If you run a dental clinic, AI is most likely no longer a promise but a tool that reads X-rays every day. Systems like Diagnocat, Overjet or Pearl analyse panoramic and CBCT scans to detect cavities, bone loss or periapical lesions. They work, they save time, and they improve detection. And precisely because of what they do and with what data, they can place the clinic in one of the most demanding positions under the AI Act. The good news is that the path to governing it well is clear, once the classification is understood correctly.
Why image diagnosis is a serious case
The system that reads an X-ray touches two sensitive things at once: health data — a special category under Article 9 of the GDPR — and a clinical function that supports decisions about the patient. That combination is what raises the bar.
These products also typically carry CE marking as a medical device under Regulation (EU) 2017/745, which is listed in Annex I, Section A, of the AI Act. That detail isn't minor: it determines the route by which the AI Act reaches them.
The classification, precisely
Here it pays to be exact, because it's easy to mislabel the system and, with it, the calendar.
An image-diagnosis system with CE marking enters the AI Act via Annex I and Article 6(1), which requires two conditions at once: that the system is a product covered by the Annex I legislation — Regulation (EU) 2017/745 is in its Section A — or a safety component of one, and that the product "is required to undergo a third-party conformity assessment". Without the second, there is no high risk by this route; so it is worth knowing the device's class and who assessed its conformity, details the manufacturer provides. Under the Digital Omnibus, the date of application of high-risk obligations through this route moves to 2 August 2028.
Annex III, by contrast, has no entry for clinical diagnosis. Healthcare appears in its point 5 in two scenarios that are not the usual ones for a dental clinic: point (a), for public authorities assessing eligibility for healthcare benefits, and point (d), which covers "emergency healthcare patient triage systems". A system that sorted emergency patients by severity would fall there, on its own timeline: the Annex III obligations, from 2 December 2027.
This precision has an important practical consequence: the FRIA under Article 27 is an Annex III instrument, not an Annex I one, and not even for the whole of Annex III: Article 27(1) binds deployers that are bodies governed by public law or private entities providing public services, and deployers of the systems in Annex III, point 5(b) and (c). For a medical device that enters via Annex I, the FRIA is not an obligation. Presenting it as mandatory "because you use diagnostic AI" would be a legal error. The obligation that usually does apply is a different one.
The obligation that lands first: the DPIA
In a dental clinic using diagnostic AI, a data protection impact assessment (DPIA, Article 35 GDPR) is most likely needed. Article 35 GDPR requires one where the processing is likely to result in a high risk; the list published by the AEPD (Article 35(4)) specifies the types of processing: it considers one necessary in most cases where the processing meets two or more of its criteria, and two of them are usually met here: special-category data, health data, and the use of new technologies. Large scale, on the other hand, is not taken for granted: under recital 91 GDPR, processing "should not be considered to be on a large scale if the processing concerns personal data from patients or clients by an individual physician, other health care professional or lawyer". This is not a future or provisional obligation — it derives from the GDPR, which already applies.
A properly done DPIA for this case addresses, at a minimum:
- Legal basis and Article 9 exception: the Article 6 basis — often, performance of the care contract — together with an Article 9(2) exception; the usual one is point (h), for the purposes of "medical diagnosis, the provision of health or social care or treatment", which refers to the conditions and safeguards of its paragraph 3.
- International transfers: if the provider processes data outside the European Economic Area — some are US-based — an appropriate mechanism is needed (standard contractual clauses, transfer impact assessment). An EU-based provider simplifies this; one outside the EU doesn't.
- Retention of images: the period is set by national and regional health-sector rules on clinical records; the DPIA records the one that applies and where it comes from.
- Technical measures: encryption at rest and in transit, pseudonymisation of identifiers in analytics.
Human oversight, without waiting for 2028
One principle worth remembering: the system supports, it doesn't decide. Where the system is high-risk, Article 26(2) will require human oversight to be assigned to people with "the necessary competence, training and authority". Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach Annex I, Section B products. Until then, having the clinician review the output and never decide the treatment based solely on what the AI proposes is good clinical practice. A false negative from the system cannot become a clinical decision without human judgement in between. And it's worth having a written procedure for what to do when a result is anomalous.
And the rest of the clinic's stack
Not everything in a clinic is high-risk diagnosis. The typical inventory includes lower-exposure systems that also need classifying:
- Appointment-booking chatbot: interacts with patients, so Article 50(1) transparency applies from 2 August 2026 — an obligation of the provider (the system must be designed so patients know they're talking to an AI); as deployer, the clinic checks that its provider has it in place. If the chatbot gets into symptoms or medical guidance, the risk level rises and a DPIA may be required.
- No-show prediction and schedule optimisation: normally no specific AI Act obligations. Watch out if the system ends up denying appointments to those it "predicts" will not show up without anyone reviewing it: a decision based solely on automated processing that produces legal effects for the patient or similarly significantly affects them falls under Article 22 GDPR.
- Office productivity copilots for administrative tasks: general-purpose, low risk, but they still count for the inventory and for the Article 4 AI literacy measures.
What to do now, without drama
The message for a clinic isn't alarm; it's order. With the Omnibus, high-risk obligations via the medical-device route have runway until 2028. But there are three things worth closing now:
- A complete inventory of every AI system in the clinic — including those at different sites, which often run different software; this is how it looks in a complete case on the dental demo.
- A DPIA for image diagnosis and for any other processing that requires one. It is the obligation most likely to apply already.
- AI literacy measures and a use policy for clinical staff (Article 4), with traceable evidence.
Getting this right isn't about buying peace of mind or displaying a seal. It's about having documentation that's reviewed, auditable, and ready to defend — with substance — that the clinic uses AI as it should.
Content in accordance with Articles 4, 6, 26, 27 and 50 and Annexes I and III of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, and Articles 9, 22 and 35 and recital 91 of Regulation (EU) 2016/679.
Mentions of commercial products are descriptive of the market and do not imply any commercial relationship. This article is for informational purposes only and does not constitute legal advice.