AI recording spreads in Estonian health care as the regulator says the audio needs its own legal basis

Editor’s Note: AI that records doctor-patient conversations and drafts summaries is spreading through Estonian health care, ERR News reported on Oct. 19, 2026. Private provider Confido uses its tool in several departments, Narva Hospital is procuring Estonian-language transcription software and Heba Clinic uses AI to document visits. Tartu University Hospital’s EMO24 pilot, begun Oct. 14, is a typed smartphone questionnaire. Estonia’s Health Services Organisation Act generally requires providers to keep confirmed outpatient and inpatient records for 30 years, but neither the act nor the ministry’s documentation regulation mentions consultation audio or transcription. In letters dated April 16 and May 7, 2026, the first expressly not a binding assessment, the Data Protection Inspectorate said that, at least under its own practice, recording a consultation is not automatically covered by that act, and named explicit patient consent as one possible basis.

For cybersecurity, data privacy, compliance and eDiscovery professionals, the issue is which artifacts a consultation leaves alongside the required record (audio, raw transcript, AI draft, logs), where vendors hold them and for how long.

Watch the Ministry of Social Affairs, where Deputy Secretary General Nele Labi says more legal clarity is needed and working groups are under way.

Industry News – Data Privacy and Protection Beat

AI recording spreads in Estonian health care as the regulator says the audio needs its own legal basis

ComplexDiscovery Staff

A patient arriving at the emergency department of Estonia’s Tartu University Hospital this autumn may type their complaint once into a smartphone questionnaire instead of repeating it to several staff members. That is one stated aim of EMO24, an artificial intelligence (AI) application the hospital began testing Oct. 14 in a voluntary three-month pilot.

The harder question is what happens to a patient’s account once AI has handled it. At other providers, ERR News reported, AI already records the consultation itself. Estonian law generally requires providers to keep confirmed records of outpatient and hospital care for 30 years. The recording is another matter: the country’s data protection regulator said this year that, at least under its own practice, recording a consultation is not automatically covered by the health services law.

Four providers at four different stages

Tartu is one of four providers named in that ERR report, published Oct. 19, 2026. The report said AI systems that record what patients and doctors say to each other are already in use at several hospitals. The same systems draft written summaries and assist physicians with diagnoses. The four providers use different tools at different stages. Tartu’s own Oct. 14 announcement describes EMO24 as a questionnaire and does not mention audio recording. Patients who come in on their own can fill it in on a smartphone after triage, logging in with Mobile-ID, while AI translates answers written in the patient’s native language and helps prepare summaries.

“The aim of using the EMO24 application is to reduce the time doctors and nurses spend on documentation. It also helps eliminate duplication where patients have to describe their condition to different staff members multiple times,” Aime Keis, head of the hospital’s emergency department, said in the hospital’s announcement, as translated by ERR. The hospital is testing the application with Certific OÜ, the company behind the Perearst24 platform used by many family practices, and it plans a longer, six-month project if the first three months prove the tool’s worth.

Confido, a private provider, began testing AI tools last year and is further along. “The solution is now in use in several departments and we plan to roll it out across the entire organization,” Chief Executive Edvard Garder told ERR. Heba Clinic uses AI before appointments to assemble patients’ medical histories, during visits to document what is said, and afterward to prepare summaries and explanations for patients.

Narva Hospital is still buying. It is running a public procurement for speech recognition and transcription software that works in Estonian. ERR said the software would turn conversations between clinicians and patients into “electronic text that can be processed, automatically translated, played back and stored.” Narva also wants the assistant to suggest medical codes and support doctors’ decisions, ERR reported. Under the procurement requirements ERR describes, doctors remain the final decision-makers in every process, and no AI-generated content may enter a patient’s medical record until a health care professional has reviewed and approved it.

The state is building its own tools. Nele Labi, deputy secretary general for innovation at the Ministry of Social Affairs, told ERR that two AI-based transcription tools are in development, one for family medicine and one for the electronic ambulance system. She also said the ministry has not comprehensively assessed AI use across all hospitals, and that hospitals are largely finding solutions on their own.

What Estonian law already keeps for 30 years

None of these deployments arrives in an empty legal space. Estonia’s Health Services Organisation Act lets a provider that is bound by a statutory duty of confidentiality process patient data, including health data, without the patient’s consent in order to provide care and, subject to statutory conditions, to plan it. The act, in the version in force from Oct. 1, 2026, also requires providers to document that care. The ministry’s regulation on documentation, in its wording in force since July 10, 2026, requires providers to document care on the day it is given or the next working day unless the regulation provides otherwise.

