AI Receptionists and the EU AI Act: Disclosure Is Only the Beginning

From 2 August 2026, people must be told when they are interacting with AI. In healthcare, trust depends on what the system does next.

Disclosure is necessary. It is not a safety system.

A patient rings a dental practice on a Friday afternoon to move an appointment. Two sentences in, almost as an aside, she mentions that the swelling on the side of her face has spread under her jaw since yesterday and that it has started to hurt when she swallows.

That call is not administrative any more. NHS guidance treats difficulty breathing, speaking or swallowing alongside dental swelling as an emergency. What the receptionist does next matters more than how natural the voice sounds.

From 2 August 2026, Article 50 of the EU Artificial Intelligence Act applies to this conversation. If the voice on the line is artificial, the person must be told clearly that they are interacting with an AI system. The information must be provided no later than the first interaction, unless the use of AI is already obvious in context.

That is a good rule. Synthetic voices can now sound warm, patient and convincingly human. Nobody should have to guess whether the person answering is actually a person.

But disclosure addresses the most visible risk in conversational AI, not necessarily the most dangerous one. A caller who knows they are speaking to a machine is better informed. They are not automatically safer.

What Article 50 changes

Article 50 requires providers of AI systems designed to interact directly with people to ensure that users are informed that they are dealing with AI. The disclosure must be clear, distinguishable and accessible. In practical terms, an AI receptionist serving patients in the EU should identify itself at the start of the call rather than burying the information in terms and conditions or a privacy notice.

The rule has real enforcement weight. The AI Act places breaches of Article 50 within a penalty category of up to €15 million or 3 per cent of worldwide annual turnover. For small and medium-sized businesses, the Act caps the fine at the lower of the percentage or fixed amount. The final sanction in any case depends on the circumstances and the national enforcement process.

The disclosure requirement is easy to understand and easy to test. Ring the number. Listen to the opening sentence. The harder questions begin once that sentence has been spoken.

The real safety question is where the AI's authority ends

I should declare an interest. I am an optometrist and the founder of ViveoAI, which develops AI receptionists for dental and other healthcare practices in Ireland and the UK. Commercially, it would be convenient if the public conversation began and ended with disclosure. It should not. I support stronger obligations for healthcare AI, including obligations that would apply to the systems my own company builds.

The most important decision in designing a healthcare AI receptionist is not what it is able to say. It is when it must stop speaking.

An administrative system has no business diagnosing a condition, deciding that a patient is safe to wait or offering reassurance that sounds clinical. It should recognise when a conversation has crossed from administration into potential clinical risk, follow the urgent wording and escalation route approved by the practice, and involve a qualified human or emergency service without delay.

This boundary matters because healthcare calls do not arrive in neat categories. A caller may begin by asking about opening hours and only later mention chest pain, sudden loss of vision, facial swelling or difficulty swallowing. A system designed merely to complete the original task can miss the fact that the nature of the call has changed.

Safety cannot live only in a prompt

It is not enough to place a sentence in the AI's instructions saying, "Do not give medical advice." Language models are flexible, callers are unpredictable and conversations drift. A persuasive caller may ask the same clinical question five different ways. A frightened caller may describe a serious symptom indirectly.

The safety boundary must therefore be built into the workflow itself. The system needs defined actions it may and may not take, tested triggers for urgent escalation, mandatory wording for specific situations, a reliable route to a human and a fallback when transfer fails. Those controls then need to be tested against messy, ambiguous and adversarial calls, not just the clean examples used in a product demonstration.

Two questions separate a serious deployment from a polished demo: how were urgent scenarios tested, and who reviews the calls in which the system failed?

Disclosure is not consent

A natural voice encourages people to speak freely. That is useful for conversation, but it also increases the chance that callers will disclose symptoms, medication details, financial information or other sensitive data without thinking about where it will go.

Telling somebody, "I am an AI receptionist," does not by itself answer whether the call is recorded, whether a transcript is stored, how long information is retained, who can access it or whether it is used for another purpose. Article 50 expressly sits alongside other EU and national transparency obligations. It does not replace data-protection law or good consent practice.

Healthcare practices therefore need a separate, plain-language explanation of data handling. They also need to minimise what the system collects. An AI receptionist should not gather clinical detail merely because it can.

Human access must be a feature, not an escape hatch

Disclosure should never become a shield for poor service. If a system cannot understand a caller, sends them around a loop or quietly blocks the route to a person, its honesty about being a machine is little consolation.

A safe system should make escalation predictable. It should know when to transfer, when to create an urgent callback, what to do outside normal hours and how to respond if the transfer does not connect. A patient should not need to outwit the software to reach a human being.

Ireland now has an AI Office, but responsibility remains distributed

Ireland has established Oifig IS na hÉireann, the AI Office of Ireland, as the central coordinating authority for implementation of the EU AI Act. Paul Byrne was appointed as its first chief executive in July 2026. Ireland is using a distributed regulatory model in which existing competent authorities retain roles within their sectors, while the new office coordinates implementation, cooperation and technical expertise.

That architecture is important, but it will not answer every practical question overnight. Dental practices, GP surgeries, opticians and other healthcare providers are already being offered AI reception systems. They are often sold on how natural the voice sounds and how many calls are answered. Neither is a safety property.

Five questions every healthcare practice should ask

Responsible AI may look less impressive in a demo

None of this is an argument against AI receptionists. Healthcare reception desks are handling call volumes they were never staffed for. A system that gives opening hours, checks an appointment or rebooks a routine visit at eight in the evening can be genuinely useful. It can reduce missed calls and free staff to deal with patients who need human attention.

But the safest version may look less impressive in a demonstration because it sometimes declines, escalates and hands over. That is not a limitation. That is the design working properly.

The patient with swelling beneath her jaw does not primarily need the voice to introduce itself. She needs it to recognise that this is the moment to stop the administrative conversation and follow the emergency pathway. Article 50 gets the introduction right. Everything after the introduction is where trust will be earned.

A practical standard for healthcare AI

At ViveoAI, our position is straightforward: healthcare AI receptionists should identify themselves clearly, remain within tightly defined administrative boundaries, use practice-approved escalation logic, preserve access to a human and be monitored after launch. Compliance is the floor. Safe design is the real work.

If your practice is evaluating an AI receptionist, ask to see the escalation testing as well as the demonstration. Learn more at viveoai.com

Sources and further reading

• EU Artificial Intelligence Act - Articles 50, 99 and 113 - official text covering transparency, penalties and application dates
• European Commission guidance on transparent AI systems - Article 50 implementation and the 2 August 2026 application date
• AI Office of Ireland announcement - establishment of the office and appointment of its first CEO
• NHS guidance on dental abscesses - emergency signs including difficulty breathing, speaking or swallowing