Patient rights and AI medical chatbots: Alignment between the GDPR and EU AI Act

When patients open an artificial intelligence-powered medical consultation app, they typically pay little attention to its privacy policy or the data compliance regulations. 

Yet, the regulatory framework governing such online consultation services has become increasingly complex. With the EU General Data Protection Regulation and AI Act enforced concurrently in Europe, the compliance obligations under both laws present a formidable challenge that healthcare institutions and technology companies must directly confront.

While the GDPR provides a set of governance rules designed for static, recordable and traceable traditional data, healthcare AI operates as a dynamic and continuously learning technological system with ever-updating parameters. These fundamentally different natures will naturally lead to an inherent conflict.

However, the parallel regulatory regimes are not redundant. The GDPR is concerned with the governance of personal data processed by AI systems, classifying health data as "sensitive personal data" with strict protections. 

The AI Act, by contrast, targets the AI systems themselves, imposing obligations related to algorithmic systemic safety and decision-making accountability. Should a healthcare AI system be designated as high-risk, it must adhere to mandatory requirements such as algorithmic transparency, human oversight and nondiscrimination. 

What the algorithm can't tell you

Most practical difficulties arise when patients exercise their legal rights. Under Article 15 of the GDPR, patients have the right of access, entitling them to know the logic behind automated decision-making. In traditional diagnostic scenarios, a physician's judgment relies on identifiable symptoms, test results and clinical guidelines, resulting in a reasoning process that is clear, explainable and traceable.