The EU AI Act and psychologists: what changes for your practice

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) sets rules for providers and professional users of AI systems in the European Union. A psychologist who uses an AI tool in their practice is, in the Act's words, a "deployer". Its duties mainly cover AI literacy, prohibited practices and, for the few high-risk tools, specific rules from December 2027 or August 2028.

What the AI Act is, and what it is not

The AI Act is an EU regulation. It applies directly in France, Belgium, Luxembourg and Ireland, with no national transposition. It covers providers inside or outside the EU as soon as they place a system on the EU market, and "deployers of AI systems that have their place of establishment or are located within the Union" (Article 2).

It is a product-safety law organised by level of risk. It says nothing about the content of your notes or how long you keep them.

• The GDPR still applies. Article 2 states that EU data protection law is not affected. The French regulator CNIL writes that "The AI Act does not replace the requirements of the GDPR" and that it "remains fully competent to apply the GDPR" (CNIL Q&A, updated 17 August 2026). Patient data is still health data (see our guide to GDPR-compliant AI scribes in Europe).
• Confidentiality is still your responsibility. The AI Act neither lifts nor eases professional secrecy. That is a separate analysis, covered in professional confidentiality and AI.
• It is not a liability regime. The Commission states that "The AI Act doesn't create criminal offences or a right to compensation" (Commission AI literacy Q&A). If a wrong report causes harm, national law and your professional rules apply.

The timeline, checked on 1 November 2026

The original timeline was changed by Regulation (EU) 2026/1744, the "Digital Omnibus on AI", of 8 July 2026, published in the Official Journal on 24 July 2026 and in force since 27 July 2026 (European Commission). These are the dates that matter to you, based on the consolidated Article 113.

• 1 August 2024. The Regulation enters into force.
• 2 February 2025. Chapters I and II apply, so the AI literacy duty (Article 4) and the prohibited practices (Article 5).
• 2 August 2025. Rules on general-purpose AI models and governance.
• 2 August 2026. General application, including the Article 50 transparency duties. National authorities start supervising from this date, according to the Commission.
• 2 December 2026. New bans added by the Omnibus (non-consensual intimate content, child sexual abuse material). Deadline for marking generated content (Article 50(2)) for providers whose systems were on the market before 2 August 2026 (Article 111(4)).
• 2 December 2027. High-risk obligations for Annex III systems (instead of 2 August 2026 as first planned).
• 2 August 2028. High-risk obligations for systems embedded in Annex I products, including medical devices.

Provider or deployer: who is who in a practice

The Regulation sets out two main roles (Article 3).

• The provider "develops an AI system" or has it developed, and places it on the market under its own name, "whether for payment or free of charge". That is your software vendor.
• The deployer is the person "using an AI system under its authority", except for personal, non-professional use. That is you, as soon as the tool supports your work as a psychologist, in private practice or in an organisation.

Some practical cases, in our reading.

• Solo private practice. You are the deployer. The vendor is the provider.
• Psychologist employed by a hospital or service. The deployer is usually the organisation that chose the tool. You are one of the people using it on its behalf, so AI literacy concerns you directly.
• You build your own tool (for example a chatbot for clients) and make it available. You become a provider, with far heavier duties.

What is banned, and what really concerns you

Article 5 has banned a closed list of practices since 2 February 2025. Three matter directly to psychologists.

• Manipulation. A system that "deploys subliminal techniques beyond a person's consciousness or purposefully manipulative or deceptive techniques" and distorts someone's behaviour so as to cause significant harm.
• Exploiting vulnerabilities linked to age, disability or a specific social or economic situation, with the same effect. Worth watching for emotional-support apps offered to minors or isolated people.
• Inferring emotions at work and in education. Banned: "the use of AI systems to infer emotions of a natural person in the areas of workplace and education institutions", "except where the use of the AI system is intended to be put in place or into the market for medical or safety reasons".

The last point is the most practical. An occupational psychologist offered a tool that analyses employees' voices or faces to measure stress, or a school psychologist faced with software that infers pupils' mood, is squarely in the banned zone. We advise you not to assume the medical exception and to ask the provider, in writing, on what basis it relies on it.

High-risk: where does a note-taking tool sit?

An AI system is high-risk through one of two routes (Article 6).

• Product route (Article 6(1) and Annex I). The system is a product, or the safety component of a product, covered by Annex I legislation and subject to third-party assessment. Annex I lists Regulation (EU) 2017/745 on medical devices. AI software that is a medical device requiring a notified body therefore falls here, with obligations from 2 August 2028.
• Use route (Article 6(2) and Annex III). Annex III lists eight areas. In health, it covers only specific cases, such as eligibility for public healthcare benefits, health insurance pricing or "emergency healthcare patient triage systems". It has no general entry on mental health or clinical documentation.

Our analysis, which is not a legal classification: an assistant that transcribes what is said or what you dictate, then drafts a report you review and approve, does not appear in Annex III. It only becomes high-risk through the product route if its manufacturer gives it a medical purpose (supporting diagnosis, predicting risk, suggesting treatment) that makes it a medical device subject to a notified body. What counts is the purpose the vendor states.

