Updated 2026-08-04 · 3 min read
First, who this binds. What follows is European Union law: the EU AI Act applies to clinics in the EU, and to anyone placing an AI assistant on the EU market. If your clinic is in the United Kingdom or the United States, no equivalent obligation is in force for you today. It's still worth reading, because in a healthcare setting the standard below is one you'd want to meet whether or not a regulator is asking.
Every time a new regulation comes out, two narratives appear: the one that says nothing changes and the one that says everything has to stop. Neither helps whoever runs a clinic and has to decide this week.
What follows is what really applies to a physiotherapy centre that handles WhatsApp with an automated assistant. It isn't legal advice: it's what we comply with and why.
Obligation 1: making it known that it's a machine
It's the one most people breach without realising, and the easiest. A system that converses with a person has to make clear that it's a system. You don't need a three-line legal notice: it's enough to introduce itself as the clinic's digital assistant in the first message and to say so if asked.
What doesn't work is the opposite: giving it a person's name, letting someone believe they're talking to reception and having them find out three messages later. That's exactly what the regulation wants to avoid, and it's also what goes down worst.
Obligation 2: staying out of what isn't its business
An assistant that books appointments is an administrative tool. One that tells a patient what's wrong with them, or whether they should worry, is getting close to ground that isn't its own, and the clinic answers for whatever is attributed to it.
That's why in ClaudIA the separation isn't a setting that can be relaxed: it notes the reason in the patient's own words, leaves it in the record and offers a slot. Assessing belongs to the physiotherapist, in the treatment room.
Obligation 3: knowing where the data is, and being able to prove it
This isn't from the AI regulation but from the GDPR, but it comes up in the same conversation. Whoever processes data on your clinic's behalf has to sign a data processing agreement, and you have to be able to say in which country it's hosted.
If a provider can't answer that in a minute, you have your answer right there.
What you can stop worrying about
You don't have to audit the model, register the clinic anywhere or hire anyone to certify anything: an assistant that informs and books isn't a high-risk system just because it's in a healthcare centre. It would be if it took clinical decisions, and ClaudIA always leaves those to the team.
Questions clinics ask
Do I have to put a legal notice in every message? No. It's enough for the assistant to introduce itself as the clinic's digital assistant and confirm it if asked. A notice repeated in every message adds nothing and makes the conversation worse.
Is my clinic responsible for what the assistant says? For what's attributed to your clinic, yes. That's why it matters so much that the assistant doesn't assess or recommend: it isn't a style preference, it's where your responsibility lies.
And if a patient asks to speak to a person? They're passed over. Anyone on your team can join the conversation and the assistant steps aside until it's switched back on.
Can the data leave the European Union? In ClaudIA it's hosted in data centres in the European Union, and the data processing agreement is signed before you start.