Do you have to tell your patients that an AI answers the phone?
Yes, and the patient has to be told at the start of the call rather than in a privacy notice nobody opens. Article 50 of the EU AI Act has applied since 2 August 2026, and it requires that a person be informed they are interacting with an AI system. The duty it writes falls on the provider of the system, so it is the supplier who has to build the disclosure in. Your own duties sit in a different place: the GDPR makes your practice the controller of a dental call, which is health data, and Belgian law adds its own rule about recording it. Three regimes, three different people carrying them. This page pulls them apart, says what stays yours, and gives you the wording to put in the waiting room and on your website.
Tilcao is the operating system for dental practices in Belgium: its AI receptionist answers patient calls and WhatsApp messages in Dutch, French and English, and books, moves and cancels appointments in the practice’s own software. It does not diagnose, assess symptoms or triage.
Last updated
Yes. And this is the sentence that does it.
The patient is told in the first sentence of the call, before anything else is said, and without having to ask. That is the whole of it. There is no consent form, no button to press and nothing for the patient to read in advance. The disclosure is spoken, it is the opening line, and it carries the recording notice with it so the caller has both facts before they have said a word about their tooth.
Practices worry that the sentence will cost them the call. It is worth saying plainly that the alternative is worse. A patient who works it out halfway through booking, and feels they were allowed to believe otherwise, is the one who tells the waiting room about it. Saying it first turns an awkward discovery into an ordinary piece of information.
These are the opening lines Tilcao uses, in the three languages it answers in. A practice can change the wording so it sounds like the practice. It cannot remove the disclosure, and that is not a setting on offer.
- English: Hello, you have reached the dental practice. You are speaking to the practice’s AI assistant and this call is recorded. How can I help you today?
- Dutch: Goeiedag, u bent bij de tandartspraktijk. U spreekt met de AI-assistent van de praktijk en dit gesprek wordt opgenomen. Waarmee kan ik u helpen?
- French: Bonjour, vous êtes bien au cabinet dentaire. Vous parlez à l’assistant IA du cabinet et cet appel est enregistré. Que puis-je faire pour vous ?
- On WhatsApp the same disclosure sits at the top of the first reply, because a written channel gives the patient no voice to judge by.
What does the AI Act actually require, and of whom?
The text is shorter than its reputation. Article 50(1) of Regulation (EU) 2024/1689 says providers must ensure that AI systems intended to interact directly with natural persons “are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system”. The exception follows immediately: “unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use”. Article 50(5) adds the timing. The information “shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure”.
Notice who the sentence is addressed to. A provider, under Article 3(3), is whoever develops the system and puts it on the market or into service under their own name. A deployer, under Article 3(4), is whoever uses it under their own authority in the course of their work. Tilcao is the provider. Your practice is the deployer. The design duty in Article 50(1) is therefore Tilcao’s, which has a useful practical consequence for a practice owner: you cannot lawfully be sold an AI phone agent that keeps quiet about itself, and if you found a supplier willing to switch the disclosure off for you, you would be running a system that no longer complies.
The exception is the part suppliers reach for, and it is not a plan. Recital 132 of the same regulation says that when implementing the obligation, “the characteristics of natural persons belonging to vulnerable groups due to their age or disability should be taken into account”. A dental practice answers the phone to a patient of eighty-two with a loose denture and to a parent on a station platform with a child in pain. Neither is the reasonably well-informed, observant and circumspect listener the article imagines, and neither should have to be. Tilcao gives the disclosure whether or not it would be obvious, which removes the argument rather than winning it.
One more thing to know, and then to stop worrying about. Article 99(4) puts fines of up to fifteen million euro, or three per cent of worldwide annual turnover, behind the Article 50 obligations. That penalty attaches to the operator that breached the duty. A practice that bought a system which discloses on every call, and left the disclosure alone, is not the operator in question.
Is an appointment-booking agent a high-risk AI system?
No, and the reason is worth understanding rather than taking on trust, because it is also the question to put to every other supplier you speak to. There are two routes into the high-risk category and a booking agent takes neither of them.
The first route is Article 6(1). A system is high-risk if it is a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in Annex I, and that product has to undergo a third-party conformity assessment. Medical devices arrive here. Software has a medical purpose when it is intended to diagnose, prevent, monitor, predict or treat. Writing a check-up into a diary on Thursday at 10u30 has no medical purpose at all, so there is no device and no assessment.
