Healthcare and biometric AI systems are assessed under the AI Act by route, not by sector label. A system that is, or is a safety component of, a medical device or another regulated product follows the Annex I route under Article 6(1), with conformity through the sector legislation. A system that performs a listed Annex III biometric function follows the Annex III route under Article 6(2), subject to the Article 6(3) conditions and the profiling limit. Both routes start with Article 5 prohibition screening, and both sit alongside sector law, data protection law and professional regulation, which this cluster does not replace. No guide in this cluster determines whether a specific healthcare or biometric system is high-risk or prohibited.
Why does sector not settle classification?
A sector label such as healthcare or biometrics describes where a system is used, but the AI Act classifies by intended purpose, function and legal route. A hospital can use AI for scheduling, for documentation, for clinical decision support and for access control, and each of those functions must be tested separately against Article 5, Article 6 and Annexes I and III. A biometric system can identify a person, categorise a person, infer an emotion or verify an identity, and each function has a different legal treatment. Treating the sector as the classification would therefore over-classify some systems and under-classify others, and would hide the provision that actually governs the use. The practical discipline is to write down the function, the people affected and the decision the system influences, and to test that function against the precise wording of the provision, keeping the sector context as background rather than as the answer.
Which routes matter in healthcare?
In healthcare, the Annex I route is central. Where an AI system is itself a medical device, or a safety component of a medical device, under Regulation (EU) 2017/745 on medical devices or Regulation (EU) 2017/746 on in vitro diagnostic medical devices, and third-party conformity assessment is required under that legislation, the system can be high-risk under Article 6(1), with the Chapter III requirements taken into account in the sector conformity assessment. The Annex III route can also matter where a healthcare system performs a listed function, such as a biometric function, and the two routes must be tested separately because they have different application dates: Annex III rules apply from 2 December 2027 and Annex I rules from 2 August 2028, as amended by Regulation (EU) 2026/1744. A healthcare provider should therefore map each system to its route before assigning a deadline, and should coordinate AI Act work with the medical device conformity work rather than running the two in parallel without a shared record.
For the broader regulatory framework, see healthcare and biometrics under the AI Act.
Which routes matter for biometrics?
For biometrics, the Annex III route and Article 5 are both central. Annex III point 1 lists biometric uses including remote biometric identification, biometric categorisation according to sensitive or protected attributes, and emotion recognition, each described in the Annex's own terms and subject to the conditions and exceptions in the provision. Article 5 prohibits defined biometric practices, including specified remote biometric identification in publicly accessible spaces for law enforcement purposes, subject to defined exceptions, and biometric categorisation that infers sensitive attributes, subject to its own conditions. Emotion inference in the workplace and in education is also addressed by Article 5, with an exception for medical or safety reasons that must be checked in the consolidated text. A biometric system must therefore be screened under Article 5 first, then classified under Article 6, and the function, the setting, the purpose and the person operating the system must all be recorded, since each can change the outcome.
What sector law sits alongside the AI Act?
The AI Act does not displace the sector and cross-cutting law that governs healthcare and biometrics. Medical device law governs safety, performance and conformity for devices; data protection law, including the General Data Protection Regulation and the rules for EU institutions, governs biometric and health data, which are special categories of personal data with their own conditions; professional, clinical and employment law govern who may make a decision, what oversight is required and what information must be given to patients, workers and candidates. Fundamental rights considerations, including non-discrimination and the right to an effective remedy, run through all of those regimes. A team should therefore keep a combined legal map for each system, naming each regime, the provision engaged and the owner for that regime, rather than treating the AI Act file as the whole legal position. This cluster gives no dates for sector law, and any sector date must be verified in the sector instrument itself.
How should a healthcare or biometric deployment be evidenced?
Evidence for a healthcare or biometric deployment should connect the classification, the sector conformity work, the data protection assessment, the human oversight design and the post-market monitoring into one traceable file per system version. The file should record the intended purpose, the function tested, the Article 5 screen, the Article 6 route and reasoning, the sector legislation and conformity route, the oversight assignments and the people competent to exercise them, and the monitoring and incident arrangements. Where a system affects clinical decisions or identifies or categorises people, the oversight design deserves particular attention: who can override the system, on what information, with what time and with what record of the override. The file should also record the review triggers, including changes in purpose, population, data or model, so a system that drifts from its assessed use is reassessed before the drift becomes a compliance gap.
Continue with healthcare AI and medical device law.
What does this guide not decide?
This guide does not decide whether any healthcare or biometric system is prohibited, high-risk or subject to a transparency duty, and it does not determine what a specific provider, deployer, hospital, employer or school must do. Those questions turn on the system's function, its intended purpose, its setting and the exact legal wording, and they require the consolidated AI Act text, the sector legislation and data protection law to be applied to the facts, with qualified advice where the interpretation is contested. The guide also gives no clinical, medical or biometric performance advice, and it does not assess whether a system is safe or effective for a clinical purpose, which is a sector question for the competent authorities and professionals concerned. Where a deployment affects health, identity or consequential decisions about people, confirm the position with a competent authority or legal adviser before the system is used.
Frequently asked questions
Is every healthcare AI system high-risk?
No. Classification depends on the route and function: the Annex I product route, the Annex III use-case route, the Article 6 conditions and the Article 5 screen must each be tested for the specific system. A sector label alone does not settle classification.
Must biometric systems always be screened under Article 5 first?
Yes, as a matter of method. Article 5 prohibitions on defined biometric practices should be screened before high-risk classification, because a prohibited use must not proceed to conformity work.
Does the AI Act replace medical device law?
No. For Annex I systems, the Chapter III requirements are taken into account in the sector conformity assessment under the medical device legislation. Sector law, data protection law and professional regulation apply alongside the AI Act.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