August 2 Is the EU AI Act Deadline. A 6-Provider Dermatology Group Is Probably Out of Scope - Texas and California Are Not.

Can You Answer This in One Sentence, Before Your Front Desk Has To?

When a patient asks your medical assistant whether the chat window that booked her Thursday skin check was a person or a machine, what is the answer, and where is it written down? Most dermatology owners can answer the first half. The disclosure sits somewhere in a vendor's terms page, nobody at the front desk has read it, and no document in the building says which tools were switched on, when, or who approved them.

If that describes the practice, there is a 2026 problem here — not a hypothetical one. Two state laws that took effect on 1 January 2026 changed what a US medical practice has to tell patients about AI, and a third deadline lands on 2 August 2026 that most dermatology groups will find, after an afternoon of reading, does not apply to them at all. Knowing which is which is worth that afternoon.

For a specialty clinic, AI compliance in 2026 is almost entirely about three things: telling the patient plainly when a machine is involved in their care or their message, keeping a written record of which tools were switched on and who could use them, and being able to show that a licensed clinician reviewed anything clinical before it went out. Everything else on the vendor's compliance page is somebody else's obligation.

Four Places AI Already Touches a Six-Provider Dermatology Group

Owners underestimate their exposure because they think of "AI" as something they would have purchased. In a typical group running general derm, a Mohs surgeon two days a week and a cosmetic side, it is already in four places:

• Ambient note drafting in the exam room, feeding the visit note into the derm-specific record system the practice runs on.
• The after-hours phone and web chat agent that answers, triages and books once the front desk leaves at 5:30.
• Patient portal replies — the post-Mohs wound-care question at 10 p.m., the "is this normal" photo three days after a biopsy.
• Photo handling. Store-and-forward teledermatology, lesion-sorting tools, before-and-after comparison on the cosmetic side. The one owners forget, and the one with the most state-by-state variation.

Note what is not on that list: the payer's utilization-review software deciding whether your biopsy was medically necessary. That is real AI and it costs you real money, but it is regulated at the payer, not at you.

The Dates, in the Order They Hit

1 January 2026 — Texas. The Texas Responsible Artificial Intelligence Governance Act took effect. Its healthcare provision is the one that matters to a clinic: a provider using AI in a patient's care has to disclose that fact to the patient. Not buried in a portal terms page — disclosed, at or before the point of service.

1 January 2026 — California. SB 53 took effect the same day, aimed at the companies building the largest AI models, not the practices using them. Californian clinics do have a live obligation, but it comes from AB 3030: generative-AI-written clinical messages to patients need a disclaimer and a plain way to reach a human clinician instead.

2 August 2026 — the European Union. The EU AI Act's high-risk and transparency obligations carry this compliance date and reach US companies whose systems affect people in the EU. Most independent specialty clinics are not touched by it. A few are, and the test is narrow enough to settle in one meeting.

And the rest of the map. Colorado, New York, Utah, Nevada, Maine and Illinois all have their own AI statutes, with different triggers. Utah requires licensed professions to say so when a patient is dealing with a generative tool rather than a person. Illinois restricts AI in mental-health treatment and separately has strict biometric-data rules — worth raising with counsel if you run facial photography through any analysis tool at an Illinois location. Federal preemption is unsettled as of July 2026, so the state law where your offices sit still binds you.

flowchart LR
  A{"Do you treat or advise patients physically located in the EU?"} -->|No| B["EU AI Act: out of scope, memo it and move on"]
  A -->|Yes| C["Narrow scoping memo, reviewed by counsel before 2 August"]
  B --> D["Texas and California obligations still apply to your offices"]
  C --> D
  D --> E["Disclosure on the phone greeting and the chat header"]
  E --> F["Clinician attestation line on every AI-drafted note or message"]
  F --> G["Access log plus signed business associate agreement in the binder"]

What Is Genuinely Not Your Problem

Here is the part nobody sells you: you are the practice using the tool, not the company that built it, and almost every obligation that sounds terrifying in a webinar attaches to the builder. California SB 53 governs frontier model developers. Unless your group is training its own large models between Mohs cases, it is not about you. The EU AI Act reaches you only if your system's output affects people in the EU — which for a dermatology group means one of three things: you see or advise patients who are physically in Europe, you are a trial site for a European sponsor and AI-derived output flows into that study, or you have put a symptom-checker on a public website open to European users. If none of the three is true, write a one-page memo saying so, date it, have counsel glance at it, and file it. That memo is your compliance for 2 August.