Data certifying outpatient and inpatient care must be kept for 30 years from the confirmation of the data on the service provided to the patient. The same section sets shorter periods for some categories: ambulance card data, referrals and referral replies are kept for five years from confirmation. A provision in force since April 1, 2026, lets a provider set aside the section’s retention periods for data collected in the national health information system, once the provider has transmitted the data there. In that national system, data is kept indefinitely by default, with shorter periods for some categories such as ambulance card data.

What neither the act nor the documentation regulation addresses is the recording of a consultation. Searches of both in-force texts on Oct. 20, 2026, for the Estonian stems for transcription, artificial intelligence and speech recognition returned no matches. The act contains no stem for recording at all, and the regulation uses it only in provisions on heart ultrasound examinations. The act does require providers to ensure that processing of personal data in their information systems can be traced, and the regulation sets the retention period for those logs at five years.

Where the inspectorate draws its line

Estonia’s Data Protection Inspectorate took up the recording question directly in two letters dated April 16 and May 7, 2026, both of which it has published on its website. The first is a reply to a request for clarification about AI-based documentation software that processes patient data during appointments. The inspectorate said it could not give a binding assessment of a specific product outside supervision proceedings, and it set out the legal framework instead.

The letter starts from the General Data Protection Regulation (GDPR), which it calls technology-neutral, read together with the Estonian health law. It also marks its own limits. The inspectorate said it cannot interpret the documentation obligation itself, which the Health Board supervises under legislation the Ministry of Social Affairs drafts, and it pointed documentation questions to those two bodies.

Within those limits, the letter separates two processing stages. The first covers a draft that stays a working aid: the clinician reviews the machine transcript or AI summary, corrects it and signs off on the entry only after that review. The inspectorate said that sequence makes the stronger case for counting the work as part of providing and documenting care. The same letter draws a consequence records teams should note. Once a clinician has confirmed a summary, it has become a document certifying care and can no longer be handled merely as a technical draft to delete at will.

The second stage is the recording itself, along with the processing that turns it into a transcript and input for the AI, and the inspectorate treats it separately. A doctor’s summary keeps only what care requires, the letters say, while a recording of the whole visit sweeps in far more. That includes what a patient says about socioeconomic, family and other private matters and any health details the patient mentions about relatives, preserved in a form that can be stored and played back. Both letters cite a Dec. 8, 2023, order concerning a doctor’s recording and disclosure of a patient conversation; the order does not mention AI. The doctor had recorded an appointment and forwarded the recording to a third party, Terviseportaal OÜ, without showing that the patient had consented or been told. The inspectorate found that recording the conversation, keeping the recording and passing it on could not, in that case, rest on the health services act, because the act’s provisions do not provide for recording conversations. It ordered the doctor to stop recording and delete the recordings.

The April letter concludes that the recording step needs a separate legal basis and names the patient’s explicit consent as one possible basis. The May letter, which the inspectorate titled a notice drawing attention to the rules and to which it said it expected no reply, was firmer. It went to a provider after a complaint about a social media post that described an open microphone during appointments and ChatGPT listening to a phone on speaker. Recording what patients say, including phone calls, should presumably rest on explicit consent, the letter said. It added that a person’s voice is itself personal data, and that speech recognition almost always needs at least a temporary audio recording, which also counts as processing.

How patients are offered a choice

That consent analysis meets a different vocabulary in the Oct. 19 account. Confido patients “have the option to decline the use of AI during their appointments,” ERR reported. Tartu said participation in its pilot is voluntary and that a patient who does not use the application will have their history taken, be diagnosed and be treated as before.

Both letters set out what consent requires if it is the chosen basis. It must be freely given, specific, informed and unambiguous; silence or inaction does not count; and the provider must be able to prove it was given. Citing European Data Protection Board guidance, the letters say consent is not valid when a person has no real choice or when a service is made conditional on processing it does not need. The board’s own guidelines treat that second situation as a presumption that consent was not freely given, and they say cases that overcome it will be “highly exceptional.” From that, the inspectorate concluded that consent can support audio recording only if the patient can receive care without it and refusing does not worsen the patient’s position.

ERR’s account does not say how Confido presents the choice or records it, so it does not establish whether the arrangement meets that standard. Tartu’s assurance that care continues as before for a patient who declines matches the inspectorate’s condition on refusal, but it concerns a typed questionnaire, not consent to recording audio. Labi told ERR that strict data protection rules apply and that patients must be told about the recording and what it is for.