The second route is Article 6(2), which makes the eight areas of Annex III high-risk. Seven of them are nowhere near a dental practice: biometrics, critical infrastructure, education, employment, law enforcement, migration, and the administration of justice. The eighth, access to essential private and public services, is the one that comes close. Read it carefully and the line becomes visible. It covers systems used to evaluate and classify emergency calls, to dispatch emergency first response services, and, in the wording of the annex itself, “emergency healthcare patient triage systems”.
Triage is the line. An agent that judges how urgent a caller is, ranks patients against each other, or decides who gets the same-day slot, is doing the thing the annex names. Tilcao does not do it and is built so that it cannot. It does not assess symptoms, does not judge urgency and does not decide who is seen first. When a caller reports pain, swelling, bleeding or trauma, it stops, says it does not assess symptoms, and hands the call to a named person at the practice with the patient file attached. The clinical judgement never leaves your team, which is both the right answer clinically and the reason the regulatory answer is easy.
What that means for you in practice is nothing to do. There is no registration, no conformity assessment and no CE marking for a booking agent. Tilcao has not carried out a high-risk conformity assessment, does not need one for this use, and claims no compliance status of any kind. Ask a competitor the same question and listen to the answer: a supplier whose agent “prioritises urgent patients”, “assesses the complaint” or “decides who needs an emergency slot” has put itself in a different category from the one it is probably selling from.
What do the GDPR and Belgian law require, and why is that a separate question?
Because the AI Act is about the fact that it is a machine, and the GDPR is about the data. Satisfying one does nothing for the other. A practice that discloses beautifully on every call and has no processing agreement has solved the smaller of its two problems.
Under the GDPR your practice is the controller and Tilcao is the processor, acting only on your written instructions. An Article 28 processing agreement, the verwerkersovereenkomst or contrat de sous-traitance, has to be signed before the first real patient call, and until it exists there should be no real patient call. The content of a dental call makes this stricter than a generic supplier contract. The fact that someone is your patient, and what they say they are ringing about, is data concerning health under Article 9, so the processing rests on Article 9(2)(h) for the provision of health care, read with Article 9(3), which requires it to happen under the responsibility of someone bound by professional secrecy or an equivalent duty of confidentiality.
Your own transparency duty sits in Articles 13 and 14, and it is yours alone. The patient has to be able to find out, from your privacy notice, that calls are answered by an AI system on the practice’s behalf, who processes the data, that the call is recorded, how long each part is kept, and what rights they have. The spoken disclosure does not replace that paragraph, and the paragraph does not replace the spoken disclosure. They answer different questions asked at different moments.
Recording is a third question again, and Belgian law here is clearer than most people expect. Article 314bis §1 of the Strafwetboek / Code pénal punishes intercepting or recording communication that is not accessible to the public where the recorder is someone “waaraan hij niet deelneemt”, that is, someone who does not take part in it, without the consent of all participants. Your practice takes part in its own patient calls, so that paragraph is not about you. What §2 then punishes is using a lawfully made recording “met bedrieglijk opzet of met het oogmerk te schaden”, with fraudulent intent or intent to harm. So the legal question is not whether you may record. It is whether everyone was told before it started and what becomes of the recording afterwards. Telecom rules and the GDPR both require that notice in advance, covering the recording itself, its purpose and how long it is kept, which is why all three sit in the same opening sentence.
Two practical notes. Retaining the raw audio is separable from the service, so a practice that would rather keep transcripts and delete recordings quickly can say so in the agreement. And professional secrecy, beroepsgeheim or secret professionnel under Article 458 of the Strafwetboek / Code pénal, survives all of this. It is criminal rather than administrative, it binds you and everyone you let hear a call, and no contract signs it away.
Who carries which obligation?
This is the table to keep. A dentist asks one question and gets three regulations back, usually from someone with a product to sell, and the three arrive fused together. They are separate, they come from different instruments, and they land on different people.
