[{"data":1,"prerenderedAt":279},["ShallowReactive",2],{"uc-reg-hipaa":3},{"regulation":4,"includeUnpublished":11,"indexable":12,"useCases":13},{"id":5,"label":6,"issuer":7,"region":8,"url":9,"description":10},"hipaa","HIPAA","US Department of Health and Human Services","north-america","https://www.hhs.gov/hipaa/index.html","US rules for the privacy and security of protected health information.",false,true,[14,47,73,99,121,141,168,186,213,234,250,267],{"slug":15,"title":16,"shortTitle":17,"definition":18,"status":19,"industries":20,"functions":24,"patterns":27,"audience":32,"autonomy":33,"adoptionStage":34,"evidenceCount":35,"publicEvidenceCount":36,"organizations":37,"bestGrade":42,"headline":43,"lastVerified":44,"indexable":12,"euAiActTier":45,"euAiActBasis":46},"outbound-reminder-and-confirmation-agent","AI agent for outbound reminders and confirmations by voice and messaging","Outbound reminders and confirmations","An AI agent that contacts customers about something they already booked or ordered (an appointment, a delivery, a reservation or a service visit) to remind them, confirm attendance and let them cancel or move it in the same conversation, by phone, SMS, WhatsApp or email. It is operational service outreach, not marketing: nothing is sold, and success is measured in kept appointments and reused slots, not in conversion.","published",[21,22,23],"cross-industry","healthcare","government",[25,26],"customer-service","operations",[28,29,30,31],"voice-agent","conversational-agent","agentic-workflow","prediction-and-scoring","customer-facing","supervised-agent","early-adopters",5,4,[38,39,40,41],"Sheffield Children's NHS Foundation Trust","University Hospitals Coventry and Warwickshire NHS Trust","U.S. Department of Veterans Affairs","WellSpan Health","B",null,"2026-09-26","context-dependent","People must be told they are interacting with an AI system, and synthetic voice or text must be identifiable as such (Article 50). Reminding people of existing bookings and disclosure alone are limited risk. A missed appointment score used by or for a public authority to grant, reduce, revoke or reclaim access to healthcare or other essential public assistance and services, for example deciding who is offered funded transport, can fall within Annex III point 5(a), and profiling of natural persons within Annex III rules out the Article 6(3) exemption. Using the score only to decide who gets extra reminders or support does not by itself place it outside Annex III when that support is itself the assistance being granted.",{"slug":48,"title":49,"shortTitle":50,"definition":51,"status":19,"industries":52,"functions":53,"patterns":54,"audience":32,"autonomy":33,"adoptionStage":34,"evidenceCount":55,"publicEvidenceCount":56,"organizations":57,"bestGrade":42,"headline":61,"lastVerified":71,"indexable":12,"euAiActTier":45,"euAiActBasis":72},"patient-appointment-scheduling-and-reminders-agent","AI agent for patient appointment scheduling, reminders and no show reduction","Patient scheduling and reminders","An AI agent that books, moves and cancels patient appointments by phone and messaging while following the provider's scheduling rules (referral, triage level, clinician and visit type, preparation), confirms and reminds patients in two way conversations, predicts who is likely to miss an appointment, and offers freed slots to patients on the waiting list. Unlike a general branch and appointment booking agent, it writes into the electronic health record and must respect clinical constraints, so anything clinical goes to staff.",[22],[25,26],[28,29,31,30],9,6,[58,59,60,38,39,41],"Audibel","Howard Brown Health","Mid and South Essex NHS Foundation Trust",{"kpi":62,"label":63,"unit":64,"n":65,"nUpTo":66,"kind":67,"value":68,"qualifier":69,"claimant":70,"organization":59,"vendorReported":12},"containment-rate","Containment rate","percent",1,0,"reported",30,"exact","vendor","2026-09-27","Booking, rescheduling and reminders carry transparency duties: patients must be told they are dealing with AI (Article 50(1)). It becomes high risk if a public authority, or a provider acting on its behalf, uses it to evaluate eligibility for healthcare services (Annex III point 5(a)), or if it acts as an emergency healthcare patient triage system (Annex III point 5(d)). Clinical triage may also make it a medical device, which is high risk under Article 6(1) when the device needs a notified body assessment. Keep the agent to scheduling and use risk scores only to offer support.",{"slug":74,"title":75,"shortTitle":76,"definition":77,"status":19,"industries":78,"functions":79,"patterns":81,"audience":85,"autonomy":86,"adoptionStage":87,"evidenceCount":88,"publicEvidenceCount":88,"organizations":89,"bestGrade":42,"headline":93,"lastVerified":71,"indexable":12,"euAiActTier":45,"euAiActBasis":98},"ambient-clinical-documentation","AI