An AI chatbot on your healthcare website: what the AI Act asks

Which duty applies?

A chatbot answering questions about opening hours, registration or coverage is not high-risk AI. Article 50(1) of Regulation (EU) 2024/1689 applies: systems interacting directly with people must be designed so those people are informed they are interacting with AI, unless obvious to a reasonably well-informed person. Article 50(5) adds that the information must be clear, given at the latest at the first interaction, and accessible. A line in the privacy notice is not enough.

The duty formally lies with the provider: whoever develops a system, or has it developed, and puts it into service under its own name. A practice running a chatbot under its own name may count as provider. Show the disclosure regardless, and agree in your vendor contract who arranges what.

The dates after the Digital Omnibus

• 2 February 2025: prohibited practices and AI literacy (Article 4).
• 2 August 2026: Article 50 transparency duties, including chatbot disclosure.
• 2 December 2026: machine-readable marking of AI content (Article 50(2)) for systems on the market before 2 August 2026.
• 2 December 2027: high-risk duties under Annex III.

Regulation (EU) 2026/1744 of 8 July 2026 left Article 50(1) unchanged. It reworded Article 4: organisations take measures to support AI literacy, without guaranteeing a level per person.

GDPR still applies

People type personal details into chats quickly; on a care site that is often health data (Article 9 GDPR). You need a processor agreement, knowledge of where data is processed and how long chats are kept, a warning before the start not to share medical details, and a DPIA assessment. The Dutch Data Protection Authority warned in 2024 about breaches after staff, including at a GP practice, entered patients’ medical data into an AI chatbot, and in 2025 found mental-health chatbot apps that sometimes denied being AI. See GDPR and your contact form.

The line with medical advice

Let the assistant handle practical questions, not urgency or clinical advice. When it recognises a medical or urgent question, it refers to the practice, the GP or 112. This matters most in mental health and home care.

How we do it with Vorm

Vorm is Zorgvorm’s AI assistant; you can talk to Vorm yourself. It is visibly named as an AI assistant, nothing starts until you confirm the processing explanation and press start, the explanation says patient and medical data do not belong in the conversation, vendors and retention are in our privacy notice, and nothing is sent to us until you review and send it.

All points are on the printable healthcare website checklist.

This guide describes Dutch rules as we read them on 28 October 2026. It is general information, not legal advice. Rules and regulator guidance change; check the sources, and ask your trade association or a lawyer when your situation is specific.