Healthcare sector compliance: GDPR, AI Act & NIS2

Why the 'Healthcare' sector is concerned

Health data benefits from enhanced protection: its processing is in principle prohibited, except under strict exceptions (care, public interest, explicit consent). In France, this is supplemented by the obligation to use a HDS-certified hosting provider and, very frequently, to carry out a data protection impact assessment (DPIA).

Diagnostic or triage decision-support software frequently falls under high risk within the meaning of the AI Act, in combination with medical device regulations. Data quality, human oversight, and documentation requirements are at their most stringent in this context.

Finally, hospitals, clinics, and critical service providers, designated as essential entities under NIS2, bear the most demanding cybersecurity obligations — in a sector that ranks among the most targeted by ransomware, with consequences that can extend to endangering patients.

GDPR — health data, a sensitive category

The processing of health data is prohibited in principle, except under a legal exemption (care, public health interest, explicit consent). Organisations must precisely identify the exemption relied upon, carry out a DPIA for large-scale processing, and use a HDS-certified hosting provider.

The expected level of security is higher than for ordinary processing: compartmentalisation, access traceability for records, and encryption.

Key obligations

• Identify a legal exception for the processing of sensitive data.
• Conducting a DPIA for large-scale processing activities.
• Using a HDS-certified hosting provider.
• Trace and compartmentalise access to files.

AI Act — medical AI, often high-risk

AI systems used as medical devices or for triage generally fall under high risk: risk management system, quality and representativeness of training data, human oversight, technical documentation and conformity assessment.

This framework overlaps with medical device regulation; both must be coordinated rather than treated separately.

Key obligations

• Classifying clinical AI systems (most often high risk).
• Ensuring the quality of training data.
• Ensuring human oversight and transparency.
• Aligning the AI Act with medical device regulations.

NIS2 — healthcare, an essential sector

Healthcare establishments and providers above the thresholds are essential entities within the meaning of NIS2: risk management measures, incident notification, business continuity, and enhanced supervisory oversight by authorities.

The sector's high exposure to ransomware makes these obligations all the more critical: a cyber incident can bring healthcare to a standstill.

Key obligations

• Risk management measures (Article 21).
• Notification of significant incidents.
• Business continuity and recovery plan.
• Supply chain security (software vendors, service providers).

Comparative overview of regulations

How these regulations interact

All three texts converge on security and traceability. A diagnostic AI system trained on patient data combines GDPR (legal basis, DPIA, HDS hosting), the AI Act (high risk: data quality, human oversight) and NIS2 (security of the hosting infrastructure).

A cyber incident affecting this type of system is simultaneously a potential GDPR breach (to be notified within 72 hours), a NIS2 incident (to be notified on its own timeline), and a possible AI Act malfunction to be documented. Governance must therefore be cross-functional, with coordinated incident procedures rather than ones siloed by regulation.

Application timeline

• 1GDPR. In force; regular CNIL audits, heightened vigilance on health data.
• 2AI Act. High-risk: Main obligations from 2 August 2026 for high-risk systems.
• 3NIS2. French transposition nearing completion; anticipate now.
• 4HDS. Obligation in force: all health data hosting must go through a certified hosting provider.

Applicable penalties

GDPR exposes organisations to fines of up to €20M or 4% of global turnover, with authorities paying particular attention to health data. The AI Act adds higher tiers (up to €35M or 7%), and NIS2 introduces fines of up to €10M or 2% for essential entities, coupled with personal liability for senior management.

Beyond the financial penalties, the sector's specific risk is human: prolonged system unavailability or a health data breach can directly affect patient care and safety.

Compliance roadmap

• 1Map. Identify health data processing activities, clinical AI systems, and critical infrastructures.
• 2Secure the foundation. Deploy HDS hosting, compartmentalisation, access traceability, and a continuity plan — serving both GDPR and NIS2.
• 3Conduct DPIAs. Conducting impact assessments for large-scale processing activities and clinical AI systems.
• 4Aligning the AI Act and medical devices. Aligning the documentation of both frameworks for medical AI systems.
• 5Coordinate incidents. Establish coordinated notification procedures (GDPR, NIS2) and involve senior management.

How Data Comply One supports the sector

Data Comply One brings together GDPR, the AI Act and NIS2 on a single platform, with outsourced DPO and CISO services. Healthcare is one of DCO's core verticals, with templates tailored to data sensitivity (health DPIA, register, incident procedures) and hosting requirements.

This integrated approach avoids multiplying service providers across regulations that share a common foundation of security and traceability, and facilitates the coordination of notifications in the event of an incident.

Frequently asked questions