Read the middle column before the right one. Tilcao carries the disclosure on the call, and that is a real thing it carries. It does not carry your privacy notice, your lawful basis, your answer to an access request or your professional secrecy. No supplier can. A supplier who tells you that buying their product makes your practice compliant is describing something that does not exist, and the sentence is worth remembering as a test rather than as an insult.
| Obligation | Who it falls on | What it means in practice |
|---|---|---|
| Inform the person that they are interacting with an AI system, AI Act Article 50(1) | The provider of the system, which is Tilcao | Built into the opening sentence of every call and the top of every first WhatsApp reply |
| Give that information clearly, at the latest at the first interaction, Article 50(5) | The provider | It is the first thing said, before the caller states their business, and never at the end |
| Do not disable or work around the disclosure | The practice, as deployer | Reword it to sound like your practice. Removing it is not offered, and would leave you running a system that no longer complies |
| Tell patients how their data is processed, GDPR Articles 13 and 14 | The practice, as controller | A paragraph in your own privacy notice naming the AI answering, the recording, the retention and the rights |
| Have a lawful basis for health data, GDPR Article 9 | The practice, as controller | Article 9(2)(h) for the provision of health care, read with Article 9(3). Not consent, which is not freely given by someone ringing in pain |
| Sign an Article 28 processing agreement before the first real patient call | The practice and Tilcao, together | Instructions, retention per data type in days or months, every sub-processor named in an annex, breach notification |
| Tell every participant before the recording starts | The practice, delivered by Tilcao on the call | The recording, its purpose and how long it is kept, in the same opening sentence |
| Answer a patient asking what was recorded, or asking for erasure | The practice, as controller | Tilcao hands over the audio, transcript and summary so you can answer inside the one month the GDPR gives you |
| Keep professional secrecy intact, Article 458 of the Strafwetboek / Code pénal | The practice, and everyone it allows to hear a call | Criminal, not administrative. It survives the GDPR and no processing agreement can waive it |
What goes in the waiting room, on the website and on the answering message?
Less than practices expect. The AI Act duty is discharged on the call itself, and the GDPR duty is discharged by the privacy notice. Everything else in this section is good practice rather than law, and good practice here is mostly about not surprising anyone.
A sign in the waiting room is not required by anything. It is still worth a small card at the desk, because the patient most likely to ask about it is the one standing in front of you, and a card lets your team answer without improvising. One line is enough, and a line that sounds like your practice beats a line that sounds like a legal department.
The website needs two things. A sentence on the contact page, next to the telephone number, so a patient who prefers to write knows before they ring. And a paragraph in the privacy notice, which is the part that is actually required. Your existing notice almost certainly has a section on the data you collect when a patient contacts you. The AI answering belongs there, not in a separate AI page nobody visits.
The answering message needs nothing new in most practices. If calls divert to the agent, the disclosure happens when the agent picks up, so there is nothing to record in advance. If you keep a voicemail for the hours you choose not to cover, it needs no AI notice, because there is no AI on it. The only case worth thinking about is a message that plays before the agent answers, where a patient could otherwise believe a person is about to come on the line.
Tell your team before you tell the waiting room. The receptionist who learns from a patient that the practice now uses an AI has been handed a bad afternoon, and it was avoidable.
- Waiting room card: “Calls to the practice are answered by our AI assistant. It books, moves and cancels appointments. It does not assess symptoms. Ask for a person at any moment and we will call you back.”
- Contact page, beside the number: “Our phone is answered by an AI assistant in Dutch, French and English. It says so at the start of the call, and calls are recorded. You can ask to speak to someone at the practice at any point.”
- Privacy notice, in the section on contacting the practice: name the AI answering, name the processor, say that the call is recorded and why, give the retention period per data type, and point to the patient’s rights and to the Gegevensbeschermingsautoriteit / Autorité de protection des données.
- Team briefing, one page: what the agent can do, what it refuses to do, how a handover reaches them, and the exact sentence to use when a patient at the desk asks whether the practice is replacing people.
What happens when a patient objects, or asks for a person?
Tilcao hands over, without arguing and without a second attempt to keep the patient in the conversation. During opening hours the call goes to a named person at the practice, by the rules the practice set. Outside them, it takes the callback, the number and the reason in the patient’s own words, and the practice rings back in the window the practice has chosen. A disclosure with no alternative behind it is a notification, not a choice, which is why the alternative has to exist before the disclosure is worth anything.
That has a consequence for the practice, and it is the honest version of the advice. If you route every call to the agent and keep no human route at all, you have removed the thing that makes the arrangement defensible. Keep a route. It does not have to be a person sitting by a phone, and a reliable callback with a stated window is a real alternative. What it cannot be is a loop that returns the patient to the agent.
Under the GDPR the patient also has a right to object, and in practice an objection at the front desk means exactly this: a human line. A patient who wants to know what was recorded makes an access request, which goes to the practice as controller, and the practice answers it. Tilcao’s job is to put the audio, the transcript and the summary in your hands well inside the month the regulation allows.
