AI agents and health data in France: HDS, pseudonymisation and compliant architecture in 2026

This guide does not list medical AI tools; for that, see the best AI tools for healthcare. It answers a different question: how to build or choose an AI agent that handles health data while staying within HDS, GDPR and the AI Act. Use cases by practice type are covered in our guide to AI in healthcare.

Article L.1111-8 applies to anyone hosting health data collected during prevention, diagnosis, care or social and medico-social follow-up. A host that stores such data digitally must hold a certificate of conformity. The version in force since 1 July 2025 was amended by article 32 of law 2024-449 of 21 May 2024 (the SREN law).

Article R.1111-8-8 defines hosting as holding health data on behalf of the data controller that produced or collected it, or on behalf of the patient. It has one exception: briefly receiving data to enter, format, print or digitise it is not hosting. A controller that outsources hosting must check that its provider is certified.

Article R.1111-9 (version in force since 27 March 2026) lists six hosting activities:

1. providing and running the physical sites that house the hardware;
2. providing and running the hardware infrastructure;
3. providing and running the virtual infrastructure;
4. providing and running the application hosting platform;
5. administering and operating the information system;
6. backing up health data, including electronic archiving.

Two certificates are usually distinguished: physical infrastructure host (activities 1 and 2) and managed services host (hébergeur infogéreur, activities 3 to 6). This split is presented by the French digital health agency (ANS); its page could not be loaded on 15 September 2026, so check it on esante.gouv.fr. For an AI agent the consequence is practical: the host that supplies the servers is not necessarily certified for the application platform or managed operations you hand over to it.

What counts as health data? GDPR article 4(15) defines it as personal data about a person's physical or mental health, including care received, that reveals their health status. The CNIL separates three cases: health data by nature (records, diagnoses, results), by combination with other data, and by intended use. A free-text question typed into a practice chatbot ("my treatment makes me dizzy") falls into the first category.

Légifrance gives 26 September 2026 as the date of effect; some law firms use 27 September. The one-day gap changes nothing in practice: contracts and data location need to be ready before then. The full AI Act timeline, as amended by the Digital Omnibus, is in our AI Act guide for businesses.

The new article R.1111-9-1 sets two rules.

• Storage: when hosting involves storing data, the storage takes place exclusively in an EU member state or a state party to the EEA agreement.
• Transfers: if the host or one of its subcontractors transfers the data outside the EU/EEA, including through remote access, the transfer is only allowed under a Commission adequacy decision (GDPR article 45) or the appropriate safeguards of article 46. In the second case, the hosting contract must state that there is no adequacy decision and describe the safeguards.

The same decree amends article R.1111-11 III: hosts must publish and keep up to date a map of data transfers outside the EU/EEA, possible remote access and the risk of unauthorised access by third-country authorities.

For an AI agent, remote access is the point most often missed. A support team outside the EU that can read logs, a US observability tool that receives prompt traces, or an offshore managed-services subcontractor are all in scope. Ask every host for its transfer map and check that the tools connected to the agent appear on it.

Each component of an AI agent has a different status under the hosting rules: some keep the data, others only see it pass through.

The vector index is the component most often underestimated. In a RAG setup the database holds more than vectors: it also stores the document passages that will be sent back to the model. If those documents are clinical reports or patient letters, the vector store holds health data. Our guide to RAG for businesses explains how it works, and the patient file triage use case shows a typical flow.

As of 15 September 2026 we found no text and no ANS or CNIL position saying whether sending a prompt that contains health data to a model API counts as hosting. The points below are our analysis.

• The R.1111-8-8 exception covers brief receipt to enter, format, print or digitise data. An inference call is brief processing too, yet it fits none of those four categories.
• If the provider keeps requests and answers (logs, abuse monitoring, assistant history), it holds data on behalf of the customer, which matches the definition of hosting.
• Since 26 September 2026, a provider that processes or keeps this data outside the EU/EEA also raises the transfer question under R.1111-9-1.

In practice, until this is settled, get any external API call reviewed by a lawyer or your DPO, and prefer architectures 1 or 2 below. Model providers' retention and subprocessing commitments are set out in their data processing agreements; our guide to AI agent security lists the technical safeguards on the agent side.

At the large clouds, HDS scope follows the list of ISO/IEC 27001 certified services and a list of regions. A certified compute layer does not mean the managed AI service is covered: read the certificate, the service list and the signed contract.

Two takeaways. First, "HDS certified" on a cloud provider's page covers a set of services and regions, never the whole catalogue. Second, none of the model providers we checked publishes an HDS certificate for its direct API. If you use a Claude integration or another model for healthcare work, choose the channel (direct API, certified cloud, self-hosted model) before writing the first line of code.

