By sector · Healthcare and life sciences
Healthcare AI sits under two regimes at once: medical-device and safety law for the product, and AI and data-protection law for the decision. A diagnostic or triage system is usually high-risk under AI law and a regulated device under health law, so its technical file, clinical evaluation and post-market surveillance have to satisfy both.
The documentation duties overlap heavily. The controls below are counted by the duties they serve so that the technical documentation and post-market monitoring work can be planned once and cited twice.
Training data provenance, representativeness across patient groups and lawful basis for health data are where healthcare AI programmes stall. The dataset documentation and privacy controls carry those duties.
Sorted by how many of the duties on this page each control satisfies, so the ones worth building first are at the top. A control page lists every other duty it serves, in every jurisdiction.
| Control | Satisfies | Supports | Owner · frequency |
|---|---|---|---|
| AI interaction and use disclosure notices Process | 6 | 0 | Product owner · at launch and on material change |
| AI risk assessment and lifecycle risk register Process | 3 | 1 | AI system owner · once per ai system |
| Technical documentation, model cards and instructions for use Process | 3 | 1 | Product or model owner · at launch and on material change |
| Decision explanation, human review and appeal route Process | 3 | 1 | Customer operations lead · once per ai system |
| AI governance policy and accountability structure Policy | 2 | 1 | Executive sponsor for AI · annual |
| AI impact and fundamental-rights impact assessment Process | 2 | 0 | AI system owner · once per ai system |
| AI incident management and regulatory reporting Process | 2 | 0 | Incident coordinator · continuous |
| Human oversight design and override procedure Process | 2 | 0 | AI system owner · once per ai system |
| Automatic event logging and record retention Technical measure | 1 | 0 | Engineering lead · continuous |
| AI system inventory and classification Process | 0 | 3 | AI governance lead · continuous |
| Post-deployment monitoring and drift detection Technical measure | 0 | 2 | AI system owner · continuous |
| Privacy and data-protection controls for AI Process | 0 | 1 | Data protection officer · once per ai system |
| Prohibited and unacceptable-use screening gate Process | 0 | 1 | AI governance lead · once per ai system |
| Training-data provenance and copyright register Process | 0 | 1 | Model development lead · at launch and on material change |
| Contractual allocation of AI duties across the supply chain Contractual term | 0 | 1 | Legal counsel · once per ai system |
| Accuracy, robustness, fairness and security testing Technical measure | 0 | 1 | Quality or testing lead · at launch and on material change |
Every published duty whose record names this audience. It is the recorded set, not every rule in the world; a jurisdiction missing here may simply not be mapped yet (open gaps).
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.
Under several instruments, systems that inform or take decisions about access to health services or that act as safety components of medical devices are high-risk. Check the annex or schedule the duty page cites.
The technical file, clinical or performance evaluation, risk management file, and post-market surveillance records. Keep one set that references both regimes.
