AI in the medical practice 2026: what works today, what applies legally, and what practices should check before using it
AI helps practices today mainly with speech and text: phone assistance, appointment organisation, translation during the conversation, and documentation of the consultation. The same check framework applies to all of them: where is which data processed, who is responsible, and does the clinical decision stay with the doctor? This overview sorts the use cases, summarises the rules, and links to the in-depth guides.
Editorially checked against product behaviour and the stated primary sources; not individual medical or legal advice.
This overview is general information, not legal advice. The practice must check the legal basis, information duties, consent process and data protection measures for its specific use with its own legal or data protection adviser.
Use cases that work today
The tools that have taken hold in practices work with speech and text. They take administration off staff's hands or shift writing work, and they leave the clinical decision where it belongs.
Which rule applies depends on what the tool does. The table matches typical use cases to the provision that governs each.
- Phone assistance: answering calls, capturing requests, sorting callbacks.
- Appointment organisation: requests, reminders, refilling cancellations.
- Documentation of the consultation: recording the conversation, transcribing it and ordering it as a draft.
- Doctor's letter drafts from the conversation or from the record.
- Translation: documenting a conversation held in a foreign language, in German.
- Correspondence and forms: drafts for recurring texts.
| Use in the practice | What applies | Provision |
|---|---|---|
| Phone assistant or chatbot that talks to patients | The provider must design the system so that people are told they are talking to an AI system, unless that is obvious. Applies from 2 August 2026. | Art. 50(1) and Art. 113 AI Act |
| Recording the consultation | The privately spoken word must not be recorded without authorisation. The practice therefore obtains everyone's consent beforehand. | § 201(1) no. 1 StGB |
| External vendor processes conversation content | A data processing agreement setting out the subject matter, duration, nature and purpose of the processing and the type of data. | Art. 28(3) GDPR |
| Cloud service handling health data | Processing in Germany, the EU, an equivalent state or a third country with an adequacy decision; an establishment in Germany; a current C5 attestation. | § 393(2) to (4) SGB V |
| Software the manufacturer assigns a medical purpose | It is a medical device. What counts is the purpose the manufacturer states on the label, in the instructions for use and in promotional material. | Art. 2(1) and (12) MDR |
| AI in a medical device that needs third-party conformity assessment | It counts as a high-risk AI system. The AI Act's obligations for these systems apply from 2 August 2028. | Art. 6(1) and Art. 113 AI Act as amended by Regulation (EU) 2026/1744 |
Read on 27 September 2026 in the official texts on EUR-Lex and gesetze-im-internet.de. Several rules can apply at once, for example to a recording processed by a cloud service.
What applies legally
Four sets of rules touch almost every AI application in the practice. § 201 StGB: a recording of the conversation needs the prior consent of everyone involved. § 203 StGB and GDPR: a vendor that processes conversation content is a and a ; that requires a contract, necessity and reviewed measures, with particular care for health data under Art. 9 GDPR. § 630f BGB: what enters the record is decided by the treating person, promptly and traceably.
The EU AI Act adds to this. Its Art. 4 has required measures on the AI literacy of the people who use AI systems since February 2025; since the amendment by Regulation (EU) 2026/1744, that means supporting the development of that literacy. For a practice, it means a documented briefing of the team. The National Association of Statutory Health Insurance Physicians also points out that the use of AI should be transparent to patients.
Is documentation software a medical device?
That is decided by the the manufacturer declares. A tool that exclusively reproduces and orders what was said, and suggests no diagnosis, does not pursue a medical purpose within the meaning of the Medical Device Regulation. Products that themselves deliver clinical assessments must be reviewed separately; the practice should obtain the intended purpose in writing.
Cloud, local or hybrid
For speech and text tools, the data path decides how much review is needed. Cloud tools transmit the recording or text to the vendor. Local tools process on the practice computer. Hybrid tools keep the recording local and transmit only text. Any variant can be permissible; none is automatically so. The "Cloud or local" guide takes the three data paths apart.
What to check before a pilot
A pilot at your own practice is the only measurement that counts. Before that, these points belong on one page:
- Which task should the tool take on, and how will the practice know after two weeks whether it does?
- Where are audio, text and result processed, and is that stated in the contract?
- How is consent obtained and documented, and what happens on refusal?
- Who on the team is briefed, and who is the contact for access and deletion?
- How does the result reach the practice software, and who checks it beforehand?
- What does it cost after the pilot, and does the pilot end without automatic renewal?
The guides at a glance
The knowledge section goes deeper into each of these topics: the recording and its consent, the documentation duty, long and interrupted consultations, foreign-language conversations, choosing software with twelve concrete questions, the three data paths, and the path from draft to doctor's letter. Every guide starts with the answer, names its limits, and links to the official primary sources.
Frequently asked questions
Do I have to inform patients about the use of AI?
For recordings, yes, in advance and with the option to decline. Beyond that, GDPR's information duties apply to any processing of their data, and the National Association of Statutory Health Insurance Physicians recommends transparency about the use of AI in the practice workflow.
Does the practice need a data protection impact assessment?
For processing health data with new technology, this must be checked under Art. 35 GDPR and is often the case. The practice should clarify this with its data protection adviser before the pilot begins.
Which AI is suitable for a small practice?
The one that takes on a concrete task, whose data path can be explained on one page, and that can be tested with real cases over two weeks. A recommendation without knowing the practice would not be credible.
Does AI replace documentation by the doctor?
No. It delivers a draft. Reviewing, correcting and entering it into the record remains a clinical task, and so does the responsibility for it.