Key points
- Health data is a special category under GDPR, and Member States may add their own conditions, so check the EU rule and the national rule together.1
- The scribe supplier is a processor. Article 28 requires a contract, sufficient guarantees and the clinic's authorisation before any sub-processor is added.1
- The EU has 24 official languages, and many consultations mix more than one. Test the scribe in the languages your patients actually speak.4
- AI literacy duties under the EU AI Act have applied since 2 February 2025, and high-risk rules for Annex III uses now start on 2 December 2027.3
- wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic.5
Summary
A European clinic should choose an AI scribe that treats health data as GDPR special category data, signs an Article 28 processor contract, names every sub-processor, hosts records in the clinic's own country and works in the languages its patients speak. It should also give a written answer on how the product sits under the EU AI Act, and support the clinic's own AI literacy duties.
Every consultation is drafted in the patient's language, with the records kept in the clinic's own country under a processor contract that stands up to scrutiny. GDPR sets the common rules across the EU and each Member State adds its own conditions on health data, so settle the legal basis, the processor contract, the hosting country and the language before the first consultation is recorded.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee where your clinic's records would be hosted, who processes them and how a consultation in your language becomes a signed note.
| Requirement | Rule | What to ask the supplier | What to file |
|---|---|---|---|
| Health data handled as special category | GDPR Article 9 | How is health data separated, encrypted and accessed | The supplier's written answer |
| National conditions on health data | GDPR Article 9(4) and national law | Which national rules does hosting follow for our country | Hosting country in the contract |
| Processor contract | GDPR Article 28(3) | Send the data processing agreement before the pilot | Signed agreement |
| Sub-processors | GDPR Article 28(2) | Name each one, its location and how changes are notified | Current list with notice period |
| Impact assessment | GDPR Article 35 | Provide the information our assessment needs | Completed assessment |
| Languages | Clinic's own patient mix | Run five consultations in our patients' languages | Scored test notes |
| AI literacy | EU AI Act Article 4 | What training and guidance come with the product | Training record per user |
| AI Act classification | EU AI Act, as amended in 2026 | How is the product classified, and why | Written classification |
| Exit | GDPR Article 28(3) | Format and timetable for export and deletion | Exit terms in the contract |
Health data is a special category
GDPR treats data concerning health as a special category. Recital 35 defines it broadly, as all data about a person's past, current or future physical or mental health, including information collected when they register for care.1 A recorded consultation, its transcript and the note all fall inside that definition.
Article 9(4) allows each Member State to maintain or introduce further conditions, including limitations, on processing health data, so read the national rules alongside GDPR.1 Breaching the core principles or the Article 9 conditions can draw fines of up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher.1
The scribe supplier is a processor
The clinic is the controller and the scribe supplier processes on its behalf. Article 28 requires the clinic to use only processors that provide sufficient guarantees, and requires the processing to be governed by a contract.1 The supplier may not engage another processor without the clinic's prior written authorisation, and under a general authorisation it must tell the clinic of any change so the clinic can object.1
Article 35 requires a data protection impact assessment for processing on a large scale of special category data.1 Run one before go-live whatever the clinic's size, covering recording, retention and access. Our consent form template covers the patient conversation that sits beside it.
Hosting in the clinic's own country
With national conditions on health data, the sound default is to keep records in the clinic's own country and to know where every processing step happens, including the AI step. Ask each supplier to put the storage country, the processing country for transcription and drafting, and the location of every sub-processor into the contract.
wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic.5 Our guide to data residency sets out how the question is handled across jurisdictions.
Languages, tested on real consultations
The EU has 24 official languages, from Bulgarian to Swedish.4 Regional languages and the languages of visiting patients add more, and a single consultation often moves between two of them, sometimes mid-sentence.
Test on five recorded consultations in the languages your patients use, with consent. Score the note on drug names and doses first, and check that the referral letter can be drafted in the language of the colleague receiving it. The clinician reviews and signs every draft, in every language.
What the EU AI Act asks of a clinic
The AI Act asks providers and deployers to take measures to ensure a sufficient level of AI literacy among the staff who operate and use AI systems.2 The European Commission lists the AI literacy obligations as applying since 2 February 2025, so a clinic using a scribe should record who was trained and on what.3
The high-risk timetable moved in 2026. After the AI Omnibus, rules for high-risk uses in Annex III apply from 2 December 2027, and rules for high-risk AI embedded in regulated products such as medical devices from 2 August 2028.3 Ask each supplier how it classifies its product under the Act, and file the answer in writing.
One record for the consultation and the front desk
wai drafts the note during the consultation and the letters and suggested codes after it, for the clinician to review and sign. The same record runs the front desk, where every patient reply is drafted for the team to approve before it sends.
Every sub-processor is named with what it does and the data processing agreement in place, with thirty days notice before anything changes, and every message, draft, approval and signature is written to an event log the clinic can export.5
Where to start
Name the national rules on health data that apply to your clinic and the supervisory authority you answer to. Draft the impact assessment, then send each shortlisted supplier the questions in the table below.
Run the language test on your own consultations, train the clinicians who will use the scribe and keep a record of it. Then put hosting, sub-processors and exit terms into the contract, and use the procurement checklist to close the rest. Confirm with your own adviser how the law applies to your clinic.
Tell us the country your clinic is in and the languages your patients speak. We show where your records would be hosted and how a note is drafted.
Frequently asked questions
Does GDPR allow a clinic to use an AI scribe?
Yes, with a lawful basis for health data, a processor contract under Article 28 and the safeguards the clinic's national law adds.1 Complete an impact assessment before go-live as well.
Must our records stay in our own country?
Is an AI scribe high-risk under the EU AI Act?
It depends on how the product is classified, which is the supplier's call to explain. After the 2026 AI Omnibus, Annex III high-risk rules apply from 2 December 2027 and rules for AI in regulated products such as medical devices from 2 August 2028.3
What does AI literacy mean for a small clinic?
Staff who use the scribe understand where it can go wrong and how to review its drafts.2 A short training session and a record of who attended is a sensible starting point.
How should we test languages?
On five recorded consultations in the languages your patients use, with consent. Score drug names and doses first, and check letters can be drafted in the recipient's language.
Sources
- 1EUR-Lex, Publications Office of the European Union, 2016Regulation (EU) 2016/679, the General Data Protection RegulationRead 14 October 2026Read source
- 2EUR-Lex, Publications Office of the European Union, 2024Regulation (EU) 2024/1689, the Artificial Intelligence Act, as publishedRead 14 October 2026Read source
- 3European Commission, 2026AI Act, regulatory framework for AIRead 14 October 2026Read source
- 4European Union, 2026LanguagesRead 14 October 2026Read source
- 5wai, 2026Security at waiRead 14 October 2026Read source
Every consultation drafted in your patients' language, every record kept at home.
Fifteen minutes on hosting, sub-processors and a note drafted from a consultation like yours. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits