By sector · Healthcare and life sciences
Healthcare AI sits under two regimes at once: medical-device and safety law for the product, and AI and data-protection law for the decision. A diagnostic or triage system is usually high-risk under AI law and a regulated device under health law, so its technical file, clinical evaluation and post-market surveillance have to satisfy both.
The documentation duties overlap heavily. The controls below are counted by the duties they serve so that the technical documentation and post-market monitoring work can be planned once and cited twice.
Training data provenance, representativeness across patient groups and lawful basis for health data are where healthcare AI programmes stall. The dataset documentation and privacy controls carry those duties.
Sorted by how many of the duties on this page each control satisfies, so the ones worth building first are at the top. A control page lists every other duty it serves, in every jurisdiction.
| Control | Satisfies | Supports | Owner · frequency |
|---|---|---|---|
| AI interaction and use disclosure notices Process | 5 | 0 | Product owner · at launch and on material change |
| AI risk assessment and lifecycle risk register Process | 3 | 1 | AI system owner · once per ai system |
| AI governance policy and accountability structure Policy | 2 | 1 | Executive sponsor for AI · annual |
| Technical documentation, model cards and instructions for use Process | 2 | 1 | Product or model owner · at launch and on material change |
| AI impact and fundamental-rights impact assessment Process | 2 | 0 | AI system owner · once per ai system |
| AI incident management and regulatory reporting Process | 2 | 0 | Incident coordinator · continuous |
| Decision explanation, human review and appeal route Process | 2 | 0 | Customer operations lead · once per ai system |
| Human oversight design and override procedure Process | 1 | 0 | AI system owner · once per ai system |
| AI system inventory and classification Process | 0 | 3 | AI governance lead · continuous |
| Post-deployment monitoring and drift detection Technical measure | 0 | 2 | AI system owner · continuous |
| Privacy and data-protection controls for AI Process | 0 | 1 | Data protection officer · once per ai system |
| Prohibited and unacceptable-use screening gate Process | 0 | 1 | AI governance lead · once per ai system |
| Training-data provenance and copyright register Process | 0 | 1 | Model development lead · at launch and on material change |
| Accuracy, robustness, fairness and security testing Technical measure | 0 | 1 | Quality or testing lead · at launch and on material change |
Every published duty whose record names this audience. It is the recorded set, not every rule in the world; a jurisdiction missing here may simply not be mapped yet (open gaps).
Informational only, not legal advice. Verify every claim against the linked official sources and consult qualified counsel before acting.