ambient scribe for clinical documentation","Ambient clinical documentation","An AI scribe that listens, with the patient's consent, to the conversation between a clinician and a patient and drafts the clinical note, and often the letter or after visit summary, for the clinician to review, edit and sign in the health record. It documents; it does not diagnose or decide on treatment.",[22],[26,80],"knowledge-management",[82,83,84],"speech-analytics","summarization","content-generation","employee-facing","copilot","mainstream",3,[90,91,92],"Great Ormond Street Hospital for Children NHS Foundation Trust","Kaiser Permanente","US Department of Veterans Affairs, Veterans Health Administration",{"kpi":94,"label":95,"unit":64,"n":65,"nUpTo":66,"kind":67,"value":96,"qualifier":69,"claimant":97,"organization":90,"vendorReported":11},"handling-time-reduction","Handling time reduction",8.2,"organization","A scribe that only transcribes and summarises for a clinician to review is not listed in Annex III and is usually minimal risk, although the provider of a system that generates text can still owe the Article 50(2) duty to mark output as AI generated, unless an exception such as an assistive function for standard editing applies. If the product qualifies as medical device software under the EU Medical Device Regulation and needs a notified body assessment, for example because it suggests diagnoses or treatment, it becomes high risk under Article 6(1) and Annex I. Health data in audio and notes falls under GDPR Article 9 in every case.",{"slug":100,"title":101,"shortTitle":102,"definition":103,"status":19,"industries":104,"functions":106,"patterns":108,"audience":85,"autonomy":111,"adoptionStage":34,"evidenceCount":88,"publicEvidenceCount":88,"organizations":112,"bestGrade":42,"headline":116,"lastVerified":71,"indexable":12,"euAiActTier":45,"euAiActBasis":120},"clinical-trial-patient-matching","AI clinical trial patient matching and prescreening","Clinical trial patient matching","AI that reads structured data and clinical notes in the health record, compares each patient with the inclusion and exclusion criteria of open clinical trials, and gives research staff and treating clinicians a ranked list of likely eligible patients with the evidence for each criterion, so that people confirm eligibility and invite the patient.",[22,105],"pharma-and-life-sciences",[26,107],"analytics-and-reporting",[109,110],"document-processing","classification-and-routing","assist",[113,114,115],"Cleveland Clinic","Mount Sinai Health System","Yale Cancer Center",{"kpi":117,"label":118,"unit":64,"n":65,"nUpTo":66,"kind":67,"value":119,"qualifier":69,"claimant":97,"organization":113,"vendorReported":11},"accuracy","Accuracy",100,"Prescreening for research that staff verify is not listed in Annex III and is usually minimal risk. The Article 2(6) exclusion covers only systems developed and put into service for the sole purpose of scientific research and development, so an operational recruitment tool used across a health system usually falls inside the Act. If the software recommends trials to a clinician as a treatment option for an individual patient, it may qualify as medical device software under the Medical Device Regulation; where that needs a notified body assessment, it is high risk under Article 6(1). Processing health records for research falls under GDPR Article 9 and national research rules.",{"slug":122,"title":123,"shortTitle":124,"definition":125,"status":19,"industries":126,"functions":127,"patterns":128,"audience":85,"autonomy":111,"adoptionStage":34,"segment":130,"evidenceCount":131,"publicEvidenceCount":131,"organizations":132,"bestGrade":42,"headline":135,"lastVerified":139,"indexable":12,"euAiActTier":45,"euAiActBasis":140},"hospital-bed-and-staff-capacity-command-center","AI command center for hospital bed and staff capacity planning","Hospital capacity command center","An AI powered operations center that predicts patient admissions, discharges and transfers across a hospital or health system, and helps a team of coordinators sitting in one room sequence real time bed assignments, staffing levels and patient moves, so patients get into the right bed faster and existing capacity is used fully without adding beds.",[22],[26,107],[31,110,129],"anomaly-detection","hospital operations",2,[133,134],"Humber River Health","Johns Hopkins Medicine",{"kpi":136,"label":137,"unit":64,"n":131,"nUpTo":66,"kind":67,"value":138,"qualifier":69,"claimant":97,"organization":134,"vendorReported":11},"processing-time-reduction","Cycle time reduction",38,"2026-09-28","The tier depends on what the system is scoped to do. A design limited to occupancy and discharge forecasting and to sequencing bed assignments for patients already admitted is operational decision support for hospital