Checked · 5 October 2026
Legal and data boundaries.
An EU and Germany research map for the questions a real product must resolve.
Applicability depends on function, intended purpose, audience, provider role and actual data flows. The interaction implications below are design deductions, not a legal assessment of any particular product.
From requirement to design consequence
| Area | Trigger or requirement | Proposed design consequence | Primary source |
|---|---|---|---|
| Sensitive personal data | Religion and health may be special-category data. An Article 6 basis and an appropriate Article 9 exception are separate requirements. | Separate purposes for conversation, memory, training and sharing. Make any consent specific and withdrawal usable. | Process personal data lawfully |
| AI transparency | Article 50 includes direct-interaction transparency unless the AI nature is obvious, with duties depending on role and content. | Identify the AI role by the relevant first interaction or exposure; distinguish generated output from Scripture and human services. | AI Act Article 50 |
| Prohibited AI practices | Article 5 addresses specified manipulation and exploitation subject to statutory conditions, including relevant harm thresholds. | Review fear-based nudges, vulnerable audiences and monetisation; do not treat all reminders as prohibited. | AI Act Article 5 |
| Medical software qualification | Intended medical purpose, functions and promotional claims matter to qualification and classification. | Align claims and behaviour; a disclaimer does not override contradictory medical functionality. | Guidance on software qualification and classification MDR and IVDR |
| High-risk AI classification | Article 6 has specific classification conditions, including regulated-product and conformity-assessment requirements. | Assess each function and deployment context; mental health content alone does not establish high-risk status. | AI Act Article 6 |
| Professional representation | German law protects psychotherapeutic titles and regulates relevant professional practice. | Do not represent an AI persona as a licensed psychotherapist. Assess human services and medical-practice permissions separately. | Psychotherapeutengesetz Section 1 |
| Health-related advertising | HWG applies to advertising in its statutory scope and restricts misleading claims. | Avoid guaranteed healing and unsupported clinical-effectiveness statements. | Heilmittelwerbegesetz |
| Accessibility | BFSG covers specified products and services, including relevant e-books and e-commerce. | Check scope and exemptions; design accessible reading, notes, audio and purchase flows. | Barrierefreiheitsstärkungsgesetz Section 1 |
Check the current implementation schedule
The Commission’s current consolidated Article 113 text gives a general application date of 2 August 2026. It lists later application of Chapter III Sections 1–3, except Article 6(5), for specified high-risk systems: 2 December 2027 under Article 6(2) and Annex III, and 2 August 2028 under Article 6(1) and Annex I. These are not blanket extensions of all AI duties. Check the current text for the actual function and role before launch.
Purpose is expressed by the whole product
A faith or wellness label does not decide classification by itself. Assess what the software actually does, what the organisation markets and what users are led to expect. Symptom diagnosis, treatment recommendations and clinical outcome claims need their own analysis. Spiritual support and clinical care have different responsibilities.
Turn data choices into actual controls
Map collected text and audio, inferred data, source retrieval, memory, training use, logs, human access and third-party transfers. A private-looking interface must match the data flow. Define minimisation, retention, deletion, access, processors and international transfers. Assess whether a data protection impact assessment is required.
Open review questions
- Children’s access, consent, safeguarding and age-appropriate support.
- Specific medical-practice questions, including the German Heilpraktikergesetz.
- Device qualification, conformity assessment and provider or deployer responsibilities.
- How deletion and withdrawal affect derived profiles, backups and audit records.
- Accessibility scope and possible exemptions for the precise service.
- Other target jurisdictions and their health, privacy and consumer rules. HIPAA is not a general law for every faith app.
This is a scoped research map, not a completed compliance matrix or a certification. Keep source dates and product assumptions with each assessment.