← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for healthtech teams

*Engineering guidance, not legal advice. Medical device classification and AI Act scope are for your regulatory team to decide.*

Two routes into "high-risk"

Healthtech products can become high-risk AI systems in two ways:

1. As regulated products (Art. 6(1) and Annex I). AI that is itself a medical device or in vitro diagnostic, or a safety component of one, under the MDR or IVDR, and that requires third-party conformity assessment under those rules, is high-risk under the AI Act. The AI Act requirements then apply alongside the device regulation.
2. Through Annex III uses. Point 5 includes AI used to evaluate and classify emergency calls, to dispatch or prioritise emergency first response services including medical aid, and emergency healthcare patient triage. It also includes risk assessment and pricing in life and health insurance for natural persons.

Many LLM features in health products sit near these lines: symptom checkers, clinical documentation assistants, triage chatbots, prior-authorisation agents. Whether yours is in scope depends on its intended purpose, which is exactly what your regulatory documentation should pin down.

The logging duties that follow

• Art. 12 (providers): high-risk systems must automatically record events enabling traceability of their functioning, for identifying risks and for post-market monitoring, which device makers already know well.
• Art. 19 (providers): keep the logs under your control for at least six months, or longer where other law requires.
• Art. 26(6) (deployers) such as hospitals, clinics and insurers: keep logs under their control for at least six months, and ensure human oversight by competent people (Art. 26(2), in line with Art. 14).

Health data retention rules are usually far longer than six months, so treat the AI Act figure as a floor. See Art. 12 logging and retention under Art. 26.

On timing: the Digital Omnibus agreement moves Annex III obligations to December 2027 and product-embedded (Annex I) ones to August 2028 (details and caveats). Incident investigations, vigilance reports and malpractice claims do not follow those dates.

Why verifiable logs matter here

When an AI-assisted triage or recommendation is questioned, by a patient, a notified body, a competent authority or a court, the log of that run is central evidence. The first question will be whether it is complete and unaltered.

A trace in your own observability stack is your word. What an outsider can check:

1. a hash chain over the run's events (model calls, tool calls, human confirmations), so an edit or deletion is detectable;
2. an independent, timestamped countersignature, verifiable with a public key and no account.

How Vetro Attest fits

Vetro Attest accepts OpenTelemetry GenAI traces (OTLP/JSON) or native Vetro ledgers, with nothing to install. Verification is free. For 49 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto logging obligations;
• an ed25519 countersignature by this service over the digest, event count and timestamp, verifiable by anyone with our published public key.

On health data: free verification stores nothing. A ledger you pay for is stored so the report stays downloadable, then deleted after 7 days, and the service is hosted in the EU. For patient-level traces, apply your redaction and minimisation policy *before* export. The open-source Vetro recorder ships redaction presets for this.

Limits: the countersignature proves a log verified clean at a time, not that the clinical output was correct. The report is not a conformity assessment, not a substitute for MDR/IVDR documentation, and not legal advice.

Next steps

• Run the free EU AI Act Art. 12/14 checker.
• Verify a trace free, then get the countersigned report for 49 USD.
• Compare: vs. Datadog LLM Observability, vs. WORM storage.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.