AI in the salon and the practice: what applies, what you may show

Several rules apply at once in a salon, and the AI Act is not the sharpest. A skin analysis processes health data and needs explicit consent. Before-and-after images of filler treatments are banned from advertising in some member states — regardless of any label. Label only, and you will believe a problem is solved that you have not yet touched.

By Patrick de Kathen, Founder of KlarComply · Reviewed on 26 August 2026

The three things that actually apply

Beauty salons, aesthetic clinics and hair studios have been using AI for a while — usually without calling it that. Three applications matter legally, and they fall under different rules.

Under the AI Act, small and medium enterprises face the lower of the two figures (Art. 99(6)). Under the GDPR, the higher one applies. And the realistic scenario for a salon is not the maximum: a single unhappy client can complain to the data protection authority free of charge — and then you must be able to show the consent.

The skin analysis is the serious one

Feeding a facial image into a skin analysis produces a finding: pigmentation, redness, hydration, wrinkle depth. That finding says something about a person's state of health — which makes it health data within the meaning of Art. 4(15) GDPR. Health data belongs to the special categories under Art. 9(1).

What that means in practice: processing is in principle prohibited. It becomes lawful only through an exception — in a salon, almost always explicit consent under Art. 9(2)(a). “Explicit” means: not buried in the small print, not a tick-box next to the terms, but a separate, comprehensible declaration the client knowingly gives.

And the app provider?

The app processes the data on your behalf. That requires a data processing agreement under Art. 28 GDPR. Reputable providers have one ready and will tell you where their servers are; a provider who does not answer that question has answered it.

Three questions to ask before you use any of them:

• Where are the servers, and is there a data processing agreement?
• Are the images used to train the model — and can that be switched off?
• How long are they kept, and how do you delete them?

Before-and-after images: three questions, and labelling is the last

Question 1: are you allowed to show the image at all?

Advertising rules for aesthetic procedures are national law, and some are strict. Germany is the sharpest example in the EU: Section 11(1) sentence 3 no. 1 of the Medicinal Products Advertising Act bans comparative before-and-after depictions in advertising for operative plastic-surgical procedures without medical necessity — outright, regardless of any consent or label.

The Federal Court of Justice reads “operative” broadly: any instrumental intervention that changes shape or form, however minimally invasive. Dermal filler injections are expressly covered (BGH I ZR 159/23, 29 May 2024, confirmed 31 July 2025).

If you work in Malta, Ireland or anywhere else, do not assume the German rule applies — but do not assume the opposite either. Most member states regulate advertising for aesthetic procedures in some form. Find out before you post, not after the complaint.

Question 2: do you have consent — to publish?

That is not the same consent as the one for the skin analysis. A treatment photograph shows one identifiable person's state of health; publishing it is a separate processing of special-category data and needs its own explicit consent under Art. 9(2)(a) GDPR.

Three things that regularly go wrong:

• Consent can be withdrawn at any time (Art. 7(3) GDPR). If she withdraws it, the image comes down — from Instagram too, and two years later too.
• It has to be specific. Where may it appear, for how long, in what context? A blanket permission does not hold.
• Obscured is not anonymous. A bar across the eyes is not enough if a mole, a tattoo or the room makes the person recognisable.

Question 3: was AI involved? Then label it

Only now does Article 50 of the AI Act come in, applicable since 2 August 2026: anyone who generates or alters image, audio or video content with AI must make that recognisable. That covers outcome simulations, AI-assisted retouching and fully generated images — not an ordinary photograph in good light.

The booking bot has to identify itself

If a bot answers on your website or in your direct messages, the client must be able to tell they are talking to a machine — unless it is obvious from the context. One line does it: “You are chatting with an automated assistant. For a personal conversation, please call us.”

If you are a doctor: criminal law applies

Everything above applies to dermatology practices and physician-led clinics too — plus something of an entirely different order.

In practice that means: a skin image or a finding entered into a general-purpose AI tool can constitute the offence, even if the output never leaves the practice.

The route that is lawful

German law has expressly permitted involving other participating persons — including IT and AI providers — since a 2017 reform, and comparable routes exist elsewhere. Conditions attach:

• The provider must be contractually bound to secrecy. A data processing agreement is not enough: that covers data protection, not professional secrecy. You need both.
• Access may go no further than is strictly necessary.
• The technology must be state of the art so that unauthorised persons — including the provider's own staff — cannot access the content.
• Anyone so bound becomes criminally liable themselves for a breach. That is the point of the rule, and it is your test: a provider unwilling to sign that undertaking has told you something.

