Compliance for healthcare and care providers.
Patient data makes UK GDPR documentation unavoidable, the Worker Protection Act 2023 duty covers staff facing patients and visitors, and clinical AI adds a high-risk tier on top.
Why this matters
Patient data, staff protection, and clinical AI all need documenting.
Some healthcare AI can fall within EU AI Act high-risk rules, but not every triage tool, decision-support system or patient-facing chatbot is automatically high-risk. Classification depends on the system's intended purpose, role and applicable Annex I or Annex III criteria.
A Fundamental Rights Impact Assessment is required for specified Article 27 deployers and uses, where the relevant AI Act provisions apply.
MHRA, CQC, and ICO all increasingly scrutinise AI governance during inspections.
Patient records are special category data under UK GDPR, so a DPIA, a Record of Processing Activities, and a current privacy notice are expected as standard.
The Worker Protection Act 2023 preventative duty is acute in care settings, where harassment by patients, residents, and visitors counts as third-party harassment.
Recommended packs
The two tiers most healthcare businesses need.
Clear pricing. 14-day refund.
Larger organisation, multiple entities or a wider rollout? Explore Enterprise.
Professional
For practices using AI for admin, triage support, or patient comms: Article 50 disclosures, oversight, vendor register.
- AI Acceptable Use Policy
- AI Literacy Policy
- Article 50 Transparency Disclosures
- Human Oversight SOP
- AI Incident Response Procedure
- Vendor AI Risk Register
High-Risk Ready
For relevant high-risk AI use: scoped risk and oversight documentation, with a FRIA where Article 27 applies.
- Everything in Professional
- Fundamental Rights Impact Assessment, where Article 27 applies
- Risk Management Plan
- Conformity Self-Assessment Checklist
FAQ
Common questions for healthcare.
We’re a private GP practice using AI for admin only. Are we still caught?
Clinical use does not automatically make every AI system high-risk. Classification depends on the system's intended purpose and whether the relevant Annex I or Annex III criteria apply. Administrative use can still engage other obligations depending on the system and context.
Does this replace MHRA AIaMD compliance?
No. MHRA regulates AI as a medical device. The EU AI Act is broader and covers governance, literacy, transparency, and deployer obligations. Both apply to AI-integrated clinical products.
How does this interact with CQC?
CQC inspectors increasingly ask about digital governance, including AI use. Holding documented policies helps demonstrate the “Well-led” KLOE.
What did the Digital Omnibus political agreement (May 2026) actually change?
The AI Omnibus entered into force on 27 July 2026. It extended the main Annex III high-risk timetable to 2 December 2027 and Annex I product-related high-risk rules to 2 August 2028, and simplified some requirements, including AI literacy. Article 4 still concerns measures supporting staff AI literacy; it does not require a particular certificate or a prescribed policy document. The duties and documents relevant to a business depend on its role and use case.
Has the high-risk AI deadline really moved to December 2027? What still applies now?
The AI Act applies in stages. Prohibited practices and AI literacy provisions already apply, and Article 50 transparency rules apply to the systems and content within their scope, subject to transitional provisions. Following the AI Omnibus, the main Annex III high-risk rules apply from 2 December 2027 and Annex I product-related high-risk rules from 2 August 2028. UK GDPR and existing workplace duties have their own requirements and timelines.
Does the Digital Omnibus mean we can wait until 2027 to act?
Check which provisions apply to your system and role now. Prohibited uses, relevant transparency rules, staff AI literacy measures and UK data protection duties may already require action. The Annex III high-risk transition does not suspend other applicable law, but it also does not make every future high-risk duty enforceable today. Policies and records should support the measures you actually implement.
What actually counts as a “high-risk” AI system under Annex III?
Annex III covers specified uses in areas such as recruitment, education, essential services, biometrics and law enforcement. Classification depends on the intended purpose and Article 6 criteria, including relevant exceptions. Healthcare systems may instead fall within Annex I product rules. Sector alone, or the mere use of AI, does not establish high-risk status.
Does the EU AI Act still apply to UK businesses post-Brexit?
The EU AI Act can apply to a UK provider placing AI systems on the EU market or putting them into service there, and to a UK provider or deployer where the system's output is used in the EU. Applicability depends on the role, system, intended use and Article 2 scope; using an AI tool or having EU customers does not by itself establish every obligation.
What happens if our business is not compliant?
The applicable duties, enforcement authority and penalties depend on the provision, operator role, jurisdiction and application date. The AI Act provides different maximum fines for different breaches and specific limits for SMEs. A documentation pack does not guarantee compliance or prevent enforcement. Obtain professional advice for a contested or high-stakes situation.
Reviews
What UK businesses say.
“Clausely is a total lifesaver! I used the Risk Checker and it really opened my eyes to where my business was exposed. It provided exactly the clarity I needed and gave me total peace of mind.”
Rosa Rambla Espejo
Ready to get your healthcare compliance pack?
Tailored to your business. Delivered in minutes. Defensible for years.
Not sure where you stand? Take the free compliance risk check.