AI in the dental practice: what the X-ray AI may do, what you may show

Dentistry is where practice AI has come furthest: caries and lesion detection on radiographs has become routine. That is exactly where the strictest rules sit — medical-device law for the tool, secrecy law for the data. And for the smile simulation on Instagram, three questions apply, of which the AI label is the last.

By Patrick de Kathen, Founder of KlarComply · Reviewed on 27 August 2026

What actually applies in a practice

For small and medium-sized enterprises, the lower of the two AI Act values applies (Art. 99(6)). Under the GDPR, the higher one does.

The X-ray AI: your tool is a medical device — ask about it

Systems that mark caries, apical lesions or bone loss on radiographs support a diagnosis. Such software is generally a medical device under the Medical Device Regulation — CE marking, intended purpose and conformity assessment are the manufacturer's duty. The AI Act can additionally classify such systems as high-risk via Annex I where the product must undergo third-party conformity assessment; those AI-specific duties were postponed to 2 August 2028 — the medical-device duties were not.

For you as the operator, this does not mean certifying anything yourself. It means having two things in writing:

• The intended purpose: is the system placed on the market for diagnostic use, CE-marked — or "for documentation support only"? A system that officially must not diagnose but in practice shapes your findings is your risk, not the manufacturer's.
• The responsibility line: the AI marks, you diagnose. Final clinical responsibility stays with you — a sentence worth saying to your team before anyone gets used to "the AI didn't flag anything".

Professional secrecy: the strictest rule in the room

Dentists are bound by professional secrecy in every member state — under criminal law, professional regulation, or both, with the exact scope set by national law. The operative point for AI is the same everywhere:

If your practice is in Germany: dentists are named expressly in § 203(1) of the Criminal Code — up to one year's imprisonment for unauthorised disclosure — and since 2017, § 203(3)–(4) permits involving IT and AI providers only where they are contractually bound to secrecy; a data processing agreement alone is not enough, because it covers data protection, not criminal law. Outside Germany, check your national rules — the safe baseline is the same everywhere: patient data goes into no tool whose provider is not contractually bound.

The smile simulation: three questions, and the label is the last

AI tools that simulate the treatment result — whiter teeth, a closed gap, a new front — are advertising with an implied promise. The order of review will be familiar to readers of our beauty salon article:

Question 1: may you show the image in advertising at all?

Health-advertising law is regulated nationally and often strict. In Germany, § 11 of the Heilmittelwerbegesetz prohibits comparative before-and-after depictions for operative aesthetic procedures without medical necessity — and the Federal Court of Justice reads "operative" broadly, so purely aesthetic instrumental treatments such as veneers without medical indication can fall under the ban, while medically indicated restorations do not. That boundary is case-specific: clarify it before the campaign runs. Misleading claims of results are prohibited everywhere — a simulation presented as a guaranteed outcome is an easy target.

Question 2: do you have consent — for publication?

A treatment photo shows a specific person's state of health. Publishing it requires its own explicit consent under Article 9(2)(a) GDPR — revocable at any time, specific as to channel and context. Consent to treatment is not consent to publication.

Question 3: was AI involved? Then label it

Since 2 August 2026, Article 50 of the AI Act requires AI-generated or materially AI-edited images to be identifiable. For a simulation, one honest sentence is enough: "Simulation, AI-generated — not a treatment result." That line replaces neither answer 1 nor answer 2.

Booking bot, dictation, billing

The booking bot must identify itself — one sentence is enough: "You are chatting with an automated assistant." Dictation, transcription and AI-assisted billing tools, by contrast, see patient data and belong in the same review as every tool with a patient reference: a data processing agreement under Article 28 GDPR and, where your national law requires it, a contractual secrecy undertaking. A provider unwilling to sign the latter is telling you something.

And the training?

Since 2 February 2025, Article 4 of the AI Act has obliged you to take measures to foster AI literacy among your staff — since the Digital Omnibus a duty of effort, not of result, and without a standalone fine (Article 99(4) lists the sanctioned duties exhaustively; Article 4 is not among them). Why the record still matters: if a referral letter ends up in the wrong tool or a simulation goes online unlabelled, the first question — from the regulator, the professional body, the other side's lawyer — is always: did your staff know what they were doing? A dated training record answers it.

A roadmap you can finish in an afternoon

1. Inventory: X-ray AI, dictation, text drafting, simulations, booking bot, billing helpers — including the unofficial tools.
2. Manufacturer questions in writing: CE marking and intended purpose of the diagnostic AI; data processing agreement and secrecy undertaking for every tool that sees patient data.
3. Write down the patient-data rule: no patient reference in general-purpose tools; keep an approved-tools list.
4. Label the bot and the images: a disclosure sentence on the bot, a label on simulations — after the three questions, not instead of them.
5. Train the team and file the record — dated, per person.

Frequently asked questions