← Free risk checker
Home → Tools & Software → Nuance DAX (Microsoft) EU AI Act
⚠ HIGH RISK — Annex III, Category 5 (Healthcare AI)

Nuance DAX EU AI Act Compliance: Healthcare AI Obligations for 2026

Nuance DAX (Dragon Ambient eXperience), now part of Microsoft, uses AI to listen to patient-clinician conversations and automatically generate clinical documentation. As AI that directly supports healthcare delivery, it is classified high-risk under EU AI Act Annex III Category 5. Here is what healthcare providers and hospital IT teams must do.

High-risk — act now: Nuance DAX is high-risk under Annex III Category 5 — AI systems intended for use in medical diagnosis, treatment, or health management. Deployer obligations are extensive: human oversight, patient transparency, staff training, technical documentation from Microsoft, and registration. August 2026 is the deadline for most obligations.

Deployer obligations for healthcare providers using Nuance DAX

Need a full EU AI Act compliance assessment for your healthcare organisation?

DAX is one system. Most healthcare organisations have multiple AI tools across clinical, administrative, and operational functions. Map your full AI risk exposure.

Run Full Compliance Assessment — Free →
Or check your full risk level for free →

Nuance DAX and the EU AI Act: healthcare AI compliance in full

Why DAX is high-risk: the Annex III Category 5 classification

EU AI Act Annex III Category 5 covers "AI systems intended to be used by or on behalf of healthcare professionals for providing medical advice, supporting medical diagnosis or the selection of suitable treatments." Nuance DAX (Dragon Ambient eXperience) listens to patient-clinician conversations in real time and automatically generates structured clinical documentation — SOAP notes, consultation summaries, referral letters, and clinical coding recommendations. This is AI directly supporting healthcare delivery and clinical documentation that becomes part of the official patient record. The Annex III Category 5 classification is unambiguous.

What makes healthcare AI different from other high-risk categories

Healthcare AI carries a higher harm potential than most other Annex III categories because errors can directly affect patient safety. A clinical note that incorrectly documents a medication dose, a missed allergy, or an erroneous diagnosis can have life-threatening consequences. This is why the EU AI Act places healthcare AI firmly in the high-risk tier with the most extensive deployer obligations.

Microsoft and Nuance, as the providers of DAX, have significant conformity obligations — including clinical validation studies, accuracy documentation, and CE-marking equivalent processes. Your obligations as a deploying healthcare organisation build on this: ensuring the tool is used correctly, that clinicians maintain meaningful oversight, and that patients are informed.

Patient transparency: the ethical and legal obligation

Informing patients that an AI ambient listening system is active during their consultation is both an EU AI Act obligation (Article 26(6) — informing affected persons about high-risk AI use) and a GDPR obligation (Article 13 — informing data subjects about processing at the point of data collection). In practice, this means: a verbal statement at the start of each consultation ("I use an AI tool that listens to our conversation to help with my notes"), written information in patient intake materials, and clear signage in consultation rooms where DAX is deployed.

Patient consent — as opposed to notice — may also be required in some EU jurisdictions under national healthcare law, particularly for processing of special category health data. Consult your legal team and DPO on the consent requirements applicable in your jurisdiction.

Clinical staff training: beyond technical onboarding

Article 26(4) requires deployers to ensure "sufficient AI literacy and competence" among staff using high-risk AI systems. For DAX, this goes beyond the technical training provided by Microsoft/Nuance. Clinical staff need to understand: what types of errors DAX is prone to (background noise, overlapping speakers, uncommon drug names, dialects), how to critically review AI-generated notes rather than accepting them by default, how to correct and override AI documentation, and how to report suspected DAX errors through your organisation's clinical incident process.

Frequently asked questions

Is Nuance DAX high-risk under the EU AI Act?
Yes. Nuance DAX is clearly high-risk under EU AI Act Annex III Category 5 — AI systems supporting medical diagnosis, treatment selection, and health management. As a healthcare provider deploying DAX, you have extensive deployer obligations including human oversight implementation, patient notification, staff training, technical documentation review from Microsoft, and registration in the EU AI database.
Do patients need to be told that Nuance DAX is active?
Yes. Article 26(6) requires that persons affected by high-risk AI systems be informed of their use. For DAX, this means patients must be informed before their consultation that an AI ambient system is recording and processing their conversation to generate clinical notes. This is also required under GDPR Article 13 as health data processing information. Verbal notice at the consultation start, supported by written patient information, is the recommended approach.
Can clinicians rely on DAX-generated notes without reviewing them?
No. Article 26(2) requires human oversight — the ability to critically review, correct, and override AI output. DAX documentation must be reviewed by the clinician before being incorporated into the official patient record. Clinicians who habitually approve DAX notes without review are not fulfilling the human oversight obligation, and your organisation should establish clear clinical governance policies to prevent this.
Microsoft acquired Nuance — does that change compliance obligations?
Microsoft's ownership of Nuance affects provider-level obligations: Microsoft is now responsible for DAX's technical documentation (Annex IV), conformity assessment, and registration as a high-risk AI provider. As a deployer, you should request updated conformity documentation from Microsoft. Your own deployer obligations — patient notification, human oversight, staff training, incident reporting — remain unchanged regardless of the corporate ownership structure.