1. Self-hosted open-weight model in the HDS zone

The model runs on GPU instances from a host whose certificate covers them (Scaleway explicitly lists GPU Instances in its HDS scope). All data stays inside the certified zone: orchestrator, vector index, history, logs and inference. It is the easiest option to defend legally. The trade-offs: running the GPUs and model updates yourself, and a choice limited to models whose weights are published.

2. Pseudonymise before any call to an external model

A gateway hosted in the HDS zone replaces names, social security numbers, dates of birth, addresses and record IDs with tokens before the call. The mapping table never leaves the HDS zone, and the model's answer is re-identified on its way back. Two limits: free clinical text carries indirect clues (a rare occupation, a town, an admission date), and pseudonymised data remains personal data, as EDPB Guidelines 01/2025 and the IQVIA fine both show. GDPR, the processing agreement and the transfer analysis still apply.

3. A hyperscaler AI service covered by its certificate

A managed model service can be used if it falls within the cloud's HDS certificate scope, in an EEA region, with the HDS contract terms signed. At AWS, Bedrock is within scope under the published rule; at Microsoft and Google, coverage of the AI service has to be confirmed. Also check where inference runs: cross-region routing that leaves the EEA would conflict with R.1111-9-1.

In all three cases the agent is designed as a custom AI agent: storage components, logs and the gateway are chosen from this map at the design stage.

Pseudonymisation replaces direct identifiers while keeping re-identification possible with information held separately. Anonymisation means re-identification is no longer possible by reasonable means, at which point the data leaves the scope of GDPR. EDPB Guidelines 01/2025, adopted on 16 January 2025 and open for feedback until 14 March 2025, include medical examples; we found no final version as of 15 September 2026.

What these decisions mean for an AI agent:

• do not call prompts "anonymous" when only the names have been removed;
• turn on multi-factor authentication for every console that reaches the logs or the index;
• review access logs regularly and alert on unusual access;
• limit access to conversations to the team caring for the patient.

To develop or evaluate a model on health data, the CNIL page "IA et santé" of 5 March 2026 points to the prior formalities (reference methodologies MR-001, MR-003, MR-004, or an authorisation) and recommends data minimisation, a DPIA and defined retention periods.

The ANSM's three criteria (page updated 6 January 2026): software is a medical device if it has a medical purpose, produces a result specific to one patient and creates new medical information beyond storing, communicating or simply searching data. A booking agent, an administrative tool or record storage is not a medical device.

Rule 11 of Regulation (EU) 2017/745, in summary: software that provides information used to take diagnostic or treatment decisions is class IIa, IIb if an error could cause serious deterioration or surgery, and III if it could cause death or irreversible harm. MDCG 2019-11 gives the qualification details.

Since 2 August 2026, Article 50 requires telling people they are interacting with an AI; only machine-readable marking of generated content (Article 50(2)) has a grace period until 2 December 2026 for systems already on the market. See the AI agent transparency obligation.

On 30 October 2025, the HAS (France's national health authority) published "Premières clefs d'usage de l'IA générative en santé" for health, social and medico-social professionals. It uses the A.V.E.C. method: Apprendre (learn), Vérifier (check), Estimer (assess), Communiquer (communicate). Every AI output is treated as a proposal that may contain errors. In an agent, that means human validation before any message with medical content.

From 5 March to 16 April 2026, the HAS and the CNIL ran a public consultation on a draft guide on the proper use of AI systems in care settings (PDF dated February 2026). It has 10 sheets on deployment stages, from purchase to decommissioning, plus 2 on governance and generative AI. As of 15 September 2026 we found no final version.

This support minimum comes on top of compute, storage, backups and, for architecture 1, GPU instances.

1. Map every component of the agent and note which ones store health data.
2. Get each host's HDS v2.0 certificate, with the activities (1 to 6) and services it covers.
3. Check that storage and inference regions are in the EU or EEA.
4. Ask for the transfer and remote access map required by article R.1111-11 III.
5. Update the hosting contract before 26 September 2026 (transfer clauses).
6. Have a lawyer or the DPO confirm the status of calls to an external model API.
7. Redact or pseudonymise logs, traces and observability tools.
8. Carry out the DPIA and set retention periods for conversations.
9. Turn on multi-factor authentication and access log reviews.
10. Display the "you are talking to an AI" notice (Article 50) and provide a human handover.
11. Assess medical device status against the ANSM's three criteria.

Lumyniq, a Paris-based AI automation agency, builds custom AI agents, Claude integrations and n8n workflows, including for healthcare. Every project starts with an audit of the process and the data involved, which sets the architecture and the hosts before any quote.