Guide · Law

Patient consent for AI recording

The patient must be informed that an AI tool supports the documentation. The information should be noted in the record. Here we go through when consent is required, how you inform the patient, and how you document it.

Last updated: June 2026

An AI tool that helps write the clinical note does not normally require formal consent from the patient. The information is processed as part of the treatment itself and the record-keeping obligation, not for a new purpose. The patient must, however, be informed that the tool is used. This follows from the duty to inform under GDPR. It is good practice to note in the record that the patient has been informed. The authorised clinician remains responsible for the note.

Does the patient have to consent to AI documentation?

As a starting point, no - not formal consent. An AI tool that supports the documentation does not process patient information for a new purpose. The note is written as part of the treatment and your record-keeping obligation under the record-keeping order. The lawful basis under GDPR follows the treatment relationship: for health data, article 9(2)(h), together with a basis in article 6. Which basis in article 6 is the right one depends on the clinic's situation - typically point (c) on a legal obligation, and for publicly funded treatment also point (e).

Consent under article 9(2)(a) is rarely the right basis in a treatment context. It can be withdrawn and is therefore a fragile basis for something you are obliged to record. The patient is, on the other hand, entitled to information. The duty to inform under GDPR articles 13-14 means that the patient must be able to understand that an AI tool is used, what it does, and how the information is processed. The distinction is decisive: you are not obtaining consent, you are fulfilling a duty to inform.

How do you inform the patient about the AI tool?

Say it briefly at the start of the consultation. For example: "I use a tool that helps write the note as we go, so I can focus on the conversation. I always read it through afterwards." The patient should know that the tool is used and be able to ask questions or ask you not to use it.

Be concrete about three things if the patient asks. The information is processed within the EU. The transcription is deleted after up to 90 days. The finished note stays in your own record system. If the patient reacts with discomfort, you can document the consultation as usual without the tool. If you want a more detailed wording, keep it ready in the clinic's information material. Read more about what the rules require in the guide on lawful AI documentation.

How do you document that the patient has been informed?

A short line in the record is enough: that the patient has been informed about the use of an AI tool for documentation. It gives a clear trail if the question is later raised, and makes the information part of your ordinary record-keeping. No separate consent forms or extra systems. If the patient opts out of the tool, note that too.

For the clinic as a whole, the broader documentation belongs in your record of processing activities under GDPR article 30 and in the data processing agreement under article 28. People's Clinic is a data processor for the information the tool processes on your behalf. The clinic remains the data controller. The individual record note is only about establishing that the patient has been informed.

What happens to the recording afterwards?

The speech is converted into a transcription, which is used to create a draft of the note. The transcription is deleted after up to 90 days. The finished note remains in your record system under the clinic's control and forms part of the ordinary record with the retention and deletion deadlines that apply there. The information is processed within the EU.

The clinician reads the draft through, corrects and approves it before it is saved. Responsibility for the content rests with the authorised clinician, not with the tool. See more under data and security.

This guide is general information about the rules - not legal advice. If you are in doubt about your clinic's situation, seek specific advice. Relevant authorities are Datatilsynet and Styrelsen for Patientsikkerhed.

What the clinics ask about.

Normally not formal consent. The note is written as part of the treatment and the record-keeping obligation, not for a new purpose. The patient must, however, be informed that an AI tool is used. This follows from the duty to inform under GDPR articles 13-14.

The treatment relationship, not consent. For health data the basis is GDPR article 9(2)(h), together with a basis in article 6 - typically point (c). Consent under point (a) is rarely the right basis, because it can be withdrawn.

Say briefly at the start of the consultation that a tool helps write the note, and that you read it through yourself. The patient should be able to ask questions or ask you not to use it.

A short line in the record is enough: that the patient has been informed about the use of an AI tool for documentation. It does not require separate consent forms. If the patient opts out of the tool, note that too.

The authorised clinician. The tool creates a draft, but the clinician reads it through, corrects and approves it before the note is saved. Responsibility for the content does not move to the tool.

The speech is converted into a transcription, which creates the draft, and is deleted after up to 90 days. The finished note remains in your record system under the clinic's control.

The information is processed within the EU. People's Clinic is a data processor under GDPR article 28; the clinic remains the data controller for the patient information.

Want to see how People's Clinic processes data and complies with the rules?

See data and security