Myndgard

Blog · · 5 min read

The EU AI Act and mental-health tools: what applies, and when

Which EU AI Act rules apply to mental-health and wellbeing tools, and when, after the 2026 amendments, and what it means for universities.

By Myndgard Limited

Banner reading: The EU AI Act and mental-health tools

The EU's Artificial Intelligence Act has been in force for two years, and its timetable changed this summer. If you work in a university counselling or wellbeing service and are being offered digital tools that use AI, it helps to know which parts of the law already apply, which have moved, and which questions matter for mental-health tools in particular.

The timeline, as it stands in August 2026

According to the European Commission:

  • 1 August 2024: the AI Act entered into force.
  • 2 February 2025: the prohibited practices and the AI literacy duty began to apply.
  • 2 August 2025: obligations for general-purpose AI models began to apply.
  • 2 August 2026: the Act became generally applicable, with exceptions. This includes the transparency rules in Article 50.
  • 2 December 2027: obligations for "stand-alone" high-risk systems listed in Annex III, such as certain uses in education.
  • 2 August 2028: obligations for high-risk AI built into products covered by other EU safety law listed in Annex I, which includes medical devices.

The last two dates are new. The original Act set 2 August 2026 and 2 August 2027 respectively. In November 2025 the Commission proposed a "Digital Omnibus on AI" to simplify and delay parts of the Act. Parliament and Council reached political agreement on 7 May 2026, and the result was adopted as Regulation (EU) 2026/1744, which entered into force on 27 July 2026, a few days before the original high-risk deadline. The amended Article 113 now sets out the later dates.

The high-risk obligations have been postponed, not removed. The omnibus also added new prohibited practices, aimed at AI that generates non-consensual intimate imagery and child sexual abuse material, which apply from 2 December 2026. It softened the wording of the AI literacy duty in Article 4, which now asks providers and deployers to take measures to support AI literacy among their staff.

What already applies, and is easy to miss

Emotion recognition in education is prohibited. Since February 2025, Article 5(1)(f) has banned AI systems that infer people's emotions in workplaces and education institutions, except for medical or safety reasons. In the Act, "emotion recognition" means inferring emotions or intentions from biometric data, such as faces or voices.

The Commission's guidelines on prohibited practices say the term "education institutions" is broad and covers all levels. They also read the medical exception narrowly. Therapeutic use should be understood to mean CE-marked medical devices, and the exception does not cover detecting general aspects of wellbeing. The guidelines give a direct example: an AI system intended to detect burnout or depression in a workplace or education institution would remain prohibited. The guidelines are not binding, but they show how the Commission reads the law. For universities, this rules out a category of "wellbeing monitoring" tools.

Manipulation and exploiting vulnerability are prohibited. Article 5 also bans AI that uses manipulative techniques, or exploits vulnerabilities linked to age, disability or social or economic situation, in ways likely to cause significant harm. The Commission's guidelines use a therapeutic chatbot as one illustration of how this can happen.

People must be told when they are talking to AI. From 2 August 2026, Article 50 requires AI systems that interact directly with people to be designed so that people know they are dealing with an AI, unless that is obvious.

When is a mental-health tool "high-risk"?

There are two routes, and they now have different dates.

Medical devices (Annex I, from August 2028). Under Article 6(1), an AI system is high-risk if it is, or is a safety component of, a product covered by legislation listed in Annex I and that product needs a third-party conformity assessment. Joint guidance from the Medical Device Coordination Group and the AI Board, MDCG 2025-6, explains that this generally captures AI in devices of Class IIa and above under the Medical Device Regulation, along with some Class I devices that need a notified body. So an AI-based mental-health app that is itself a medical device in one of those classes will be high-risk; one that is not a medical device will not be caught by this route.

Stand-alone uses (Annex III, from December 2027). Annex III lists uses including permitted emotion recognition, AI in education for admissions or evaluating learning outcomes, and emergency healthcare patient triage.

A general wellbeing app that does neither is likely to be outside the high-risk rules. It may still be subject to the transparency duties, the prohibitions and, always, the GDPR.

Why Myndgard Share does not use AI

Myndgard Share does not use AI or large language models to process personal data. That is a design choice for this product, not a judgement on others. There are careful teams building AI for mental health, and the law now gives a clearer framework for doing that well.

Our reasons are specific to what Share does. It supports students who are already in counselling, and the person interpreting their information is their counsellor. Questionnaires such as the PHQ-9 and GAD-7 are scored using their published rules. When an answer indicates risk, the assigned clinician is alerted so that a person can follow up. None of that needs a model to infer anything, and keeping it simple means students, counsellors and data protection officers can understand exactly what happens to the data.

What this means for counselling services

When a vendor says their tool uses AI, it is reasonable to ask:

  1. What exactly does the AI do, and what personal data does it process?
  2. Does anything infer emotions or mental state from faces, voices or other biometric data? If so, how is that compatible with Article 5(1)(f)?
  3. Is the tool a medical device, and what is its classification?
  4. How are users told they are interacting with AI?
  5. What do your staff need to know to use it well?

If the answers are clear, you are in a good position to judge the tool on its merits.

This article is general information, not legal advice.

Sources