The second route is the patient's consent, which makes disclosure authorised — but it must be informed and name who receives the data. A blanket line in the intake form does not carry it.

And if the AI gives an assessment?

As soon as a system does not merely describe but evaluates — “this mole looks suspicious” — the question arises whether it is a medical device. Then the Medical Device Regulation and CE marking apply, and the AI Act classifies such systems through Annex I. Those AI Act duties were postponed to 2 August 2028; the medical device rules were not. Get it in writing from the manufacturer whether their system is placed on the market as a medical device — the answer decides a great deal.

And the training?

Since 2 February 2025, Article 4 has obliged you to take measures to foster AI literacy among your staff — since the Digital Omnibus a duty of effort, not of result. There is no headcount threshold: it applies to the three-person salon as much as to the chain.

To be straight about it: Article 4 on its own carries no fine. Article 99(4) lists the sanctioned obligations exhaustively, and Article 4 is not among them. Anyone telling you otherwise is selling through fear.

Why it still counts: when something goes wrong — an unlabelled image, an analysis without consent — the first question is always the same: did your staff know what they were doing? A dated training record answers it. Nothing else does.

A plan you can finish in an afternoon

1. Write down what you use. Skin analysis, image editing, booking bot, text tools for social media. It is usually more than you think.
2. Separate the consent. A dedicated declaration for the skin analysis, naming the provider and the retention period.
3. Request the data processing agreement from every provider that sees client data.
4. Agree on a label. One sentence everyone on the team uses the same way.
5. Train the team and keep the record. With a date, or it does not count.

Frequently asked questions

Is an AI skin analysis allowed at all?

Yes, with explicit consent under Art. 9(2)(a) GDPR. Without it the processing is prohibited, because a skin finding is health data and therefore falls under the special categories.

Is the consent signed at registration enough?

As a rule, no. Consent to treatment and consent to an AI-assisted skin analysis are two different acts. The second must expressly name the analysis, the provider and what happens to the images.

Are facial photographs biometric data?

Not automatically. Under recital 51 GDPR, a photograph becomes biometric data only when specific technical processing allows the unique identification of a person. A skin analysis does not identify, it assesses — which is why the classification as health data is the decisive one.

Do I have to label every edited photo?

Labelling is required where AI generated or altered the content — an outcome simulation, or AI-assisted retouching. An ordinary photograph taken with good light and no AI tool is not covered. Important: a label does not make lawful anything that would otherwise be prohibited.

Can I show before-and-after images of filler treatments if I label them?

In Germany, no. Comparative before-and-after depictions in advertising for operative plastic-surgical procedures without medical necessity are banned outright, and the Federal Court of Justice has held that dermal filler injections fall within that — any instrumental intervention changing shape or form counts. A label changes nothing. Elsewhere the rules differ, so check the law where you practise.

My client agreed — isn't that enough?

Not for an advertising ban: it does not protect the person shown, it exists to stop people being encouraged into medically unnecessary procedures. Her consent cannot lift it. Where images are permitted, her consent is essential — a separate one for publication, which she can withdraw at any time.

What does it cost if I do nothing?

Under the GDPR up to €20 million or 4 % of worldwide annual turnover, whichever is higher. Under the AI Act up to €15 million or 3 % — and for small and medium enterprises the lower figure applies there. More realistic than a regulator, though, is a complaint from a competitor.

I am a dermatologist. May I upload a skin image to an AI tool?

Only under conditions. Disclosing a patient's secret without authorisation is a criminal offence — in Germany punishable by up to a year's imprisonment or a fine, with equivalents across the EU. The offence is committed as soon as the provider's staff could access the data, whether or not anyone does. It becomes lawful through an undertaking of secrecy by the provider, or through the patient's informed consent.

Is a data processing agreement with the AI provider enough?

For data protection yes, for professional secrecy no. A DPA covers Article 28 GDPR; secrecy law requires a separate, express undertaking. Ask the provider for exactly that — not for the DPA, which everyone has.

Do I need a lawyer for this?

For the standard case, no. Inventory, consent wording, labelling and a training record can be handled with templates. A lawyer is worth it if you work with health data beyond the skin analysis, or if a complaint has already landed.