How often patients actually ask for a person is not something this page will put a number on. Tilcao is pre-pilot in Belgium, no measurement exists, and an invented figure is exactly the kind of thing this page is arguing against. What can be said is that the request costs the practice nothing to honour, and that a practice which cannot honour it has a problem no wording will fix.
Questions practices ask
Do I have to tell patients that an AI answers the phone?
Yes. Article 50(1) of the EU AI Act requires that a person interacting directly with an AI system be informed of it, and the obligation has applied since 2 August 2026. The article writes that duty for the provider of the system rather than for you, so in practice the supplier builds the disclosure into the call. Your own duty is the GDPR one: your privacy notice has to tell patients how the call is handled and recorded. Tilcao says it in the first sentence of every call, unprompted, together with the recording notice.
Can I rely on the exception for when it is obvious that it is an AI?
It is a poor plan. The exception covers what would be obvious to a person who is “reasonably well-informed, observant and circumspect”, and recital 132 says the characteristics of people who are vulnerable by age or disability have to be taken into account when applying the obligation. A dental practice answers the phone to patients in their eighties and to parents with a child in pain. The Commission reads the exception narrowly, and it is cheaper to say the sentence than to argue about it afterwards. Tilcao discloses whether or not it would be obvious.
Is an AI that books dental appointments a high-risk AI system?
No. There are two routes into the high-risk category and a booking agent takes neither. Article 6(1) captures systems that are safety components of products under Annex I, such as medical devices, and booking an appointment has no medical purpose. Article 6(2) captures the eight areas of Annex III, where the nearest point covers evaluating and classifying emergency calls, dispatching emergency services and “emergency healthcare patient triage systems”. Triage is the line, and Tilcao does not triage, assess symptoms or judge urgency.
Why does it matter so much that Tilcao does not triage?
Because that single capability is what separates an administrative tool from a regulated one. A system that ranks callers by urgency, or decides who gets the same-day slot, is doing what Annex III names as patient triage, and it carries the full high-risk regime with it. Tilcao does not assess symptoms and does not decide who is seen first. When a caller reports pain, swelling, bleeding or trauma, it says it does not assess symptoms and hands the call to a named person with the file. The clinical judgement stays with your team, which is where it belongs anyway.
Do I need a sign in the waiting room?
No rule requires one. It is still worth a small card at the desk, because the patient most likely to ask about it is standing in front of your receptionist, and a card means nobody has to improvise. Something like this does the job: calls to the practice are answered by our AI assistant, it books, moves and cancels appointments, it does not assess symptoms, and you can ask for a person at any moment. Tell your team before you put up the card.
What exactly do I put in the practice privacy notice?
It belongs in the section you already have about contacting the practice, not on a separate AI page. Name the fact that calls are answered by an AI system on the practice’s behalf, name the processor, say that the call is recorded and why, give the retention period for each data type as a number of days or months rather than “as long as necessary”, set out the patient’s rights of access, rectification, erasure and objection, and give the address of the Gegevensbeschermingsautoriteit / Autorité de protection des données for a complaint.
May we record the calls, and do we have to say so?
You may, and you have to say so before the recording starts. Article 314bis §1 of the Strafwetboek / Code pénal is about someone recording a conversation in which they do not take part, and your practice takes part in its own patient calls. What §2 punishes is using a lawfully made recording with fraudulent intent or intent to harm. On top of that, telecom rules and the GDPR both require every participant to be told in advance about the recording, its purpose and how long it is kept. Tilcao puts all three in the opening sentence.
What if a patient refuses to speak to an AI?
Tilcao hands over, with no argument and no second attempt to keep them in the conversation. During opening hours the call goes to a named person by the rules the practice set. Outside them, it takes the number and the reason in the patient’s own words, and the practice calls back within the window it has chosen. Keep a human route open, because a disclosure with nothing behind it is a notification rather than a choice, and it is the alternative that makes the arrangement defensible.
Does using Tilcao make my practice AI Act compliant?
No, and any supplier who says otherwise is selling something that does not exist. Tilcao carries the disclosure on the call, which is a real obligation really discharged. It does not carry your privacy notice, your lawful basis for health data, your answer to an access request or your professional secrecy under Article 458 of the Strafwetboek / Code pénal. Tilcao holds no certification, has completed no conformity assessment and claims no compliance status. What it can do is give you the detail you need to write your own paperwork accurately.