logistics, outside Annex III. Annex III point 5(d) covers AI used \"to dispatch, or to establish priority in the dispatching of, emergency first response services\", including medical aid and emergency healthcare patient triage systems. On a plain reading, that point can apply when a system dispatches, or sets the priority of dispatching, ambulance or critical care transport itself (work similar to what the Johns Hopkins center's Lifeline transport staff do for helicopter and ambulance transfers), or when it assesses the clinical urgency of an emergency patient, that is, triage. Sequencing which already admitted ED patient gets the next ward bed, and deciding whether to accept an inter hospital transfer request on capacity grounds, are not listed activities under 5(d) as written; whether either counts as dispatching or triage in a given deployment is a case by case legal question, not a settled fact, and should be assessed with counsel before relying on this tier. For public hospitals, Annex III point 5(a) (access to essential public services, including healthcare) can also be relevant. Scoping the system to bed sequencing and transfer acceptance only, and keeping every ambulance dispatch and ED triage decision with clinical staff outside the AI's recommendation, is what keeps a deployment in the lower tier.",{"slug":142,"title":143,"shortTitle":144,"definition":145,"status":19,"industries":146,"functions":150,"patterns":154,"audience":85,"autonomy":86,"adoptionStage":34,"segment":157,"evidenceCount":35,"publicEvidenceCount":35,"organizations":158,"bestGrade":42,"headline":163,"lastVerified":44,"indexable":12,"euAiActTier":166,"euAiActBasis":167},"outbound-notice-drafting","AI for drafting customer letters and outbound notices","Outbound notice drafting","AI that drafts the letters and notices operations must send at scale, such as arrears notices, decline letters, complaint responses, servicing confirmations and product change notices, from case data and approved templates and clauses, in the customer's language, for a person to approve where the notice is regulated.",[21,147,148,23,22,149],"banking","insurance","wealth-and-asset-management",[26,25,151,152,153],"collections-and-recovery","regulatory-compliance","claims",[84,155,156],"rag-knowledge-assistant","translation","back-office",[159,160,161,162],"Acentra Health","Hiscox","Health Resources and Services Administration","SS&C Technologies",{"kpi":136,"label":137,"unit":64,"n":65,"nUpTo":66,"kind":67,"value":164,"qualifier":69,"claimant":70,"organization":165,"vendorReported":12},25,"SS&C GIDS and RS","limited","Drafting letters for human approval is not listed in Annex III. The decision the letter communicates may come from a separate high risk system, such as credit scoring (Annex III point 5(b)) or a public body's eligibility decision on benefits (point 5(a)); the drafting tool does not make that decision. Article 50(2) requires the provider of an AI system that generates text to mark the output as artificially generated, which puts this on the limited risk (transparency) tier; this includes an organization that builds its own drafting tool. Article 50(2) does not apply where the AI has only an assistive function for standard editing and does not substantially alter the input data or the semantics of the output.",{"slug":169,"title":170,"shortTitle":171,"definition":172,"status":19,"industries":173,"functions":174,"patterns":176,"audience":85,"autonomy":86,"adoptionStage":34,"segment":153,"evidenceCount":35,"publicEvidenceCount":35,"organizations":177,"bestGrade":42,"headline":182,"lastVerified":71,"indexable":12,"euAiActTier":45,"euAiActBasis":185},"health-prior-authorization-and-claims-adjudication","AI for health insurance prior authorization and claims adjudication support","Health prior authorization and adjudication","AI that reads prior authorization requests, medical claims and appeals with their clinical and billing documents, extracts diagnoses, treatments and costs, checks them against the policy and published clinical criteria, and prepares a summary and recommendation for a clinician or adjudicator, who makes every adverse decision.",[148,22],[153,175,26],"case-management",[109,83,155,110,84],[159,178,179,180,181],"AdvanceCare","Centers for Medicare and Medicaid Services","ICICI Lombard","Manulife",{"kpi":94,"label":95,"unit":64,"n":131,"nUpTo":66,"kind":67,"value":183,"qualifier":184,"claimant":70,"organization":159,"vendorReported":12},50,"approximately","Annex III point 5(a) makes AI high risk when it is used by or on behalf of public authorities to evaluate eligibility for essential public assistance benefits and services, including healthcare services, or to grant, reduce or revoke them, which can cover statutory health schemes run by or for public bodies. Point 5(c) covers risk assessment