EN

Step 3: Law, Ethics & Data Protection

Use data protection and ethics as a solid foundation for implementing AI systems responsibly and transparently.

Acting Responsibly

With the right legal and ethical guardrails:

  • protect your facility from liability risks,
  • secure the approval of your works council team
  • and build trust among staff and residents.

Data protection is no obstacle

When AI is used, highly sensitive care data meets novel technologies. Data protection is not an obstacle; it is the foundation for secure implementation.

The three pillars of legally compliant AI implementation

To ensure that your AI project is legally and ethically sound, you need to consider three areas from the outset:

  • Area 1: Ethics and responsibility
  • Area 2: Law and liability
  • Area 3: Data protection
Handschlag zweier Personen über einem unterschriebenen Vertrag, im Hintergrund Taschenrechner und Miniaturhäuser

Area 1: Ethics and responsibility

AI should support care staff – not replace the human relationship.

As a management team, answer four core ethical questions in advance:

  • Transparency: Do all parties involved (staff, residents and relatives) understand where and how AI is being used?

  • Human connection: Is there still enough time for human interaction despite the use of AI?

  • Protection of vulnerable groups: Are people with dementia or disabilities given protection?

  • Critical reflection: Is your team aware that AI models can make incorrect assumptions because of biased training data?

Info

AI never takes on legal responsibility. Every critical decision must be reviewed and approved by a qualified nurse.

Involve staff and the works council early

The use of AI changes roles and workflows. If staff fear surveillance or job losses, the project will fail.

  • Works council, employee representation: Involve these bodies from day one. In Germany, co-determination under the Works Constitution Act and the Occupational Safety and Health Act is regulated.
  • Build competencies: Training on basic technical knowledge and ethical reflection helps prevent misuse and blind trust in the system.

Learn more in Step 5: Involving stakeholders.

Practical tip

Invest in your team, not just the software. Involve your team in the decision-making process from day one.

Clarify internally in advance: How do we deal with AI errors? When is AI used? What data are processed? Where are the limits of such a system?

Learn more in Step 2: The Importance of AI for Care.

Communicate transparently that responsibility always remains with people. This reduces uncertainty, acknowledges your team’s changing role with appreciation, and helps ensure acceptance in day-to-day work.

Area 2: Legal framework

The EU AI Act regulates AI systems according to their risk potential. Strict requirements apply to care facilities because care data and health-related assessments have a direct impact on people.

 

How the EU AI Act classifies AI

Risk class Meaning in care Examples Facility obligations

Unacceptable

Prohibited. Risk of violating fundamental rights.

Manipulative systems that influence behaviour.

Use is completely prohibited.

High risk

Makes decisions affecting health, safety or dignity.

Fall-risk analyses, AI-assisted care-level assessment, robots.

Strict risk assessment, transparency, human oversight.

Limited risk

AI systems with direct user interaction.

Chatbots, AI voice assistants.

Information obligation: users must be able to recognise that AI is being used.

Minimal risk

Administrative tools without a link to individuals.

Logistics or staff scheduling tools.

No special requirements.

What is the EU AI Act? – A Podcast

This podcast was generated with the help of AI. The content was developed by humans and reviewed for accuracy. (As of: 14 September 2026)

Read the podcast

You can read the podcast in this summary.

If you would like to learn more about the EU AI Act, you can find helpful information and tools on this page from the Future of Life Institute.

Medical Device Regulation (MDR)

If your AI application assesses health risks (e.g. fall or pressure-ulcer risk) or supports diagnoses, it is generally considered a medical device. Make sure the provider has a valid CE marking.

If your AI application performs medical functions, it must meet the MDR requirements – in addition to the requirements of the GDPR and the AI Act. This keeps the AI safe, legally compliant and beneficial to your residents.

Area 3: Implement data protection under the GDPR

Health data are among the special categories of personal data under Article 9 GDPR. Avoid uncontrolled data accumulation and involve your Data Protection Officer (DPO) from the outset.

