Clinical decision-support systems that help diagnose or treat patients are treated as high-risk under the EU AI Act. Companies must keep technical documentation, ensure human oversight, and log every assisted decision. Even wellness chatbots that only give general health tips usually stay outside the high-risk rules.
The EU AI Act reaches any company whose AI output is used in the European Union — regardless of where the company is based. If your product has EU users or clients, the rules apply to you. The first question is always the same: which risk tier does your system fall into, and what duties come with that tier?
The Act sorts AI into four tiers: prohibited (banned outright), high-risk (heavy duties), limited-risk (transparency only), and minimal-risk (no mandatory duties). Most software starts in limited or minimal risk. The expensive surprises live in high-risk and prohibited — which is exactly why scanning early matters.
Under Annex III of the Act, AI used by doctors and nurses to reach diagnostic or therapeutic decisions — recommending a diagnosis, suggesting a dose, triaging images, or predicting patient deterioration — is presumed high-risk. That triggers the full high-risk package: a risk-management system (Article 9), data-governance controls (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency and user instructions (Article 13), human oversight (Article 14), and accuracy, robustness and cybersecurity requirements (Article 15). None of this is optional once your system is in scope.
Expect auditors to look for: training and validation datasets with documented provenance and consent (especially patient data under GDPR), evidence that the system was tested on the population it will actually serve, bias and drift monitoring, audit trails that log every assisted decision alongside the human override, and a named human who can review and reverse the system's output. Your codebase should already contain these hooks — a scanner can tell you which ones are missing before an inspector does.
General health-tip chatbots and fitness trackers usually stay outside the high-risk rules because they are not used for diagnosis or treatment. They still trigger limited-risk transparency duties: a chatbot must identify itself as AI, and AI-generated content needs labelling. The boundary is murky in practice — if the app can be interpreted as supporting a clinical decision, the safe assumption is high-risk.
See your score in 2 minutes. No signup, no code stored.
Scan Your Codebase NowNot by default. If it only gives general health tips and cannot influence diagnosis or treatment, it typically stays limited-risk — but must still disclose that it is AI and label AI-generated content.
AI that is, or is a safety component of, a medical device must meet both the MDR/IVDR and the AI Act (Annex I route). Standalone clinical decision-support software that is not a device follows the Annex III route under Article 6(2).
It produces evidence-based coverage of the 15 requirement areas so you know which gaps to fix. A CE mark and a formal conformity assessment still require certification work — the scan shows you where your code already satisfies and where it falls short.