AI in healthcare clinics pays off where staff lose time to paperwork: summaries, patient correspondence, draft notes and tidying up documentation. The line is drawn at clinical decisions. Diagnosis and treatment stay with the clinician, and a system that takes part in them falls under an entirely different regulatory regime.
This article is for clinic directors, IT managers and data protection officers. We cover administrative use cases, the red lines, and why patient data is better processed on a server in the EU than through a public API. Legal position as of November 2026. This article is for information only and is not legal or medical advice.
Where AI in healthcare clinics actually helps
The safest, quickest wins are where the model drafts and a person checks and approves:
- Record summaries. The model condenses previous discharge letters, results and referrals into a short summary the doctor reviews before the appointment: a shortcut to the sources, not a replacement.
- Patient communication. Draft replies to administrative questions (opening hours, test preparation, rescheduling), reminders and follow-up messages. No medical advice, and a clear statement that an AI system is replying.
- Coding support. Suggested ICD-10 and procedure codes based on the visit description, verified by a coder or doctor before billing. The model speeds up the lookup; it does not take responsibility for the code.
- Transcription and draft visit notes. A recording of the consultation, made with the patient’s knowledge and consent, turned into text and a structured draft note that the doctor corrects and signs. We describe the technical side in our article on self-hosted transcription with Whisper and an LLM.
- Internal procedures. An assistant that answers staff questions from policies, sterilisation instructions or front-desk procedures, with a link to the source.
Red lines: what AI should not do
Trouble starts when an administrative tool quietly begins to influence clinical decisions. Rules worth sticking to:
- No autonomous diagnosis or treatment recommendations. A language model can be wrong in a convincing way. If a draft note contains a diagnosis, it must come from the doctor, not from a model suggestion.
- No patient triage without validation. Prioritising patients by urgency is a clinical decision, not an administrative one.
- No medical advice in the chatbot. A booking chatbot answers questions about appointments and hands over to staff when a question is about health.
These rules also have a regulatory basis. Software intended to diagnose, monitor or support treatment decisions may be a medical device under the EU Medical Device Regulation (MDR), with conformity assessment and CE marking. An AI system that is such a device, or part of one, may be subject to the AI Act’s high-risk requirements. Following the July 2026 amendments (Regulation (EU) 2026/1744), obligations for AI embedded in regulated products, including medical devices, apply from 2 August 2028. Annex III of the AI Act also separately lists, among others, systems for emergency patient triage. Classification depends on intended purpose and actual use, so take borderline cases to a lawyer who knows the MDR.
| Use case | Risk level | Condition for safe use |
|---|---|---|
| Record summary before a visit | Low to medium | Doctor has access to sources; summary is not added to the record without review |
| Answers to patients’ administrative questions | Low | AI disclosure; health questions routed to staff |
| Suggested ICD-10 codes | Medium | Verified by a coder or doctor before billing |
| Draft note from a visit recording | Medium | Patient informed and consenting; doctor corrects and signs; short retention of recordings |
| Diagnosis or treatment suggestions | High | Outside the scope of administrative tools; MDR and AI Act may apply |
Health data under the GDPR: a special category
Health data is a special category of personal data under Article 9 GDPR. Clinics usually process it on the basis of healthcare law, but every new tool is a new form of processing that needs to be assessed. In practice this means:
- A data protection impact assessment (DPIA) before go-live. Processing health data with new technology is a textbook case where one is required.
- Data minimisation. Summarising a follow-up visit does not need the patient’s entire history. What reaches the model should follow from the purpose.
- Role-based access. Reception, doctors and billing see different data. The AI assistant must respect the same permissions as the clinical system.
- Logs and retention. Prompts and outputs contain patient data. Decide where they are stored, who can read them and when they are deleted.
- Medical confidentiality. Passing data to an external model provider is processing on your behalf and must fit within the rules on professional secrecy and medical records.
For a full overview of GDPR, AI Act, NIS2 and DORA requirements for AI systems, see self-hosted AI and EU compliance.
Why a server in Poland rather than a public API
A public API means a chain of processors, often with processing outside the EEA and retention set by the provider. With health data, each link has to be justified in the DPIA and the processing agreement. An open-weight model on a GPU server in a Polish data centre simplifies the picture: data does not leave infrastructure you control, and you configure logging and the model version yourself.
Healthcare is also one of the sectors covered by NIS2; in Poland the directive is implemented by the amended National Cybersecurity System Act, in force since 3 April 2026. Providers in scope must manage supply chain risk, and an AI system with access to patient data is part of that chain. If you are unsure whether the rules apply to you, start with a NIS2 audit. See how we secured a 30-clinic network.
Administrative use cases do not need large infrastructure: transcription plus a mid-size model for summaries usually fits on a single GPU. A larger model or many sites is a matter of choosing the card, not changing the architecture.
How to start deploying AI in healthcare clinics
- Pick one administrative use case with a clear time cost, such as answering administrative questions or pre-visit summaries.
- Carry out a DPIA with your data protection officer and define what data reaches the model.
- Pilot it in one clinic, with mandatory staff review of every output.
- Set up logging, retention and permissions before data on all patients goes into the system.
- Train staff: what the tool does, what it does not do, and how to report errors.
FAQ: frequently asked questions
Can doctors use ChatGPT for medical documentation?
Pasting patient data into a public tool on a personal account breaches data protection and confidentiality rules. A documentation tool needs a processing agreement, a DPIA and a controlled processing location, most simply a model on the clinic’s own infrastructure or in an EU data centre. See also how to avoid data leaks to public AI tools.
Can AI make a medical diagnosis?
Administrative tools should not. Software that supports diagnosis may be a medical device under the MDR and subject to the AI Act’s high-risk requirements, with conformity assessment before it is put into use.
Do you need patient consent to record a consultation for transcription?
The patient should know about the recording and its purpose. Agree the legal basis, the information notice and the retention period for recordings with your data protection officer before the pilot starts.
Are clinics covered by NIS2?
Healthcare is a sector covered by NIS2. Whether a specific provider is an essential or important entity depends on its size, its activity and national transposition rules. In Poland, entities assess for themselves whether they meet the criteria.
Want to use AI for administrative work without sending patient data outside the EU? See our GPU servers in a Tier III, ISO 27001 certified data centre in Poland and contact us. We will size the hardware, deploy the model and help prepare the environment for your DPIA and NIS2 requirements.