Evaluating AI documentation software: 12 questions for practice owners

Do not judge documentation software on a single polished demonstration alone. Check data flows, the consent process, behaviour under disruption, correction options, retention, hand-off, support and total cost in the real practice workflow.

Practice owner comparing twelve abstract criteria for documentation software

Redaktion KiPT Voice, J Medical GmbHPublished: 27 August 2026Updated: 29 August 2026

Editorially checked against product behaviour and the stated primary sources; not individual medical or legal advice.

This overview is general information, not legal advice. The practice must check the legal basis, information duties, consent process and data protection measures for its specific use with its own legal or data protection adviser.

Data flow and confidentiality

The first four questions clarify which content goes where, and who is responsible for it.

Two terms help with question 3: under Art. 28 GDPR and, for cloud services, the . The table shows which evidence you can request in writing.

1. Does the audio recording stay on the practice computer, or is it transmitted?
2. Which text content leaves the computer, for what purpose, and to which recipients?
3. Which contracts, sub-processors and technical safeguards apply?
4. When are audio, transcript and draft each deleted or retained?

Questions 1 to 4: which evidence to request As of: 27 September 2026

Evidence	What to look for	Basis
Data processing agreement	Subject, duration, nature and purpose of processing, type of data, categories of people concerned, the practice's rights and duties.	Art. 28(3) GDPR
List of sub-processors	Further processors only with the practice's prior written authorisation.	Art. 28(2) GDPR
Cloud: location and C5 attestation	Processing in Germany, the EU or a country with an adequacy decision, a branch in Germany, a current C5 attestation (Type 2 as a rule since 1 July 2025). Applies to providers of care under SGB V.	§ 393(2) to (4) SGB V
Statement on training	Whether input and output data are used for training, and whether this can be switched off.	DSK guidance on AI, section 1.9
How the system works	Information from the vendor that the practice needs for its risk assessment or data protection impact assessment.	DSK guidance on AI, section 2.3

Read in the official texts on EUR-Lex and gesetze-im-internet.de and in the German data protection authorities' guidance of 6 May 2024.

Legal texts read (5)

Workflow in the consultation room

The next four questions show whether the software holds up outside a prepared demonstration.

5. Does the application prevent a recording before the defined consent process?
6. Do pause, resume and multiple segments remain part of the same session?
7. What is preserved if the microphone, connection or a processing step fails?
8. Which spoken languages and which output language are actually supported?

Review and hand-off

The final four questions concern the path from draft into the existing practice workflow.

9. Can the doctor review the transcript, speaker attribution and draft before accepting it?
10. Do corrections stay traceable, with nothing written unreviewed into the medical record?
11. How does the approved text reach the existing practice software, and which platforms are supported?
12. What does the pilot include, how is support reached, and what costs apply afterwards?

Verify answers in the pilot

Do not settle for yes/no answers alone. Have data flows described in writing, and run through a typical appointment, a pause, a correction and a failure. Open points belong in the pilot log, with an owner and a deadline.

These steps put the pilot on a sound legal and organisational footing before the first real appointment is recorded.

Set the purpose in writingRecord what the software is used for and what it is not used for. The German data protection authorities call this essential, because only a fixed purpose shows which data is actually needed.
Sign contracts before the first appointmentConclude the data processing agreement and have the vendor and its staff bound to confidentiality in writing (§ 203(4) StGB, § 9(4) MBO-Ä).
Update your record of processingAdd the new processing, with the vendor as a recipient, to your record of processing activities (Art. 30 GDPR).
Assess the risk in advanceCheck whether a data protection impact assessment under Art. 35 GDPR is required. According to the German data protection authorities, this will often be the case when AI applications are used. If your practice has a data protection officer, involve them.
Write down the rules and train the teamDecide internally who may use the software and for what, and train the team. Where the software is an AI system under the EU AI Act, Art. 4 in its 2026 version requires deployers to support the AI literacy of their staff.

Frequently asked questions

Which question separates local from cloud-based processing?

Ask about audio and text separately. A locally installed application can process audio locally and still transmit text for a later step.

Why does failure behaviour belong in the comparison?

Because a practice workflow must stay comprehensible even during a disruption. Content already recorded should be preserved, and a later retry should be possible.

Is a product demonstration enough for the decision?

No. A limited pilot with typical appointments, interruptions and the actual hand-off shows more than a prepared, ideal run-through.