EU AI Act for healthcare and pharmacy

Where AI enters healthcare and pharmacy

• Documentary and regulatory assistants

  Answers drawn from circulars, procedures and sector rules. The main risk is citing a superseded document, which takes a version chain, not just a search engine.

• Software with a clinical function

  Support for diagnosis, triage or therapy. Where the software is a medical device subject to a notified body, the AI Act treats it as high risk.

• Chatbots for patients and customers

  People interacting with an AI system must know it. In healthcare, wording, stated limits and hand-over to a person matter as well.

• Work organisation

  AI-assisted rotas, workloads and staff appraisals fall under Articles 41 and 42 of Italian Legislative Decree 179/2026: human decision and an updated risk assessment.

What the rules ask

AI Act. Classification follows the system’s intended purpose and the organisation’s role. A documentary assistant and a diagnostic tool carry very different obligations; deployers of off-the-shelf systems still owe AI literacy (Article 4) and, for high-risk systems, human oversight (Article 14).

Law 132/2025. In healthcare, AI supports and the decision stays with the physician; patients are entitled to be informed about its use. Law 132/2025 and AI in healthcare.

GDPR. Health data is a special category: legal basis, minimisation, place of processing and contracts with model providers must be settled before go-live.

Product liability. Directive (EU) 2024/2853 applies from 9 December 2026 and covers software, which changes the weight of contracts and technical evidence for anyone building or customising AI tools for the sector.

What Dynamics Consulting does

• Inventory and classification

  Which AI systems a pharmacy or provider uses, including those inside management software and third-party services, and which class each falls into.

• Data boundary

  Which data may reach an external model and which may not; personal data excluded at ingestion where possible.

• Answer traceability

  A record of which document, in which version, produced an answer — what makes an error reconstructable and diligence demonstrable.

• On-premise architecture

  Where needed, retrieval, identity and audit stay inside the provider’s perimeter: on-premise AI for healthcare and sovereign AI for pharma.

Experience in the sector

Federfarma Lombarda. Regulatory assistant in production for more than 1,000 pharmacies across Milan, Lodi and Monza Brianza, built on Nexus MDS Core: document version chains, personal data excluded at ingestion, tamper-evident audit log. Full case study.

CureSicure. A pro bono service that reads public hospital data to help patients choose a facility for a condition; it keeps no usage metrics and tracks nobody. Case study.

The full service, across sectors, is described under AI Act consulting in Italy.

Frequently asked questions

Does a pharmacy using an AI assistant have AI Act obligations?

Yes, as a deployer: it needs to know which systems it uses, ensure AI literacy among the staff who use them (Article 4) and meet the obligations attached to each system’s class. A documentary assistant is normally not high risk, but it still has to be inventoried and governed.

Is clinical AI software high risk?

If it is a medical device subject to notified-body assessment, yes: the AI Act treats it as high risk through Annex I. Most obligations fall on the manufacturer, but the provider using it has its own deployer duties, including human oversight.

What does Italy’s Law 132/2025 change for healthcare providers?

It confirms that in healthcare AI is a support and the decision stays with the physician, and it gives patients the right to be informed. It does not change risk classification, which remains that of the AI Act.

Can I use a cloud model with health data?

It depends on legal basis, place of processing, contracts and security measures under the GDPR. A common answer is a hybrid architecture: data and retrieval inside the perimeter, generation on a local model or a replaceable EU endpoint.

Why does the product liability directive matter here?

Directive (EU) 2024/2853 applies from 9 December 2026 and treats software as a product. For anyone developing or modifying AI tools for healthcare, contracts and technical evidence carry more weight.