AI Chatbots and Patient Communication: GDPR and Transparency for Irish Health Services

If a hospital, GP practice, nursing home or home support provider puts an AI chatbot in front of patients or service users, two kinds of transparency are in play: telling people they are dealing with AI (an AI Act duty that the Commission places mainly on the system's provider), and telling them what happens to their personal data (a GDPR duty on you as the organisation). This guide looks at AI chatbots and patient communication through those two lenses, using the Data Protection Commission (DPC), the European Commission's page on Article 50 of the AI Act and HIQA's work on AI in health and social care. It is a workforce and compliance guide, not clinical advice. For the AI Act side in more depth, see our explainer on Article 50 transparency and labelling obligations.

Two transparency questions, not one

It is easy to treat "transparency" as a single notice on a website. The sources we read treat it as at least two separate questions:

• Do people know they are talking to an AI system? This is the AI Act question (Article 50), and the Commission frames it mainly as something the system's provider must build in.
• Do people know what you do with their personal data, and how to exercise their rights? This is the GDPR question, and the duty sits with you as the organisation deciding why and how the data is processed.

A health service that buys a chatbot from a supplier will usually need to look at both, because the supplier's product design does not by itself discharge your own data protection duties.

What the Commission says about chatbots and Article 50

The European Commission's FAQ on transparency obligations under Article 50 (page last updated 24 July 2026) says providers must design systems that interact directly with people so that those people are told they are dealing with AI, "unless this is obvious". The page says the notice must come at the start of the first interaction, be clear and distinguishable, and meet accessibility requirements. It sets out four cumulative criteria for the duty to apply: the system is AI, it supports a genuine two-way exchange, the AI communicates directly rather than through a human, and the people involved are natural persons. Background systems and machine-to-machine communication fall outside it.

The page also says the "obvious from context" exception is to be read restrictively. For patient-facing tools that is a useful warning: do not assume that a chat window looks obviously automated to every patient, including older people, people with limited digital confidence or people under stress.

On timing, the page says Article 50 applies from 2 August 2026, with a grace period until 2 December 2026 only for the marking and detection duty for AI-generated content, and only for systems already on the market before 2 August 2026. Check the Commission's current position on application dates rather than relying on our summary.

What the DPC says that applies to chatbots

The DPC's blog "AI, Large Language Models and Data Protection" (18 July 2024) is aimed at organisations using generative AI products. Points that translate directly to patient-facing chatbots include:

• Understand the product first. The DPC says organisations should know what personal data an AI system uses, how it uses it, where it goes when third parties are involved, and whether it is retained or reused.
• Transparency and rights. The blog says organisations need processes to handle access and deletion requests for personal data held in an AI system, and that providers should explain their processing in accessible documentation.
• Retention. The blog says that "without a retention schedule and associated processes" an organisation risks non-compliance with the storage limitation principle.
• Accuracy and review. It warns that AI products can produce inaccurate or biased information and that relying on them without human review creates risk.
• Risk assessment. It says a data protection impact assessment may be required, particularly with new technology or data about vulnerable people.

Our own summary of that blog is in DPC guidance on AI and large language models. Separately, the DPC describes health data as special category data under Article 9 of the GDPR, which is generally prohibited to process except in limited circumstances. A chatbot that collects symptoms, medication details or appointment reasons is plausibly handling that kind of data; your lawful basis and condition need to be settled before it goes live.

The right to be informed

The DPC's guide to the rights of individuals (up to date as of 28 February 2018) says information about processing must be given "in a concise, transparent, intelligible and easily accessible form", in plain language, typically through a privacy notice. Where the data is collected from the person, the information is due at the time of collection. The DPC's FAQ on privacy policies adds that a notice should reflect the organisation's actual processing, be written in appropriate language for the people it addresses, and be regularly reviewed and updated. Neither page is specific to AI, but both apply when the collection point is a chat window.

The same guide describes the right not to be subject to a decision based solely on automated processing where it has legal or similarly significant effects, with safeguards such as human intervention. Whether a given chatbot's output could amount to such a decision depends on what it is used for; that is a question for your data protection officer or adviser rather than something we can answer in general.

What HIQA's AI guidance says

HIQA published its National Guidance for the Responsible and Safe Use of Artificial Intelligence in Health and Social Care Services on 29 July 2026. The announcement says it is for all health and social care services in Ireland and aims to help people understand what to expect when AI is used in their care. It lists transparency among the practical topics but does not set out specific requirements, and it does not mention chatbots. We could not open the final guidance document, so we read HIQA's January 2026 consultation draft. That draft is not final, and the published text may differ. It says services should inform people "about when, where and for what purpose AI tools are used in their care", and gives as an example of good practice that people can easily find information on how the service uses AI tools in their care, and that staff should communicate clearly and avoid technical language. On chatbots it says that where a person is engaging directly with an AI tool, there should be an option to revert to interacting directly with a human. It also says a DPIA is needed if an AI tool processes health-related data, and asks for enforceable controls to stop identifiable data being entered into public large language models. See our summary of HIQA's national guidance on AI for more.

The Medical Council's position statement on AI (undated) is aimed at doctors, but it points the same way: patients should be informed when AI tools are used in their care, with detail proportionate to the use, and it warns that personal information entered into public generative AI becomes public.

A practical approach for a patient-facing chatbot

The checklist below is our suggestion, drawing on the sources above. It is not a statement of what the law requires.

• Say it plainly, first. Open every chat with a short statement that the person is talking to an automated AI tool, before any personal details are asked for.
• Offer a human route. Show how to reach a staff member, and make sure someone is actually available to pick it up.
• Link a short privacy notice. State what data the tool collects, why, who receives it, how long it is kept and how to exercise rights, in plain language.
• Limit what people are invited to type. Prompt users not to enter more detail than the task needs.
• Complete the DPIA before launch and record the supplier's role, data locations and retention terms.
• Test wording with real users, including people who are not comfortable with technology.
• Train front-line staff so they can explain the tool and handle questions or complaints.

What we could not confirm

We could not open HIQA's final guidance document, so the detail above on chatbots comes from the consultation draft. We did not find an Irish regulator page that addresses patient-facing chatbots specifically. The DPC pages we cite for privacy notices and rights are general GDPR guidance, and two of them show no date or an older date.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Do we have to tell patients a chatbot is AI?

The Commission's Article 50 FAQ says providers must design direct-interaction systems so people are told they are dealing with AI unless it is obvious, and that the exception is read restrictively. HIQA's draft also expects services to be open about AI use. Check the current application dates.

Is the chatbot supplier responsible for transparency?

The Article 50 duty to design the notice sits with the provider, according to the Commission page. Your own GDPR duties as the organisation processing patient data remain with you, so you should not rely on the supplier alone.

Can patients ask to speak to a person?

HIQA's consultation draft says there should be an option to revert to a human where someone is engaging directly with an AI chatbot. The final text may differ, so check the published guidance.

Do we need a DPIA?

The DPC says a DPIA is required where processing is likely to result in a high risk, and lists large-scale special category data and innovative use of technology among its criteria. HIQA's draft says one is needed if an AI tool processes health-related data. Take advice for your specific tool.

Clear, early and honest communication is the common thread in every source we read: tell people it is AI, tell them what happens to their data, and make a human easy to reach.