What you cannot dismiss is disclosure. A patient in Texas is entitled to know that AI touched their care. A patient in California is entitled to a disclaimer on a machine-drafted clinical message and a route to a human. Both are cheap to satisfy and expensive to have ignored for eighteen months.

The Compliance File: Six Documents, One Afternoon

Here is the whole file. It fits in one folder, and it is what you hand over if anyone asks.

Assumptions, illustrative: 9.5 of those hours are administrator time at a fully loaded $58 an hour, 2 hours are outside counsel at $450. That is $551 plus $900 — $1,451 in total, once — plus an hour each January to review the file when the plan year and the statute book both turn over.

Now the comparison. Suppose a complaint or a payer audit arrives in 2027 and you have to reconstruct, after the fact, which tools were running in March 2026, who had access, and whether the message the patient received carried a disclaimer. Assume 20 hours of counsel at $450 and 15 administrator hours digging through vendor invoices and staff memories: roughly $9,870, before any finding is made. The file is not insurance against a bad outcome — it is the difference between answering a question in an afternoon and reconstructing a year.

Where a Human Has to Put Their Name

No statute lets a drafted note become a signed note by itself. The physician or physician assistant attests, and the attestation should say something truthful — that the note was drafted with AI assistance from the visit and reviewed and edited by the clinician before signing. Vague attestation wording written by a vendor is worse than none, because it is a written statement you did not verify.

Keep a clinician in the loop on anything that decides urgency. Booking a routine full-body skin check on Thursday is one thing. A patient describing a rapidly changing pigmented lesion, a red streak spreading from a surgical site, or bleeding that will not stop after a shave biopsy needs a person, and that escalation path should be written down and tested rather than assumed. The same goes for cosmetic work that touches medical judgment — a laser consult for a patient on isotretinoin is not a scheduling question.

And be honest about the limit of disclosure itself. Telling a patient a machine is involved is not consent, does not transfer liability, and does not make a wrong answer acceptable. It is the floor. Everything above it is still practicing medicine.

Frequently asked questions

We have one office in Texas and one in New Mexico. Do the Texas rules follow the second office?

Generally the law of the state where care is delivered governs — but if one phone system, one website and one chat agent serve both offices, you are applying the strictest rule to everyone anyway. Most multi-state groups write one disclosure that satisfies the toughest state they operate in, because two greetings on one phone tree fail the first time somebody edits it.

Do I have to tell patients that ambient note drafting is being used in the exam room?

In Texas, yes, and it is good practice everywhere: a line in the check-in paperwork and a sentence the clinician says at the start of the visit. Most groups add it to the intake form patients already complete on the tablet and let the medical assistant mention it while rooming. Patients rarely object to the tool; they object to finding out later.

Our teledermatology service sees a few patients who travel to Europe. Does that put us in EU scope?

Put this to counsel rather than to a blog: the answer turns on whether you are offering the service into the EU or continuing care for someone who happens to be travelling. Write down the facts — how many patients, from where, whether you advertise there — and buy one paragraph of written advice.

The Monday Version

Start with the access log, the one document you cannot recreate later. One sheet: tool name, date switched on, which staff or clinicians have it, who approved it, where the signed agreement is filed. Give it to the practice administrator with a two-week deadline.

When you write the disclosure text, remember where patients meet the practice after hours: the phone greeting and the chat window. CallSphere builds the AI voice and chat agents that answer those lines, book appointments and capture new patients around the clock — and the practical compliance point is that the disclosure sentence, the route to a human and the record of what was said belong to the conversation itself, not to a policy nobody reads.