three for your hospital.
Start a conversationFrequently asked questions
What is patient-facing AI in healthcare?
Patient-facing AI is any AI system a patient interacts with directly, rather than one a clinician uses. Intake, appointment preparation, explaining a procedure and answering routine questions about medication are patient-facing. Diagnostic support and clinical documentation are not. The line matters for two reasons. A patient-facing system handles health data under Article 9 of the GDPR. And it falls under the disclosure duty in Article 50 of the EU AI Act.
Does the EU AI Act require patients to be told they are talking to an AI?
Yes. Article 50 of the EU AI Act has applied since 2 August 2026. A provider must design an AI system that interacts directly with people so that they are told they are dealing with an AI. The only exception is where this is obvious to a reasonably well-informed, observant and circumspect person, given the context. A breach can cost up to 15 million euro or 3 percent of worldwide annual turnover, whichever is higher, with the lower figure for SMEs and start-ups. The AI Omnibus did not delay this duty.
Does the AI Act Code of Practice cover Article 50(1) disclosure?
No. The Commission found the Code of Practice on Transparency of AI-generated Content adequate for Article 50(2), (4) and (5) of the AI Act. It does not cover Article 50(1), the duty to tell people they are dealing with an AI. For an avatar the Code matters for marking its generated speech and video under Article 50(2). The disclosure duty is judged against the Act and the Commission’s guidelines of July 2026.
Is a patient-facing AI assistant a medical device under EU rules?
It depends on the intended purpose. A system that gives patients information and guidance is generally not a medical device. One that suggests a diagnosis or performs triage has a medical purpose and engages the Medical Device Regulation. The boundary under MDR Annex VIII Rule 11 and the MDCG 2019-11 rev.1 guidance is fact-specific. Each product needs its own assessment, and a stated purpose does not override what the software does.
Is a hospital a provider or a deployer under the AI Act?
Usually a deployer. The supplier that places the system on the market is the provider and carries the Article 50 design duty. Under Article 25, a hospital that puts its name on a high-risk system, or changes its intended purpose, can become the provider.
Which certifications should a patient-facing AI vendor hold in the EU?
It depends on the country and on who does the hosting. In France, a supplier hosting health data for a healthcare establishment needs HDS certification. In Germany, cloud processing of health data needs a current C5 attestation. In Italy, public hospitals may only use cloud services qualified by ACN. A hospital hosting on its own systems needs no HDS hosting provider. ISO 13485 matters only where the product is a medical device.
What legal basis applies to patient-facing AI in a hospital?
Usually Article 9(2)(h) of the GDPR, covering the provision of health care and the management of health systems. It needs a basis in Union or Member State law or a contract with a health professional. It also needs an Article 6 basis alongside it, and processing under the responsibility of a person bound by professional secrecy. Explicit consent is weak in a hospital because of the imbalance of power. Purposes outside care, such as model training, need their own basis.
Why does on-premise deployment matter for patient-facing AI?
It answers the data protection question in the network rather than in a contract. The claim still needs testing. “No data leaves during inference” covers one path. Ask where transcripts, logs, caches, backups and support snapshots live, and which update, telemetry, licensing and support channels cross the boundary. On-premise also moves cost to the hospital, which belongs in a five-year total cost of ownership.
Sources
Every figure and legal statement in this article is traceable to one of these. Where a source carries a caveat, the caveat is in the text.
- Regulation (EU) 2016/679, General Data Protection Regulation, Articles 6, 9, 28, 30 and 35. eur-lex.europa.eu
- Regulation (EU) 2024/1689, the EU AI Act, Articles 14, 50, 99(4), 99(6) and 113, consolidated text as at 27 July 2026. ai-act-service-desk.ec.europa.eu
- Marburger Bund, MB-Monitor 2024, summary of results, February 2025. Online survey of 9,649 employed member physicians, 27 September to 27 October 2024, run by IQME. marburger-bund.de
- The Commonwealth Fund, The Causes and Impacts of Burnout Among Primary Care Physicians in 10 Countries, November 2025. 10,895 physicians, fielded 12 March to 22 September 2025. commonwealthfund.org
- WHO Regional Office for Europe, Artificial intelligence is reshaping health systems: state of readiness across the European Union, 20 April 2026. Data collected June 2024 to March 2025 from all 27 Member States. who.int
- European Commission, DG CNECT, Observatory for digital health technologies in Europe, final report by Capgemini Invent and IDC, January 2026, doi 10.2759/8361180. Surveys of 300 providers and 70 vendors. op.europa.eu
