Crosswalk
HIPAA ↔ EU AI Act
HIPAA regulates the use and disclosure of protected health information (PHI) by covered entities. The EU AI Act regulates AI systems placed on the EU market and, for healthcare, largely overlaps with the Medical Device Regulation. Companies operating cross-border need both. When an AI is a Class IIa+ medical device under Annex I MDR/IVDR, it is automatically high-risk under Article 6(1) EU AI Act.
| HIPAA | EU AI Act | Notes |
|---|---|---|
Security Rule § 164.308(a)(1) Risk analysis | Article 9 Risk management system | HIPAA is PHI-focused; AI Act is system-focused. |
Security Rule § 164.312 Technical safeguards | Article 15 Accuracy, robustness, cybersecurity | Encryption, access control. |
Privacy Rule § 164.514 De-identification | Article 10 Data governance | Training data considerations. |
Breach Notification § 164.400 Breach notification | Article 73 Serious incident reporting | Different timelines (60 days for HIPAA, 15/10/2 days for AI Act). |
§ 164.508 Authorization | Article 26(11) Notification of natural persons | Different bases — HIPAA is consent, AI Act is notice. |
Business Associate Agreement BAA | Article 26 deployer duties Deployer obligations | Third-party allocation. |
What to watch
Key differences
- · HIPAA is US-only, EU AI Act is EU-market-only. Cross-border requires both.
- · HIPAA penalties = up to $2.06M/year per violation category; AI Act = up to €35M / 7% turnover.
- · HIPAA does not require adversarial testing; AI Act Article 15 does.
- · When an AI qualifies as an MDR/IVDR medical device, AI Act conformity assessment integrates with the medical-device notified-body procedure.
Primary sources
Where every mapping was verified
Next steps
Turn a crosswalk into an audit-ready posture
Free vendor matchmaking
Need vendors that cover both frameworks?
Get matched with vendors that ship controls, evidence, and mappings across both frameworks on this page.
No credit card. Independent directory — we do not sell software ourselves.