A hospital deploys AI: why GDPR compliance alone is not the answer

One technology, several legal questions

A hospital plans to use AI in a care pathway. The system might summarise documents, assist a clinician, support research or automate an administrative step. The product name does not settle its legal classification.

Teams need to establish the actual function, who provides and deploys it, what data is used, who makes the final decisions, how patients are affected and which rules apply at the relevant date.

A generic compliant verdict cannot substitute for that factual scoping.

Personal data and patient context

Where personal data is processed, GDPR questions include purpose, lawful basis, sensitive-data safeguards, recipients, minimisation and security. A data protection impact assessment depends on the risks of the processing and relevant legal criteria, not only the project's name.

Pseudonymisation may be useful, but does not itself resolve these questions or make personal information anonymous.

Clinical decisions and patient rights

Where a system affects clinical information or care decisions, the applicable healthcare rules and professional duties need separate review. French patient-information requirements, for example, cannot simply be reduced to a generated statement of compliance.

Human accountability and documentary evidence should be designed into the professional workflow where appropriate.

AI Act: distinguish roles, categories and timelines

The AI Act differentiates providers, deployers, system categories and requirements that begin to apply at different dates. Two AI systems used in healthcare may have very different legal duties.

Qualification should be linked to the role, intended purpose, actual use and relevant effective date, with any uncertainties visibly assigned for review.

Cybersecurity, providers and change management

Data hosting, access, incident handling, logging and service-provider terms must be assessed against the architecture and actors involved. Do not infer all required safeguards from a supplier's logo or generic security claim.

If the model, purpose, recipients or patient data changes, the organisation may need to revisit earlier assumptions and approvals.

Eight questions to ask before go-live

Use this starting checklist as a discussion aid, not a legal qualification.

• What is the AI system actually doing in the workflow?
• Who provides, deploys, configures and uses it?
• What data, recipients and purposes are documented?
• Which patient rights or professional duties may apply?
• Which laws apply now, and which are not yet in force for this case?
• What technical controls actually ran, and what were the results?
• Who reviewed exceptional or judgement-dependent decisions?
• What versions, facts and supporting records will remain available later?

One coherent regulatory case file

A useful dossier connects confirmed facts, legal sources, version history, controls, outstanding records, accountable owners and approvals. Which parts can be automated depends on the available legal corpus and reliable facts.

NELSPACE is designed to structure that cross-regulatory context. NELSIA can address integrated AI channels and NELSON selected information and decision journeys. Coverage should always be demonstrated on the actual pilot scope.