Medico-social · AI Act

Healthcare & Social Care — AI Act: governing companion AI

The social and healthcare sector is beginning to use AI for planning, assessment, and referral. When it is used to assess access to essential social benefits, AI may qualify as high-risk under the AI Act. This guide clarifies the qualification process, the FRIA, and the safeguards required for vulnerable populations.

DPO / CISO team — Data Comply One Updated on 15 June 2026

In brief

  • Regulation: AI Act.
  • Organisations deploying AI assessment tools are deployers; the software vendor is the provider.
  • Qualify use cases.
  • Conducting an FRIA.
  • Supervise.
  • Up to €35M or 7% for prohibited practices and €15M or 3% for high risk, in addition to GDPR exposure.

Regulatory deadlines

The key dates of this regulation.

August 2024

Entry into force

In force

February 2025

Ban on prohibited practices

In force

August 2025

General-purpose AI models (GPAI) & governance

In force

August 2026

High-risk system obligations (Annex III)

In force

August 2027

High-risk embedded in products (Annex I)

Upcoming

What does the AI Act cover?

As in the public sector, AI assessing eligibility for essential social benefits may be classified as high-risk. Uses related to planning or administrative assistance generally fall under limited risk.

The vulnerability of audiences makes bias control and human oversight particularly critical.

Is the 'Medico-social' sector concerned?

Organisations deploying evaluation AI are deployers; the software vendor is the provider. Some deployers must carry out a FRIA.

Purely organisational uses fall under lighter regimes, while still remaining subject to GDPR.

Detailed obligations

Qualify use cases

Isolating AI from access to benefits (potentially high risk).

Conduct a FRIA

Analyse the impact on the rights of supported individuals.

Supervise

Ensuring effective human decision-making.

Control biases

Preventing any discrimination against vulnerable audiences.

Articulate with GDPR

Coordinating FRIA and DPIA.

Sanctions & risks

Up to €35M or 7% for prohibited practices and €15M or 3% for high risk, in addition to GDPR risk. A biased access AI affects vulnerable individuals.

Application timeline

  • 1Entry into force. 1 August 2024.
  • 2High risk. From 2 August 2026 for access to benefits.

Common mistakes in the sector

  • 1High risk denied. Treating an access AI as an administrative tool.
  • 2FRIA omitted. Fail to analyse the impact on rights.
  • 3Uncontrolled biases. Discriminating against vulnerable audiences.
  • 4Superficial oversight. Mechanically validating decisions.

Practical case

An organisation is piloting an AI tool for pre-assessing eligibility for a benefit. As a potentially high-risk use case, it conducts a FRIA, provides for enhanced human oversight and controls for bias, in conjunction with the DPIA.

Compliance roadmap

  1. 1

    Inventory. Map AI uses.

  2. 2

    Qualify. Isolate high risk.

  3. 3

    FRIA/DPIA. Carry out the analyses.

  4. 4

    Frame. Oversight and bias control.

  5. 5

    Monitor. Post-market monitoring and reassessment.

Frequently asked questions

If it conditions access to essential services, it may be.

Back to the Medico-social guideMedico-social & GDPR

Take action on AI Act

Free assessment or a chat with an expert dedicated to medico-social.

Start my free assessment Talk to an expert

They already trust us

See how organisations in the medico-social sector secured their compliance with DCO.

See testimonials