Hilbi IQ · one question, answered

Who is responsible when AI touches a patient case?

Under the AI Act, whoever puts an AI system to work in a professional process carries the duties. Paste a case into a general assistant and the practice owns that. IQ arrives the other way round, as a processor under a written agreement.

Where your data is processed

Platform security

Deployer duties, explained
Signature gate before filing
Architecture not published

Who is responsible when AI touches a patient case?

Deployer duties

carried by the processor, not by you

Art. 50(4)

transparency recorded on every output

JUDr. Eva Halászová

Regulatory and privacy lead

Reviewed by MUDr. Marek PetríkUpdated 28 August 2026

Two ways of working, side by side

The comparison is between two situations, never between named products.

	A general-purpose assistant used outside the clinical system	Hilbi IQ
Who is the deployer under the AI Act	The practice, by putting the system to use	Allocated in writing, with Hilbi as processor
Contractual relationship for the data	Consumer terms; usually no Art. 28 agreement	Art. 28 processing agreement per market
Where the data is processed	Determined by the vendor's terms; often outside the EU	EU for SK and CZ; India for IN (contractual)
Use for model training	Governed by the vendor's terms, changeable	Excluded contractually
Transparency toward the patient	Nothing records that text was machine-generated	Art. 50(4) disclosure carried with the draft
Human oversight	A habit, not a gate	Signature gate: §21 SK, §12 CZ
Record of what happened	Outside the record; not auditable by the practice	Immutable trail, exportable by you
What reaches the clinical record	Copy-paste, unattributed	Structured FHIR R4 resources, signed

Status keyIn forceIn progressReadiness

In force: applies today and can be evidenced. In progress: under way and dated. Readiness: the position is prepared and the market opens next.

What is published, and what is not

Enough to assess responsibility. Not enough to rebuild the system.

Processing location: Stated per market and contractual.In force
Legal roles: Provider as controller, Hilbi as processor under Art. 28 GDPR, with the AI Act deployer duties allocated in writing.In force
Transparency mechanism: Machine-generated clinical text is disclosed under AI Act Art. 50(4) and carries the clinician who signed it.In force
Oversight mechanism: A signature gate before filing, not a review recommendation.In force
Intended purpose: Generates a structured draft report for clinician review and suggests service codes. It does not diagnose and it does not decide.In force
Classification: Assessed against MDCG 2019-11 and AI Act Art. 6(1) on the stated intended purpose, so a reviewer can re-run the assessment.In force
Audit evidence: What was generated, what was edited, who signed, when: immutable and exportable.In force
What is not published: Model routing, prompt construction, retrieval design and the vendor mix are not published. Responsibility can be assessed without them, and publishing them would not make the answer more checkable.In force
Independent verification: Under agreement a reviewer receives the audit report, the penetration test summary and the sub-processor list.In force

The follow-up questions

Is it actually forbidden to use a general assistant on a patient case?

It is not automatically unlawful, but it moves the duties onto the practice: a lawful basis for the disclosure, a processing agreement with whoever receives the data, a transfer basis if it leaves the EU, the AI Act transparency duty toward the patient, and an audit trail the practice does not have. Most practices discover the gap when they are asked to evidence it.

What changes if the assistant is used with data that is not identifiable?

Who is liable if the draft contains an error?

Does the AI Act make IQ a high-risk system?

Why will you not publish the architecture?

Reading this as part of a shortlist?

The processing detail, the legal basis and the retention rules are on the IQ data page. The platform position is on the security page.

Where your data is processed

Monthly briefing

The signal, once a month.

What changed in European health data, what we shipped, and what it means for a provider. Nothing else.