Can a Belgian dental practice use ChatGPT?
For writing work without patient data, yes, provided you check what comes out. A patient record, an X-ray or a message with the patient’s name and reason for the visit does not belong in consumer ChatGPT: there OpenAI itself is responsible for your chats, there is no processing agreement, and what you type can be used to train the model unless you switch that off. No Belgian authority or dental association has published rules of its own. What follows comes from the GDPR, the EU AI Act and OpenAI’s terms.
Last updated
What do Belgian authorities say about ChatGPT?
Nothing written for dentists. The Data Protection Authority, the federal health ministry, RIZIV/INAMI, the eHealth platform and the dental associations have published no rules on ChatGPT in care.
What exists is general. In an April 2026 brochure the Data Protection Authority asks citizens to be careful before typing medical information into a chatbot, to check the AI training settings, which are often on by default, and to leave out names, addresses or age. The Flemish government forbids its own staff to enter sensitive information into public generative AI, and allows rewriting, translating and summarising public documents, always with a check.
What happens to what you type into ChatGPT?
It depends on the version. In consumer ChatGPT, free or on a personal plan, OpenAI Ireland is the controller of your chats. OpenAI may use what you type to train its models unless you switch that off under Data controls in the settings. A thumbs up or down can still pull that whole conversation into training. A deleted chat or a temporary chat is kept for up to 30 days.
ChatGPT Business, ChatGPT Enterprise and the API work differently. There OpenAI Ireland signs a processing agreement, and OpenAI does not train on your data by default. Storage in Europe is offered for the API and for new Enterprise workspaces, not for Business or consumer ChatGPT.
| Consumer ChatGPT | ChatGPT Business or Enterprise | API | |
|---|---|---|---|
| Who is responsible for the chats | OpenAI Ireland | Your practice, OpenAI Ireland as processor | Your practice, OpenAI Ireland as processor |
| Processing agreement | No | Yes | Yes |
| Training on your data | Yes, unless you switch it off | Not by default | Not by default |
| Retention | Until you delete, then up to 30 days | Set by the admin, deleted within 30 days | Logs up to 30 days |
| Storage in Europe | No | New Enterprise workspaces only | Yes, after approval |
What can you use ChatGPT for?
Anything with no patient in it. The Flemish government’s rules for its own staff give a useful list:
- Proofreading or simplifying a text you wrote, such as a general aftercare leaflet for an extraction.
- Translating your own text into Dutch or French, then having someone who speaks the language check it.
- Summarising a public document, such as a RIZIV/INAMI circular, and checking the summary is right.
- Drafting a template letter or e-mail with no personal data, then filling it in yourself.
What does not belong in ChatGPT?
Anything that makes a patient recognisable, and any decision that belongs to the dentist:
- A patient record, a treatment plan, a referral letter or an e-mail thread with a patient.
- An appointment message with the name and reason for the visit. That too can be health data.
- X-rays, intraoral photos or scans.
- A text from which you only removed the name. Under the GDPR, pseudonymised data remain personal data, so initials, dates of birth and addresses must go too.
- A question about a diagnosis or a treatment choice that you then follow without your own judgement. OpenAI’s own rules forbid tailored medical advice without a licensed professional involved, and EU data protection authorities found that ChatGPT can produce made-up answers.
Is ChatGPT Business fine for patient data, then?
It is a better starting point, not a free pass. A processing agreement and no training on your data remove two big objections. But no Belgian authority has said that patient data in ChatGPT Business is acceptable, and the practice still has its own work to do: add the processing to its record, list who has access to health data, and check where the data go. OpenAI does not offer storage in Europe for Business.
What does the EU AI Act ask of your practice?
A practice that uses ChatGPT for its work is a deployer under the AI Act. Purely personal use falls outside it.
Since 2 February 2025 it has had to look after its staff’s AI literacy. The Digital Omnibus on AI softened that duty on 27 July 2026: it now means measures that support the team’s AI knowledge, without having to guarantee any particular level. The Act does not ask you to measure or test that knowledge either. A short briefing and a written house rule, like the one below, is a reasonable way to meet it.
Since 2 August 2026, AI-generated text published to inform the public on matters of public interest must be labelled as such. That duty falls away when a person has reviewed the text and someone holds editorial responsibility for it.
Belgium has not yet formally designated its AI Act authority. The BIPT has been announced, and the FPS Economy coordinates.
European Commission, AI Omnibus enters into force, 27 July 2026
A house rule for your team, in five lines
An example to copy and adapt:
- We never type a patient’s details into an AI tool: no name, no initials, no date of birth, no photo.
- We use a work account, not our own, with training on our chats switched off.
- We check everything an AI tool writes before it leaves the practice.
- An AI tool decides nothing about a diagnosis or a treatment.
- When in doubt, we ask [name] first.
How do the Netherlands and France see it?
In stricter terms, and neither is Belgian law. The Dutch data protection authority called it a data breach when an employee of a GP practice, against the practice’s rules, entered patients’ medical data into an AI chatbot. France’s national health authority, the HAS, asks care providers to strip names, initials, dates and addresses from every prompt to a public AI tool.
Autoriteit Persoonsgegevens, AI chatbot use can lead to data breaches, 6 August 2024 (in Dutch)
And Tilcao, is that ChatGPT too?
No. Tilcao works for the practice as a processor, under a processing agreement, and every sub-processor, the language model included, is named in the annex. It makes no diagnosis and decides nothing medical: a patient in pain is passed to a person. How that is set up is on security and GDPR, and what patients must hear about AI is on telling patients about AI.
Questions practices ask
Can I have ChatGPT rewrite a letter to a patient?
Not with the patient’s details in it. Removing the name is not enough, because pseudonymised data remain personal data. Have ChatGPT write a template with no personal data, then fill it in yourself.
Do I have to say a text was written with AI?
For a text published to inform the public on matters of public interest, yes, unless a person reviewed it and the practice holds editorial responsibility for it. A text you check and sign yourself falls under that exception.
Does my team need AI training?
The AI Act asks for measures that support your team’s AI knowledge. Since 27 July 2026 you no longer have to guarantee a particular level, and the Act asks for no certificate or test. A short briefing and a written house rule on what is and is not allowed is a reasonable way to meet it.
Has the Data Protection Authority approved or banned ChatGPT for dentists?
Neither. It has published no ChatGPT rules for care providers, only a brochure for citizens that urges care with medical data in chatbots. The dental associations have published nothing on it either.
Tilcao is the operating system for dental practices in Belgium: its AI receptionist answers patient calls and WhatsApp messages in Dutch, French and English, and books, moves and cancels appointments in the practice’s own diary.