If a tool is high-risk, Article 26 requires the deployer, from the applicable date, to use it "in accordance with the instructions for use", to give human oversight to people with "the necessary competence, training and authority", to make sure input data it controls is relevant, to monitor operation, to keep logs under its control for "at least six months" and, for Annex III systems that make or help make decisions about people, to inform them. CNIL adds that for such systems a data protection impact assessment is presumed to be required from both provider and deployer.

What to do now

1. AI literacy (Article 4)

Since the Omnibus, Article 4 reads: "Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf", and this "does not require providers or deployers to guarantee any specific level of AI literacy". The duty is lighter but still there. The Commission's FAQ, written before the Omnibus, says "There is no need for a certificate" and does not intend to impose mandatory training.

In practice, we advise that you can show you know what the tool does, what it does not do, its typical errors (misreadings, a sentence given to the wrong speaker, something added that was never said) and how you correct them. Keep a simple trail: documentation read, training taken, date.

2. Informing the client

Article 50 mainly places duties on providers: telling people they are "interacting with an AI system" (a chatbot, for example) and marking generated content. Deployers must inform people exposed to emotion recognition. In our reading, a note-taking tool the client does not interact with falls outside these cases.

That does not exempt you from informing the client: the GDPR requires it for any processing of their data. We advise clear information and explicit agreement before any transcription, with the option to refuse at no cost to the therapy. Our article on patient consent for AI note-taking offers ready-to-use wording.

3. Checking the tool

CNIL advises starting from concrete needs to choose the most suitable system, having access to the system's documentation and, where possible, switching off the provider's reuse of usage data.

Checklist before using an AI tool in session

• Purpose. Does the documentation say the tool helps write, or that it suggests diagnoses, scores or decisions? If it is a medical device, which class and which marking?
• Banned practices. Does the tool infer emotions from voice or face? If so and I work in a company or a school, I do not use it.
• Hosting. Where is data stored and where does the AI process it? Is it in the EU, on certified health-data infrastructure?
• Training. Does the contract rule out, in writing, using my data to train a model?
• Minimisation. Are the client's name and identifying details removed before the AI step? Is audio kept, and for how long?
• Security. Is data encrypted in transit and at rest?
• Human oversight. Can I review, correct and approve every report before it enters the record?
• Information. Do I have written information for the client and a way to note their agreement or refusal?
• GDPR. Is my record of processing up to date? Do I need an impact assessment? Is the processor agreement signed?

To compare software on these points, see our psychologist practice software guide.

Obligations by type of use (indicative summary)

• Note-taking or writing assistant, reviewed by you : likely category outside Annex III, not a medical device unless the vendor gives it a medical purpose ; AI Act AI literacy (Article 4) ; alongside GDPR, confidentiality, client information and agreement.
• Consumer general-purpose chatbot to draft a letter : category general-purpose system ; AI Act AI literacy ; alongside no identifying data, check whether data is used for training.
• Chatbot offered to clients between sessions : category transparency, possibly a medical device depending on purpose ; AI Act clients must know they are talking to an AI (Article 50(1), a provider duty) ; mind Article 5(1)(a) and (b) for vulnerable people.
• Emotion recognition in private practice (outside work and school, where it is banned) : category high-risk (Annex III, 1(c)) ; AI Act inform the people concerned (Article 50(3)), Article 26 duties from 2 December 2027.
• Diagnostic or risk software that is a medical device with a notified body : category high-risk (Annex I) ; AI Act Article 26 from 2 August 2028, on top of medical device rules.

Common mistakes

• Thinking the AI Act only targets vendors. Article 4 applies to deployers, so to you.
• Thinking you need a certificate. You do not, according to the Commission. We advise keeping a record of your training.
• Confusing "AI Act compliant" with "GDPR compliant". They are two separate regimes. A vendor who stresses one tells you nothing about the other.
• Keeping pre-July 2026 dates for high-risk rules.
• Pasting a report into a consumer chatbot because the AI Act does not ban it. It does not, but the GDPR and confidentiality usually stand in the way.

Why Delta fits this framework

Delta is the clinical assistant for psychologists, more than a scribe: it keeps the memory of every client. Data stays in Europe, in France, on infrastructure certified for health data (HDS), and AI processing takes place in France. The client's name and identifying details are pseudonymised before the AI step. No audio file is kept: audio is only used during the session to produce the transcription. Data is never used to train a model and is encrypted in transit and at rest. To learn more, see what is Delta and our clinical document templates.

Sources

• Regulation (EU) 2024/1689 on artificial intelligence, EUR-Lex and Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex.
• European Commission AI Act Service Desk, consolidated text as at 27 July 2026 (Articles 2, 3, 4, 5, 6, 26, 50, 111, 113, Annexes I and III).
• European Commission, "AI Omnibus enters into force", July 2026.
• European Commission, AI Literacy questions and answers.
• CNIL, Entry into application of the European AI Regulation, Q&A (2024, updated 17 August 2026).