and pricing in life and health insurance, not claim review. A copilot for a private insurer's claim review, where people decide, is usually outside Annex III; for public schemes, Article 6(3) may exempt a system that only performs a preparatory task, unless it profiles natural persons. GDPR rules on health data (Article 9) and on solely automated decisions (Article 22) apply in every case.",{"slug":187,"title":188,"shortTitle":189,"definition":190,"status":19,"industries":191,"functions":194,"patterns":197,"audience":85,"autonomy":33,"adoptionStage":34,"evidenceCount":198,"publicEvidenceCount":198,"organizations":199,"bestGrade":42,"headline":207,"lastVerified":71,"indexable":12,"euAiActTier":45,"euAiActBasis":212},"security-alert-triage-and-investigation","AI for security alert triage and investigation in the SOC","Security alert triage","An AI agent in the security operations centre that picks up each new alert or user reported phishing email, gathers the evidence from the SIEM, endpoint, identity and threat intelligence tools, gives a verdict with its reasoning and a draft incident summary, and closes clear false positives while an analyst approves every containment action.",[21,22,192,23,193],"technology","professional-services",[195,196],"security-operations","it-and-engineering",[30,110,83,155],7,[200,201,202,203,204,205,206],"Avanade","Federal Housing Finance Agency","Human Managed","SEP2","St. Luke's University Health Network","TÜV SÜD","U.S. Immigration and Customs Enforcement",{"kpi":208,"label":209,"unit":64,"n":88,"nUpTo":66,"kind":210,"value":211,"qualifier":69,"claimant":43,"organization":43,"vendorReported":11},"productivity-gain","Productivity gain","median",60,"Triage of phishing, endpoint, network and cloud alerts for an organization's own cyber defence is not listed in Annex III. Recital 55 of the AI Act says that components intended to be used solely for cybersecurity purposes should not qualify as safety components, so the agent does not fall under Annex III point 2 (critical infrastructure), and for this scope the tier is minimal. The design changes that when the agent triages identity, data loss prevention, insider risk or user behaviour alerts in a way that scores or monitors individual employees: monitoring and evaluating the behaviour of persons in a work relationship falls under Annex III point 4(b), so that scope needs its own high risk assessment before it goes live. The Article 50(1) duty to disclose AI interaction does not apply because it is obvious to a reasonably well informed analyst that they are working with an AI agent. An operator that lets AI act autonomously on network or operational technology controls should assess that design separately, and reading employees' emails and sign in data remains subject to data protection law.",{"slug":214,"title":215,"shortTitle":216,"definition":217,"status":19,"industries":218,"functions":219,"patterns":220,"audience":157,"autonomy":33,"adoptionStage":34,"evidenceCount":222,"publicEvidenceCount":198,"organizations":223,"bestGrade":42,"headline":231,"lastVerified":44,"indexable":12,"euAiActTier":45,"euAiActBasis":233},"synthetic-test-data-generation","AI for synthetic test data generation","Synthetic test data generation","AI that generates realistic synthetic datasets, such as customers, transactions, documents and conversations, which keep the structure and statistical properties of production data without containing real personal data, so teams can test software, train and validate models and run demos safely.",[21,147,22,148],[196,107],[221,84],"synthetic-data-generation",8,[224,225,226,227,228,229,230],"Boomi","Financial Conduct Authority","Internal Revenue Service","JPMorgan Chase","Kin Insurance","Merkur Versicherung AG","Patterson Dental",{"kpi":136,"label":137,"unit":64,"n":65,"nUpTo":66,"kind":67,"value":232,"qualifier":69,"claimant":70,"organization":230,"vendorReported":12},75,"A generator of synthetic tabular test data is not listed in Annex III and does not interact with people, so it is minimal risk with only the AI literacy duty of Article 4. When the system generates synthetic text, images, audio or video, such as documents or conversation transcripts, Article 50(2) requires its provider to mark the output in a machine readable format as artificially generated. When synthetic data is used to train, validate or test a high risk system, such as credit scoring, it falls under that system's data governance duties in Article 10.",{"slug":235,"title":236,"shortTitle":237,"definition":238,"status":19,"industries":239,"functions":240,"patterns":242,"audience":157,"autonomy":33,"adoptionStage":34,"evidenceCount":88,"publicEvidenceCount":88,"organizations":243,"bestGrade":42,"headline":246,"lastVerified":71,"indexable":12,"euAiActTier":248,"euAiActBasis":249},"medical-coding-automation","AI