Practical tip

If you do not have an internal Data Protection Officer, be sure to seek external support for this complex topic. The DPO can help you with all relevant points:

  • Review providers and conclude contracts (such as a data processing agreement)
  • Assess risks
  • Obtain legally valid consent from residents, relatives or legal guardians
  • Regular audits of the AI system

The 5 most important GDPR steps

Conclude a data processing agreement (DPA)

Ensure that a legally valid DPA with the software provider is in place.

Check data storage location

Are data processed locally, in a national cloud, on EU servers or in a third country (e.g. the US)?

Conduct a data protection impact assessment (DPIA)

Mandatory for high-risk systems under Art. 35 GDPR. Your DPO can assist you.

Obtain consent

Inform residents or their legal representatives in an understandable way and obtain any required consent.

Apply data minimisation

Strictly adhere to data minimisation (Art. 5 GDPR) – process only data that are strictly necessary for the purpose.

Pflegekraft im Gespräch mit einer Bewohnergruppe im Sitzkreis in einem hellen Aufenthaltsraum

Who decides what? Responsibilities for digitalisation, data protection and care

Partner projects showed that the greatest delays are usually caused not by technology, but by a lack of legal coordination. The following table shows which institutions in Germany and Denmark are relevant in this context:

Area Germany Denmark

Legal basis

Digital Healthcare Act (DVG), Digital Healthcare and Nursing Care Modernisation Act (DVPMG), Health Data Use Act (GDNG), as well as General Data Protection Regulation (GDPR)/Federal Data Protection Act (BDSG)

Social Services Act (Serviceloven), Health Act (Sundhedsloven), General Data Protection Regulation (GDPR)/Danish Data Protection Act

Data protection

Federal Commissioner for Data Protection and Freedom of Information (BfDI) and state data protection authorities

Danish Data Protection Agency (Datatilsynet)

IT security

Federal Office for Information Security (BSI)

Danish Agency for Societal Security (Styrelsen for Samfundssikkerhed)

Care

Federal Ministry of Health (BMG); implementation by the federal states and long-term care insurance funds

Ministry of Children, Seniors and Housing (Børne-, Ældre- og Boligministeriet); implementation by municipalities

Digitalisation

Federal Ministry for Digital Transformation and Government Modernisation (BMDS)

Ministry of Digital Affairs (Digitaliseringsministeriet)

Common European rules – different practices

Our German Danish exchange in the Care-AI research project quickly showed that although both countries are subject to the same European rules, care facilities handle artificial intelligence, data protection and legal requirements very differently.

In practice, open questions and areas of legal uncertainty continue to cause considerable uncertainty.

Where possible, therefore, make use of official regulatory sandboxes to test projects and initiatives in a legally secure environment.

Your implementation checklist

Use this checklist to start Step 3:

  • Erfüllt:

    Data Protection Officer (DPO) is involved from the planning phase.

  • Erfüllt:

    Works council / employee representation is officially informed and involved.

  • Erfüllt:

    Risk class under the EU AI Act has been determined.

  • Erfüllt:

    DPA and, where applicable, the DPIA are fully documented.

  • Erfüllt:

    Usage guidelines and clear review obligations for professionals are established. At least one qualified nurse must review every critical decision.

  • Erfüllt:

    Training plan for the care training team has been developed.

  • Erfüllt:

    Risk management has been established: prepare technical documentation and define responsibilities. There is a procedure for regular review and reassessment of risks, data protection requirements and legal obligations.

  • Erfüllt:

    GDPR is complied with. Technical and organisational measures protect sensitive data.

Your outcome after this step

  • Erfüllt:

    You have clarified the legal and ethical framework for your facility.

  • Erfüllt:

    Your project has legal safeguards in place.

  • Erfüllt:

    The relevant bodies are involved.

  • Erfüllt:

    Your team is prepared to use AI responsibly.

What Happens Next

The legal framework is in place and the boundaries have been defined? Next, it’s time to select the right solutions: In Step 4: Concept Development, learn how to find suitable software partners, assess interfaces, and negotiate contracts with confidence.

Sources