- European Patients’ Forum, AI Survey Report 2026, 28 May 2026. 874 responses to a 2025 survey, analysed with KU Leuven. eu-patient.eu
- ESTRO, release of 16 May 2026 on the study by Dr Adam Raben and colleagues, ChristianaCare, Newark, Delaware, presented at ESTRO 2026. 1,464 radiotherapy patients. ChristianaCare describes it as a pilot study. eurekalert.org and christianacare.org
- Code de la santé publique, Article L.1111-8, the arrêté of 26 April 2024 on the HDS référentiel, and décret n° 2026-209 of 24 March 2026 on EU and EEA storage. This summary follows the ANS page and legal commentary. esante.gouv.fr and cms.law
- Décret n° 2026-272 of 14 April 2026, as reported by the Banque des Territoires. Arrêté of 12 August 2026 approving SecNumCloud version 3.2, as reported by LexisVeille, lexisveille.fr. banquedesterritoires.fr
- §391 SGB V, IT-Sicherheit in Krankenhäusern, introduced by the Digital-Gesetz with effect from 26 March 2024, replacing §75c SGB V. gesetze-im-internet.de
- BSI, B3S Medizinische Versorgung im Krankenhaus, Deutsche Krankenhausgesellschaft, version 1.3.1, suitability confirmed until November 2028. bsi.bund.de
- §393 SGB V, Cloud-Einsatz im Gesundheitswesen. gesetze-im-internet.de
- BSI, press release of 7 April 2026 on C5:2026, and the C5 FAQ on the transition for attestations from 1 June 2027. bsi.bund.de
- §203 Strafgesetzbuch, Verletzung von Privatgeheimnissen, paragraphs 3 and 4. gesetze-im-internet.de
- Agenzia per la Cybersicurezza Nazionale, Regolamento per le infrastrutture digitali e per i servizi cloud per la pubblica amministrazione, applicable from 1 August 2024. acn.gov.it
- Legge 23 settembre 2025, n. 132, Disposizioni e deleghe al Governo in materia di intelligenza artificiale, Article 7, in force 10 October 2025. normattiva.it
- Real Decreto 311/2022, Esquema Nacional de Seguridad, Articles 2 and 38 and Annex I, as amended. boe.es
- Real Decreto 806/2026 of 5 October 2026 dissolving the Cortes Generales and calling elections for 29 November 2026, and Real Decreto 729/2023 on the statute of AESIA. boe.es
- Dutch Besluit elektronische gegevensverwerking door zorgaanbieders, Articles 3 and 5, and the ministerial notice of 7 May 2026 designating NEN 7510-1:2024 and NEN 7510-2:2024+A1:2026 from 1 June 2026, Stcrt. 2026, 17743. officielebekendmakingen.nl
- Greek Law 5321/2026, Government Gazette A 114 of 20 July 2026, Articles 21, 25 and 26, which also repealed the AI provisions of Law 4961/2022. taxheaven.gr
- Polish Act of 6 November 2008 on Patient Rights and the Patient Rights Ombudsman, Article 24(5) to (7), consolidated text Dz.U. 2024 poz. 581. sejm.gov.pl
- Polish Act of 3 July 2026 on artificial intelligence systems, Dz.U. 2026 poz. 1003, Article 5(1). sejm.gov.pl
- Cyprus eHealth Law 59(I)/2019, section 30(3) and (4). cylaw.org
- Cyprus Safeguarding and Protection of Patients’ Rights Law 1(I)/2005, sections 15 and 17. cylaw.org
- Directive (EU) 2022/2555 (NIS2), Annex I. National laws: Germany NIS2UmsuCG, in force 6 December 2025. Italy D.lgs. 4 settembre 2024, n. 138. Greece Law 5160/2024. Poland Act of 23 January 2026, Dz.U. 2026 poz. 252, in force 3 April 2026. Netherlands Cyberbeveiligingswet, in force 15 August 2026 under Stb. 2026, 189. Cyprus Law 60(I)/2025, in force 25 April 2025. European Commission, Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose rules, 8 July 2026. digital-strategy.ec.europa.eu
- Regulation (EU) 2025/327 on the European Health Data Space, and the Commission’s questions and answers on its application dates. health.ec.europa.eu
- Regulation (EU) 2026/1744, the AI Omnibus, published 24 July 2026, in force 27 July 2026, including the new Article 111(4) of the AI Act on the 2 December 2026 marking deadline. ai-act-service-desk.ec.europa.eu
- European Commission, guidelines on the transparency obligations for providers and deployers of AI systems under Article 50, published 20 July 2026. digital-strategy.ec.europa.eu
- European Commission, Commission opinion on the assessment of the Code of Practice on Transparency of AI-generated Content, July 2026. The Code was published on 10 June 2026 and found adequate for Article 50(2), (4) and (5). digital-strategy.ec.europa.eu
- European Commission, EU icons for labelling AI-generated content. Three icons in four variants. Their use is optional. digital-strategy.ec.europa.eu
- Regulation (EU) 2017/745, Medical Device Regulation, Annex VIII Rule 11, and MDCG 2019-11 rev.1, Guidance on qualification and classification of software under the MDR and IVDR, June 2025. health.ec.europa.eu
- European Data Protection Board, Opinion 3/2019 on the interplay between the Clinical Trials Regulation and the GDPR, 23 January 2019, paragraph 20 on imbalance of power. edpb.europa.eu
- Directive (EU) 2016/2102 on the accessibility of the websites and mobile applications of public sector bodies, and §12 Behindertengleichstellungsgesetz on federal bodies. eur-lex.europa.eu
- §87(1) No. 6 Betriebsverfassungsgesetz, and Federal Labour Court, decision of 13 December 2016, 1 ABR 7/15. gesetze-im-internet.de
