The EU AI Act in the medical practice: AI literacy under Art. 4 and what applies to documentation software
A practice that uses an AI system professionally is a deployer within the meaning of the AI Act, Regulation (EU) 2024/1689. For tools that are not classified as high-risk, one duty follows from that role above all: Art. 4 requires measures that support the AI literacy of the people operating the system. That rule has applied since 2 February 2025; its current wording comes from the amending Regulation (EU) 2026/1744 of July 2026.
Reviewed editorially against product behaviour and the stated primary sources; not individual medical or legal advice.
This overview is general information, not legal advice. Which content, deadlines and forms apply to a specific practice should be clarified with the practice's own legal or data protection advisers.
Which role the practice has in the Regulation
Regulation (EU) 2024/1689 draws its main distinction between providers and deployers. Under Art. 3(4) a deployer is anyone using an AI system under their own responsibility, except where it is used in the course of a personal, non-professional activity. A practice using a tool in the consulting room is therefore a deployer, even if it only bought the tool.
The provider role stays with the manufacturer. It carries the heavier duties, on conformity and technical documentation among others. For the practice the decisive question is therefore not what duties exist in total, but which of them attach to the deployer role.
The overview below shows the duties attached to the deployer role, with the date from which each applies. Several rows only apply if the practice uses a particular kind of system.
| Duty | Provision | Applies from | Relevant to the practice if |
|---|---|---|---|
| Take measures on the AI literacy of staff and others acting on its behalf | Art. 4 as amended by Regulation (EU) 2026/1744 | 2 February 2025 | it uses an AI system professionally |
| Use no prohibited practices | Art. 5 (Chapter II) | 2 February 2025 | always; the prohibitions apply to any use |
| Inform the people affected that the system is in operation | Art. 50(3) | 2 August 2026 | it operates an emotion recognition or biometric categorisation system |
| Disclose that content is artificially generated | Art. 50(4) | 2 August 2026 | it creates deepfakes or publishes AI text on matters of public interest; for text the duty falls away with human review and editorial responsibility |
| Use according to the instructions, assign human oversight, monitor operation | Art. 26 for high-risk systems under Annex III | 2 December 2027 | it uses a high-risk system under Annex III |
| The same deployer duties | Art. 26 for high-risk systems under Art. 6(1) and Annex I | 2 August 2028 | it uses an AI system that, as a medical device, is subject to assessment by a notified body |
Read in the official text of Regulation (EU) 2024/1689 and amending Regulation (EU) 2026/1744 on EUR-Lex. The high-risk dates are the amended ones under Art. 113(3)(c).
Legal texts read (6)
Art. 4: AI literacy, and what is meant by it
Art. 4 obliges providers and deployers to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use on their behalf. That is its wording since the amending Regulation (EU) 2026/1744 of July 2026; before, it required them to ensure, to their best extent, a sufficient level of AI literacy.
Art. 3(56) defines AI literacy as the skills, knowledge and understanding that allow systems to be deployed knowledgeably. That is deliberately not a certificate and not a number of training days, but an outcome: whoever operates the tool should know what it does, where it errs, and when an output has to be checked.
For a practice this is more a question of induction than of continuing education. Whoever records should be able to explain what is being captured; whoever reviews the draft should know that the review is the point at which a draft becomes documentation.
What applies since when
The Regulation was published in the Official Journal in July 2024 and entered into force in August 2024. Its application is staged, and the stages are set out in Art. 113.
- 2 February 2025: Chapters I and II, general provisions, prohibited practices and Art. 4.
- 2 August 2025: among others the rules on general-purpose AI models and the governance chapters.
- 2 August 2026: the rest of the Regulation, including the transparency duties under Art. 50, but not yet the requirements for high-risk systems.
- 2 December 2027: the requirements for stand-alone high-risk systems under Annex III.
- 2 August 2028: Art. 6(1), that is high-risk systems in regulated products such as medical devices. Regulation (EU) 2026/1744 moved both high-risk dates; before, they were 2 August 2026 and 2 August 2027.
When a tool counts as a high-risk system
Art. 6(1) ties classification to product law: a system is high-risk if it is a of, or itself is, a product covered by the Union legislation listed in Annex I, and a is required for that product. Annex I, Section A, point 11 names the Medical Devices Regulation (EU) 2017/745.
Alongside that stands Annex III with independently classified use cases. Its point 5 concerns access to essential services and names, under (d), certain systems used in emergency care. Documenting a consultation is not what is meant.
In practice this means classification runs through the intended purpose. A tool that makes no diagnosis and claims no medical purpose does not become a high-risk system by the Annex I route. Whether an application is a medical device is still decided under the Medical Devices Regulation, not under the AI Act.
What a practice can actually put on file
Art. 4 requires measures, not forms. A practice that still wants something in hand when asked is best served by collecting what arises anyway: who was inducted, on what, and what the tool does and does not do according to its provider.
- A short note on which people were inducted and when.
- The workflow the practice agreed on: consent, recording, review, carry-over.
- The limits of the tool as the provider describes them.
- Who decides, in case of doubt, that a draft is discarded.
- Where the data protection files sit that the GDPR requires in any case.
What the AI Act does not replace
The Regulation sits beside the existing rules. The data protection assessment still follows the GDPR, professional secrecy follows § 203 StGB, the documentation duty follows § 630f BGB. None of those assessments is settled by the AI Act, and none of them settles it.
Conversely, the AI Act does not turn a documentation tool into a medical device, nor a medical device into a harmless text tool. It adds a layer on which the practice mainly has to show one thing: that the people operating the system understand what they are working with.
Frequently asked questions
Does a medical practice have to register anything because of the AI Act?
For a tool that is not classified as high-risk, the Regulation provides no registration for deployers. The duty that follows from the deployer role is above all Art. 4: measures that support AI literacy in the team.
Since when does Art. 4 apply?
Since 2 February 2025. Chapters I and II of the Regulation have applied from that date, the rest of the Regulation since 2 August 2026. The requirements for high-risk systems apply from 2 December 2027, and for high-risk systems in regulated products under Art. 6(1) from 2 August 2028.
Is a documentation application a high-risk system?
Not simply because it runs in a practice. Art. 6(1) attaches to products under Annex I for which a third-party conformity assessment is required; Annex III lists its own use cases, and documenting a consultation is not among them.
Is a training session enough to satisfy Art. 4?
The provision requires measures that fit the context, and names knowledge, experience, education and training as factors. A documented induction into the practice's workflow is the obvious start; what is enough in a given case belongs with the practice's own legal advisers.
Does the AI Act apply if the model runs locally?
Yes. The Regulation attaches to the use of an AI system, not to where it computes. Where processing happens is a data protection question and is answered separately.