August 2 Is the EU AI Act Deadline. A Six-Therapist PT Clinic in Toledo Is Not in Scope — Here's What Is.

"Do I have to do something about the AI rules by August 2?"

That is what clinic directors started asking their attorneys in June, usually after a practice-management newsletter used "extraterritorial reach" and "penalties" in the same sentence. Short answer for a six-therapist outpatient clinic in Toledo, or Boise, or Chattanooga: no, the August 2 deadline is not yours. Longer answer: three or four other things landed in 2026 that genuinely are yours, they cost less to handle, and almost nobody in outpatient rehab has done them.

Here is what actually shipped. The EU AI Act's high-risk and transparency obligations carry a 2 August 2026 compliance date and do reach US companies whose systems affect people in the EU. Texas's TRAIGA and California's SB 53 both took effect 1 January 2026. Colorado, New York, Utah, Nevada, Maine and Illinois each have their own AI statutes. And federal preemption of state AI rules is still unsettled as of July 2026, so the state law where your clinic sits binds you regardless of what you read about Washington sorting it out later.

The distinction that does most of the work: you use these tools, you do not build them

Nearly every one of these laws separates the company that builds an AI system from the company that uses one. The heavy obligations — technical documentation, conformity paperwork, risk files, model reporting — sit with the builder. California's SB 53 is aimed at the companies training the largest models; a clinic that buys a documentation assistant is not in that category and never will be.

If your clinic buys AI tools rather than building them, your compliance job is mostly three things: know what you are running, tell patients when it touches them, and keep a record showing a licensed human made the clinical calls.

That is a folder and an afternoon, not a project. The EU question resolves quickly for most outpatient rehab: unless you treat patients physically located in the EU by telehealth, or license a home-exercise app or outcomes tool to European users, the August 2 obligations belong to your software vendors. Send one email — ask WebPT, Prompt, Raintree, Net Health or whoever supplies your AI features whether they are in scope — and file the reply.

flowchart LR
  A["List every AI tool that touches a patient or an applicant"] --> B{"Does it treat and triage, or only schedule and transcribe?"}
  B -->|Schedules, answers phones, drafts notes| C["Disclose it, log it, keep the human signature"]
  B -->|Suggests a clinical decision| D["Treating PT signs, reasoning stays in the chart"]
  A --> E{"Any patient physically located in the EU?"}
  E -->|No| F["August 2 is the vendor's problem, get it in writing"]
  E -->|Telehealth to an EU address| G["Request the vendor's conformity paperwork now"]
  C --> H["Annual review with your attorney and malpractice carrier"]
  D --> H

The four documents to have in a folder before anyone asks

Every practice I have walked through this ends up with the same four items, and none requires a consultant.

1. An inventory. One page, one row per tool: what it is, what it touches, who the vendor is, whether protected health information passes through it, whether a business associate agreement is signed. Most clinics discover two or three tools they had forgotten — the ambient documentation assistant one therapist trialed, the AI scheduling feature switched on by default in a spring release, the chatbot a marketing agency installed on the website.

2. A disclosure line. One sentence in the new-patient intake packet and one on your website: the practice uses AI-assisted tools for scheduling, communication and documentation support, a licensed physical therapist makes all clinical decisions, and a patient can ask for a person. Texas's TRAIGA leans on exactly this kind of disclosure when AI is used in a patient's care, and Utah's approach centers on disclosure by licensed occupations — a physical therapist is a regulated, licensed occupation there.

3. A log. If an AI agent answers your phone, keep the recordings or written records of what it said, retained on whatever schedule your state and your malpractice carrier require for patient communications. If an assistant drafts daily notes, the chart must show who reviewed and signed. This is the document that actually protects you, and the one most practices skip.

4. The vendor replies. Business associate agreements, the EU scope answer, and a written statement of whether your data is used to improve the vendor's product. Three emails, one folder.

Hiring is where a rehab practice is closest to a real state statute

The AI use most likely to put an outpatient clinic in front of a regulator is not the one in the treatment room. It is the one in the hiring inbox.

