AI to transcribe and summarise sessions in a health centre: what the GDPR and the AI Act say

Health data: legal basis and information

Health data are a special category (article 9 of the GDPR): in principle they cannot be processed, unless one of the exceptions in article 9.2 applies. In a health centre, the usual ones are the provision of healthcare by professionals bound by a duty of confidentiality (9.2.h and 9.3) and the patient’s explicit consent (9.2.a). The AEPD’s guide for healthcare professionals points out that you do not need to ask for consent to provide care, but informing the patient is mandatory.

Recording a session and running it through an AI is one more processing operation within the care, and the legal basis has to be designed for that use. The AEPD has not said whether article 9.2.h is enough or whether explicit consent is needed: there is room for interpretation, and this is where your data protection officer has to help you.

The information for the patient (article 13) must say who processes the data, for what purpose and on what basis, who receives them (including the AI provider), whether they leave the European Union, how long they are kept and what rights the patient has.

If the centre is a healthcare centre required to keep clinical records, Spain’s data protection law requires it to have a data protection officer (article 34.1.l of the LOPDGDD). Healthcare professionals who work on their own are exempt.

The impact assessment

Article 35 of the GDPR requires an impact assessment when processing, especially with new technologies, is likely to result in a high risk. The AEPD’s list says it is needed “in most cases” when two or more of its criteria are met, and transcribing sessions with AI already meets two: health data (criterion 4) and new technologies (criterion 10). If minors under 14 or vulnerable people are involved, criterion 9 as well.

The exception for processing that is “not large-scale” is for the professional who works alone, not for a centre. And even a professional who works alone must carry one out if the processing significantly meets two or more criteria.

If sessions are recorded

• Information, and consent if that is the legal basis, at every session: according to the AEPD, consent to record one conversation does not cover the following ones, and it must be visible throughout the session that recording is under way.
• If they are minors: under 14, processing based on consent requires the consent of the parents or guardians (article 7 of the LOPDGDD); consent to the intervention itself is governed by Ley 41/2002 (the patient autonomy law).
• A data processing agreement with the AI provider (article 28 of the GDPR): what it does with the data, that it only follows your instructions, security, sub-processors, and that it deletes or returns the data at the end.
• The provider does not train on the data: if it uses them to retrain its system, according to the AEPD it becomes the controller of that processing, with a different legal basis.
• Where they are processed: in the European Union or, if they leave it, with transfer safeguards, such as an adequacy decision (the EU-US Data Privacy Framework, for companies that have signed up to it) or standard contractual clauses.
• The audio is deleted once transcribed, and you tell people how long the voice recording and the transcript are kept.
• The professional reviews everything the AI does: according to the AEPD, a transcript is not a neutral text, and human oversight is needed.

If the transcript or the report goes into the clinical record, the retention periods apply: at least five years (article 17 of Ley 41/2002) and, in Catalonia, fifteen years for some documents (Ley 21/2000).

The AI Act after the Digital Omnibus

Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026, has postponed the obligations for high-risk systems: those for Annex III systems apply from 2 December 2027, and those for Annex I systems (medical devices, for example) from 2 August 2028.

The transparency obligations in article 50 apply from 2 August 2026. According to the Commission’s guidelines, a transcription tool does not fall under article 50.1 (telling people they are talking to an AI) and transcripts do not have to be marked; AI-generated summaries do, but that is the provider’s job (article 50.2), and those already on the market have until 2 December 2026.

AI literacy (article 4) remains after the Omnibus: anyone who uses AI systems must take measures so that their staff know how to use them, although the law no longer requires any specific level. The Commission and the Member States must help with this, especially for SMEs.

Spain has no AI law of its own: the draft organic law lapsed on 6 October 2026, when the Cortes (the Spanish Parliament) were dissolved. The AI Act applies directly, and Spain’s AI supervisory agency is AESIA.

When a session tool is high-risk

• Transcribing and producing a summary to document the session, reviewed by the professional: very probably neither high-risk nor a medical device. The MDCG 2019-11 guidance treats speech-to-text systems as general-purpose software, and the Commission’s draft guidelines give a conversation summary reviewed by a person as an example of a “narrow procedural task”.
• If it suggests diagnoses, scores risks, recommends treatments or gives clinical alerts: very probably it is software as a medical device (at least class IIa, under rule 11 of the Medical Device Regulation) and needs a notified body. It is then high-risk under Annex I, with the AI Act obligations from 2 August 2028, and the Medical Device Regulation already applies to it today.
• If it analyses the patient’s voice to infer their emotions: that is emotion recognition, high-risk under Annex III (from 2 December 2027), and the centre must already inform the people affected (article 50.3). Inferring emotions only from the text of the transcript is not, although the GDPR still applies.
• If it infers the therapist’s emotions or stress from their voice or image: in the workplace, that has been prohibited since 2 February 2025 (article 5.1.f), and the medical exception only covers medical devices with the CE marking.

What the manufacturer says also counts: if a tool’s advertising says it helps with diagnosis, that becomes its intended purpose.

What you need before bringing AI into sessions

1. The legal basis for the processing and the article 9.2 exception that covers it, decided with your data protection officer.
2. The impact assessment, done.
3. The record of processing activities and the patient information, brought up to date.
4. A consent form for recording, per session, and the parents’ or guardians’ form for minors.
5. The data processing agreement, signed with the provider.
6. An indicator that is visible while recording.
7. How long the audio is kept (not at all, once transcribed) and how long the transcript is kept.
8. Who reviews each report before it goes out, and how that is recorded.
9. Short training for the staff who will use the tool.

Questions to ask the provider

• Where are the data and the audio processed and stored: in the European Union?
• Do you sign a data processing agreement (article 28)? With which sub-processors?
• Do you train or improve your models with our data? Does the contract say so?
• When is the audio deleted? And the transcript?
• Who at your company can access the data, and is that logged?
• Does the tool analyse the voice to infer emotions or make any clinical suggestion? If so, its classification under the AI Act changes.
• Do the summaries carry the marking required by article 50.2 of the AI Act?
• What happens to the data if we stop working with you?