Questions for records and discovery teams

For anyone who later has to preserve or produce this material, in a patient complaint, a Health Board inquiry or a malpractice claim, the first question is which artifacts exist. A consultation can now leave an audio file, a raw machine transcript, an AI-drafted summary, the clinician’s confirmed entry and processing logs, held by the provider, a vendor or both.

The Oct. 19 account does not say where any provider stores recordings or transcripts, how long it keeps them, or which vendor supplies Confido’s tool. Records managers should put those questions to each deployment directly. Contracts deserve the same attention. If a vendor wants to put patient data from the service to its own uses, such as improving a model, the inspectorate said that is a new purpose needing its own legal basis. The letter named patient consent as the only theoretical candidate and called obtaining it essentially impossible in practice.

Location and security come next. Keeping transcripts that contain health data inside the European Economic Area is, in the inspectorate’s assessment, usually the simpler and lower-risk course compared with routinely sending them outside it. For the product it was asked about, it named health data, AI-based processing, possible effects on care documentation, several outside vendors and a possible transfer outside the area as signs of high risk. High risk is the condition that makes a data protection impact assessment necessary. Garder told ERR that Confido considers its current tools secure, and he said the state should set common security criteria rather than build a single AI system for every provider.

Others in the sector have raised similar questions. In an April ERR report on the state’s plans for AI in health care, Kirke Maar, team lead of the Eesti.ai initiative, said the initiative cannot send such data to a U.S. cloud. Triinu-Mari Ots, a board member of the Estonian Society of Family Doctors, said in the same report that she did not fully grasp where the information ends up or who is liable.

Ministry working groups and a retention review

The ministry has set up working groups on the question. Labi told ERR that the technology is developing quickly. “We need greater legal clarity and must ensure that patients understand how it is used and that the process is transparent,” she said. In a Jan. 30, 2026, letter signed by Labi, the ministry also asked medical, hospital, disability, academic, technology and state health organizations for views on the act’s retention periods. Responses were due Feb. 25, and the letter said they would feed further discussion and the preparation of possible amendments.

That review asked whether the act’s current periods for paper and digital records remain justified, without mentioning audio or AI. The deployments run on their own clock: Tartu’s pilot, if it runs its planned three months, ends about mid-January 2027, and the national family medicine and ambulance tools remain in development.

The emergency patient in Tartu may describe their condition only once. Whatever tool takes that account, the provider must still document the visit, and the confirmed entry is generally kept for 30 years. Where AI listens to a consultation, Estonian providers are now deciding, one deployment at a time, whether the audio, the raw transcript and the unconfirmed draft survive alongside that entry. Neither the act nor the documentation regulation says for how long. Which of those artifacts would your organization treat as part of the record if the visit were ever disputed?

News Sources

• Tervishoiuteenuste korraldamise seadus (Riigi Teataja)
• Tervishoiuteenuse osutamise dokumenteerimise tingimused ja kord (Riigi Teataja)
• Ettekirjutus-hoiatus isikuandmete kaitse asjas nr 2.1.-5/23/2684-8 (Andmekaitse Inspektsioon)
• Vastus selgitustaotlusele: Tehisintellektipõhine dokumenteerimistarkvara tervishoiuteenuste osutamisel (Andmekaitse Inspektsioon)
• Tähelepanu juhtimine: Üldotstarbelise tehisintellekti kasutamine tervishoius (Andmekaitse Inspektsioon)
• Tervishoiuteenuse osutamisel tekkivate dokumentide ja andmete säilitustähtajad (Ministry of Social Affairs via adr-docs.karlerss.com)
• Guidelines 05/2020 on consent under Regulation 2016/679 (European Data Protection Board)
• Kliinikumi EMO testib patsiendi terviseseisundi info kogumist tehisaru abil (Tartu University Hospital)
• AI recordings of doctor-patient conversations the new norm for Estonian hospitals (ERR News)
• Erameditsiini ettevõte Confido on keset koroonat kiirelt laienenud (ERR)
• Riik plaanib tehisintellekti abil tõhustada tervishoiu valdkonna tööd (ERR)

Assisted by GAI and LLM Technologies

Additional reading

• Latitude59’s four-country push puts startup deals in front of four data-protection laws
• Slush 2026 brings a smaller, sharper bet on European startups to Helsinki
• Tallinn Digital Summit 2026 puts the agentic state to the test
• Nine months across Europe’s tech-sovereignty arc, from Tallinn to London
• The flame and the frontier: how Estonia carries a 1919 victory into a tense 2026
• Estonia aims to be first to give AI agents official digital IDs

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.