Clinics hire constantly — PTs, PTAs, rehab techs, front desk, billing — and the tools that screen and rank applicants are exactly what several state statutes target. Illinois's law reaches AI used in employment decisions, and New York City has required bias auditing of automated employment decision tools for some time. If your applicant tracking system ranks PT candidates automatically, that is a covered use in more places than anything you do clinically. The fix: know whether your system ranks, ask the vendor in writing for its bias-audit documentation, notify applicants where required, and keep a human making the decision to interview or reject.

The second surprise: none of this is new HIPAA. HIPAA already governed what happens to patient data before AI arrived. A business associate agreement with an AI vendor is the same instrument you already sign with your billing company. If a vendor will not sign one, that answers the question.

What this costs, worked out

A one-time build with a small annual refresh. Figures are illustrative for a three-site practice with 18 clinicians.

I will not quote you a fine number, because US enforcement is genuinely unsettled and anyone offering a precise expected penalty is guessing. The honest case for the $827 is different: it buys the ability to answer in one email when a payer's audit team, a plaintiff's attorney, or your malpractice carrier's renewal questionnaire asks what AI your practice uses and who reviews it. That question is on renewal questionnaires now. Not having an answer is the expensive outcome.

What is out of scope, and where a human stays anyway

Owners waste more energy on the parts that do not apply. To be plain: you are not a frontier model developer, so obligations aimed at companies training very large models do not touch you. Using AI to draft a daily note is not "high risk" in the sense these laws mean, provided a licensed therapist reads and signs it — the signature is what keeps it out of the category. You do not need an algorithmic impact assessment for appointment reminders. And nothing here requires you to stop using AI; every one of these laws is about disclosure, documentation and keeping a human accountable.

What compliance paperwork does not do is decide clinical questions. No state statute tells you where the line sits inside a treatment room, so write it down yourself. The plan of care and every certification and recertification is the treating physical therapist's, full stop — a drafting assistant can assemble goals and objective measures, but the reasoning and the signature are the licensee's, and your state practice act treats delegating that judgment as a licensure problem, not a technology problem. Discharge decisions belong in the same bucket. And a conversation about prognosis after a failed rotator cuff repair is a conversation between two people; an agent pulled into one should hand off, and your log should show that it did.

Frequently asked questions

We do telehealth visits. One patient moved to Germany for six months. Are we suddenly in scope?

Talk to counsel, because it turns on your facts, but the general shape is that the EU AI Act reaches systems whose output affects people in the EU. One telehealth patient is an odd fact pattern rather than an obvious trigger, and most practices handle that visit without AI-assisted tools in the loop, which removes the question. The larger exposure is licensing an app or outcomes tool to European users.

Do I have to tell every patient, out loud, that AI answered the phone?

Written disclosure in the intake packet plus a clear statement at the start of an automated call is what most practices are settling on. The more important behavior is what happens when a patient asks for a person: the agent should transfer immediately, without arguing. If it does not, no disclosure language saves you.

Our EMR vendor turned on an AI feature we did not ask for. Whose obligation is that?

Both of yours, differently. They carry the builder obligations; you carry the duty to know it is running, disclose it, and control it. Practically: read release notes, add anything new to the inventory that week, and make sure your administrator can switch it off.

Does any of this change if we take Medicare?

The AI statutes do not change, but the documentation expectations pile on top. Medicare already requires the certifying physician signature on the plan of care within 30 days, progress notes at the tenth visit, and defensible medical necessity in your notes. If AI drafts those and no therapist meaningfully reviews them, your exposure in a targeted probe or a records request is a documentation problem long before it is an AI-law problem.

Monday's version of this

Open a blank spreadsheet and write down every piece of software in your practice that switched on an AI feature in the last eighteen months. Ask each clinic manager to add what you missed. That list, finished by Friday, is 60 percent of everything above.

CallSphere builds AI voice and chat agents that answer clinic phone lines and web chat, book appointments and capture patient inquiries 24/7 — and because those conversations are exactly the ones a disclosure and logging duty attaches to, they come with the records you would need to show what was said and when a caller was handed to a person. That is a documentation question as much as a phone question, and it is worth asking any voice vendor how they handle it.