A symptom-checking chatbot is a medical device question before it is a chatbot question.

For this tool the determination says the UK regulator's AI-as-a-medical-device rules apply. The gate, in the product's words, is whether the AI makes, supports or influences clinical decisions. MHRA AIaMD returned seven obligations, and they read like a device file: classification, UK marking, post-market surveillance, and the incident clocks a safety officer lives by: two days, ten days, fifteen days.

• Classification of general medical devicesMedical Devices Regulations 2002 (SI 2002/618) reg. 7MHRA AIaMD
• UK marking of general medical devicesMedical Devices Regulations 2002 (SI 2002/618) reg. 10MHRA AIaMD
• Initial reporting of serious incidents — serious public-health threat (2 days)Medical Devices Regulations 2002 (SI 2002/618) reg. 44ZH(4)MHRA AIaMD
• Initial reporting of serious incidents — death or unanticipated serious deterioration (10 days)Medical Devices Regulations 2002 (SI 2002/618) reg. 44ZH(5)MHRA AIaMD
• Post-market surveillance systemMedical Devices Regulations 2002 (SI 2002/618) reg. 44ZEMHRA AIaMD

The tier shown is high-risk. Three obligations are in force now: a screen against the prohibited practices before anything else, the art. 4a safeguards if special-category data is used to detect bias, and AI literacy for the staff who operate it.

• Prohibited AI practices — screen the deployment against art. 5 and refrain (Regulation (EU) 2024/1689 art. 5)Regulation (EU) 2024/1689 (Artificial Intelligence Act) art. 5EU AI Act
• Confirm the art. 4a safeguards if special-category data is processed to detect or correct bias in Patient Triage Chat (art. 4a)Regulation (EU) 2024/1689 (Artificial Intelligence Act) art. 4aEU AI Act
• EU AI Act art. 4 — confirm AI literacy for staff operating this systemRegulation (EU) 2024/1689 (Artificial Intelligence Act) art. 4EU AI Act

That is the question the determination puts on the list rather than answers for you: GDPR returned a meaningful-human-review obligation for the tool's automated decisions, and UK GDPR its art. 22C safeguards. Whether a nurse reviewing the same-day and emergency suggestions meets them is for your counsel; the obligation is cited so the question is not missed.

• Give a meaningful human review to Patient Triage Chat's automated decisionsRegulation (EU) 2016/679 (General Data Protection Regulation) art. 22GDPR
• Give art. 22C safeguards to Patient Triage Chat's solely automated significant decisionsUK GDPR (assimilated Regulation (EU) 2016/679) Arts. 22A-22DUK GDPR
• Identify an art. 9(2) condition before Patient Triage Chat processes special-category dataRegulation (EU) 2016/679 (General Data Protection Regulation) art. 9GDPR

GDPR returned fourteen obligations and UK GDPR ten. Two of them are the breach clocks: the supervisory authority within 72 hours, and the people affected when the risk to them is high. NIS2 adds the incident timelines and puts accountability on the management body.

• Notify the supervisory authority of a breach touching Patient Triage Chat within 72 hoursRegulation (EU) 2016/679 (General Data Protection Regulation) art. 33GDPR
• Tell affected individuals about a high-risk breach touching Patient Triage ChatRegulation (EU) 2016/679 (General Data Protection Regulation) art. 34GDPR
• Incident reporting timelinesDirective (EU) 2022/2555 art. 23NIS2
• Management-body accountabilityDirective (EU) 2022/2555 art. 20NIS2

Four laws were recorded as not determined because a question was not answered: the EU-U.S. Data Privacy Framework, the UK ATRS, UK BCRs and the UK IDTA. Each stays marked that way, with the question named on its row, rather than silently as no.