medical coding for clinical encounters","Medical coding automation","AI that reads the clinical documentation of an encounter and assigns the diagnosis and procedure codes (such as ICD-10, CPT and HCPCS) needed for billing and reporting, either as suggestions for a certified coder or autonomously for encounters it can code with high confidence, sending the rest to coders with the reasons.",[22],[241,26],"finance-and-accounting",[110,109],[244,92,245],"Mass General Brigham","Your Health",{"kpi":117,"label":118,"unit":64,"n":65,"nUpTo":66,"kind":67,"value":247,"qualifier":69,"claimant":97,"organization":245,"vendorReported":11},98.3,"minimal","Assigning billing and statistical codes from clinical documentation is not listed in Annex III and does not decide on a person's access to care, so no specific AI Act obligations apply beyond AI literacy. Health data processing falls under GDPR Article 9, and in the United States under HIPAA and the payment integrity rules of public payers. Minimal under the AI Act does not mean low stakes: the Veterans Health Administration classifies its computer assisted coding deployment on this page as high impact in the 2025 US federal AI use case inventory, even though coders select every code.",{"slug":251,"title":252,"shortTitle":253,"definition":254,"status":19,"industries":255,"functions":256,"patterns":257,"audience":85,"autonomy":111,"adoptionStage":87,"segment":259,"evidenceCount":131,"publicEvidenceCount":131,"organizations":260,"bestGrade":42,"headline":263,"lastVerified":139,"indexable":12,"euAiActTier":265,"euAiActBasis":266},"radiology-worklist-triage","AI prioritization of radiology and imaging worklists","Radiology worklist triage","An AI system that analyzes a medical image immediately after a scan, flags time sensitive findings such as a brain bleed, a stroke causing large vessel occlusion or a pulmonary embolism, and reorders the radiologist's worklist and notifies the care team so the most urgent cases are read and acted on first, while a radiologist confirms every finding before it changes a patient's treatment.",[22],[26],[258,110,129],"computer-vision","emergency and inpatient imaging",[261,262],"Adventist Health + Rideout","Sheba Medical Center",{"kpi":136,"label":137,"unit":64,"n":65,"nUpTo":66,"kind":67,"value":264,"qualifier":184,"claimant":70,"organization":261,"vendorReported":12},44,"high","Article 6(1) and Annex I: software that analyzes a medical image to detect or prioritize a disease finding is itself, or is a safety component of, a device in scope of the EU Medical Device Regulation, and typically needs a notified body conformity assessment as software as a medical device (the FDA's AI Enabled Medical Device List shows US market authorization for devices in this category, listing authorized stroke triage devices from Viz.ai and Aidoc's BriefCase triage devices), which makes it high risk under the EU AI Act regardless of Annex III. The radiologist's own diagnostic read stays a human decision; the AI narrows and reorders the queue. Annex I high risk classification under Article 6(1) applies from 2 August 2028 (Article 113(c)); until then, Article 4 (AI literacy obligations) and Article 5 (prohibited practices), which bind the hospital as a deployer, already apply.",{"slug":268,"title":269,"shortTitle":270,"definition":271,"status":19,"industries":272,"functions":273,"patterns":275,"audience":85,"autonomy":86,"adoptionStage":34,"segment":274,"evidenceCount":131,"publicEvidenceCount":131,"organizations":276,"bestGrade":42,"headline":43,"lastVerified":71,"indexable":12,"euAiActTier":265,"euAiActBasis":278},"life-underwriting-medical-record-summarization","AI summarization of medical evidence for life and health underwriting","Life underwriting medical summaries","AI that reads the medical evidence behind a life or health insurance application (attending physician statements, electronic health records, lab results and disclosures), turns it into a structured, cited summary of conditions, treatments and dates, and maps it to the insurer's underwriting manual so an underwriter can decide faster and more consistently.",[148],[274],"underwriting",[109,83,155],[181,277],"Prudential plc","Annex III point 5(c): AI intended for risk assessment and pricing in relation to natural persons in life and health insurance. Article 6(3) exempts some purely preparatory tasks, but never a system that profiles natural persons. Extracting an applicant's health conditions and mapping them to the underwriting manual evaluates their health, which is profiling, so treat the system as high risk. Under the timeline as amended, the obligations for Annex III high risk systems apply from 2 December 2027, and Article 27 requires deployers of point 5(c) systems to assess the impact on fundamental rights before first use.",1790598319719]