GDPR (General Data Protection Regulation)

GDPR is the EU's data protection framework that has been protecting personal data since 2018. It is particularly important for healthcare institutions as patient data falls into a special category.

Key Requirements:

• Explicit consent for data processing
• Patient rights: access, deletion, modification
• Appointment of a data protection officer
• Data protection impact assessment for new systems
• 72-hour notification obligation in case of data protection incidents

NIS2 (Network and Information Security Directive 2)

Cybersecurity regulation effective from October 2024, applicable to medium and large healthcare providers. Its goal is to protect critical infrastructure from cyber attacks.

Key Requirements:

• Implementation of risk management measures
• Development of incident management processes
• Supply chain security
• Definition of management responsibility
• Regular security audits

EU AI Act

Regulation adopted in 2024, being gradually implemented for the safe use of artificial intelligence.

Healthcare AI systems mostly fall into the high-risk category.

Key Requirements:

• Risk classification of AI systems
• Conformity assessment for high-risk systems
• Ensuring transparency and explainability
• Human oversight requirement
• Bias-free and fairness

EAA (European Accessibility Act)

Digital accessibility requirements mandatory from June 2025, ensuring that people with disabilities can also use online services.

Key Requirements:

• Accessibility of websites and mobile applications
• WCAG 2.1 AA level compliance
• Screen reader compatibility
• High-contrast colors and readable font sizes
• Alternative text for images
• Keyboard-navigable interfaces

Not all regulations apply to every institution - size, scope of services, and technological solutions determine the obligations.

Expert Help with Compliance

We help identify the requirements that apply to you and the practical steps for compliance.