French HDS AI Standards: What Clinic Directors Must Verify Before Deploying Scribing Tools

TL;DR — French HDS AI Standards for Clinical Scribing

• HDS is not one certificate. CNIL audits for AI scribing expect HDS certification covering Activities 5 & 6 (health data hosting and administration) for the SaaS layer that processes audio and runs LLM inference—not merely IaaS Activities 1–3.

• Where the audio flows matters most. A single millisecond of speech-to-text routed outside an HDS-certified region can trigger an immediate CNIL-driven shutdown.

• Scribing.io European Sovereignty tier runs ingestion, ASR, and inference solely on HDS Activity 5/6-certified infrastructure in France, with customer-managed keys in an ANSSI-qualified HSM and an audit-ready subprocessor map (each partner's HDS certificate ID).

• For Clinical Operations Directors: the deliverable that clears a CNIL audit is a bundle—DPIA pack, data-flow diagram, and subprocessor HDS certificate IDs—not a marketing "compliance" badge.

• HDS Activities 5 & 6: The AI Scribing Standard

• Scribing.io Clinical Logic: A CNIL Spot-Check Shutdown

• Technical Reference: ICD-10 Documentation Standards

• Audit-Readiness Bundle: Operations Director Checklist

• Deployment Roadmap: European Sovereignty Tier

HDS Activities 5 & 6: The AI Scribing Standard Competitors Quietly Skip

CLINICAL UPDATE 2026: Revised for new CMS CPT G2211 standards, SB 1120 compliance, and FHIR interoperability.

Most AI scribe vendors marketing in France cite "HDS hosting" as a checkbox. What a Clinical Operations Director discovers during an actual CNIL audit is that the HDS framework contains six distinct activities, and the ones that govern an AI scribe are not the ones most vendors certify. Scribing.io was architected against this exact gap.

Pricing pages from most competitors reference "custom hosting terms" as an enterprise upsell while remaining silent on which HDS activities their processing stack actually holds. That silence is the information gap. Review Scribing.io Pricing & Plans to see the transparent alternative.

An IaaS provider certified for Activities 1–3 (physical infrastructure, virtualized infrastructure, platform hosting) does not automatically cover the SaaS layer that ingests patient audio, performs automatic speech recognition (ASR), and runs LLM inference.

The Original Insight that governs 2026 CNIL expectations:

CNIL audits for AI scribing in France expect HDS certification that explicitly covers Activities 5 & 6 (health data hosting and data management/administration) for all SaaS audio/LLM processing—not just IaaS Activities 1–3.

Scribing.io's European Sovereignty tier is built on the anchor truth that all patient audio processing and storage occur within HDS-compliant data centers. Ingestion, ASR, and inference run solely on HDS Activity 5/6-certified infrastructure.

Customer-managed keys are held in an ANSSI-qualified HSM, alongside an audit-ready subprocessor map listing each partner's HDS certificate ID. This is the artifact set a CNIL auditor asks for—and the one most competitor pricing pages never mention.

To map this to your own environment, review our EHR Integration Library and the full Clinical Specialties Directory.

Clinical Logic: A CNIL Shutdown at a Paris Cardiology Group

This is the scenario every Clinical Operations Director evaluating an AI scribe in France should stress-test against before signing a contract.

The Failure Pattern

A Paris cardiology group piloted a U.S.-built scribe. During a CNIL spot check, the group's DPO discovered that the audio stream was briefly routed to a non-HDS EU region for speech-to-text.

That single data-flow deviation triggered an immediate shutdown. The clinical operations fallout unfolded over three days.

The Scribing.io Logic Path

Under the European Sovereignty tier, the same encounters follow a different logic chain—one where non-HDS routing is architecturally impossible.

The outcome under Scribing.io: our DPIA pack, data-flow diagram, and subprocessor HDS certificate IDs cleared the audit and prevented any service interruption.

The structured template ensured complete problem list and medication reconciliation capture for both hypertension and diabetes follow-ups. For the governing legal framework, consult the AI Scribe Laws reference.

Quantify the avoided €11,700 in denials plus continuity value for your own volume with the AI Medical Scribe ROI Calculator.

Technical Reference: ICD-10 Documentation Standards

The two most common follow-up diagnoses in the cardiology pilot above—and in most French primary and specialty care panels—are essential hypertension and uncomplicated Type 2 diabetes.

Correct ICD-10-CM coding paired with documented medication reconciliation is what protects the encounter from the denial pattern described earlier.

Medication reconciliation is the pivot. The 40 denied encounters in the Paris pilot failed not on coding, but on missing med rec—the exact field a manual fallback note tends to drop.

Ambient Clinical Intelligence closes this by structuring the med rec field as a required capture in every hypertension and diabetes follow-up template.

Audit-Readiness Bundle: The Operations Director Checklist

A CNIL auditor does not accept a marketing badge. They request a specific bundle of artifacts, and a missing item can halt a pilot mid-audit.

1. DPIA pack scoped to the audio ingestion, ASR, and inference pipeline—not a generic template borrowed from another product.

2. Data-flow diagram showing every hop from microphone to stored note, with each region explicitly labeled as HDS-certified.

3. Subprocessor map listing each partner's HDS certificate ID, so no processing link is left unverified.

4. ANSSI-qualified HSM configuration confirming customer-managed encryption keys never leave French jurisdiction.

5. Retention and deletion policy aligned to Activity 5 hosting obligations and French health-data law.

Rule of thumb for buyers: if a vendor cannot produce all five artifacts before contract signature, assume the audit will fail.

Deployment Roadmap: European Sovereignty Tier

The following sequence takes a French clinical group from evaluation to a fully audit-ready Medical AI Scribing deployment.

Configure the connection layer using the EHR Integration Library, then select the correct template set from the Clinical Specialties Directory.

Confirm your tier and pricing against expected volume via Scribing.io Pricing & Plans before provisioning HSM keys.

The measurable result of this roadmap: audio and inference stay within an HDS Activity 5/6-certified data center in France, protected by customer-managed ANSSI-HSM keys, with zero service interruption during a CNIL spot check.