AI passports and EHDS: what the CHAIN network means for health AI governance

Summary: The European Cardiovascular Health Data and AI Network (CHAIN), funded through the EU4Health Programme and coordinated by the European Society of Cardiology, is building a federated ecosystem to validate artificial intelligence tools in cardiovascular care across 20 countries. CHAIN's "AI Passport" documentation model, its explicit alignment with the European Health Data Space (EHDS) and the EU AI Act, and its reliance on secondary use of health data make it a concrete regulatory reference point for sponsors, clinical research organisations and investigator site GDPR compliance teams operating in life sciences.

What is the CHAIN network and why does it matter for regulatory compliance?

CHAIN (European Cardiovascular Health Data and AI Network) is a 36-month, EU4Health-funded initiative coordinated by the European Society of Cardiology (ESC) that connects 53 partners across 20 European countries to test, validate and deploy artificial intelligence tools at scale in cardiovascular care. For life sciences organisations, CHAIN matters because it operationalises, for the first time in a large funded programme, the intersection of the EU AI Act (Regulation (EU) 2024/1689), the European Health Data Space (EHDS, Regulation (EU) 2025/327) and GDPR-governed secondary use of clinical health data.

Cardiovascular diseases (CVDs) remain the leading cause of mortality in Europe, and the ESC estimates their economic cost to the EU at approximately €282 billion annually, a figure that exceeds the EU's total annual budget. CHAIN is designed to translate AI's potential in prevention, early detection and clinical decision support into validated, deployable tools rather than fragmented proofs of concept. The governance mechanisms it establishes, particularly the AI Passport model, are likely to influence how regulators and procuring health institutions expect AI tools to be documented going forward.

For clinical teams, CROs and investigator sites already navigating investigator site GDPR obligations, CHAIN represents an emerging reference architecture rather than an immediately binding requirement. Nevertheless, organisations that understand its structure now will be better positioned when clients or partners request alignment with its standards.

The AI passport framework: a model for conformity documentation under the EU AI Act

AI Passports are structured documents that record an AI tool's performance characteristics, safety profile and clinical suitability as validated within the CHAIN federated ecosystem. They are not yet a legally mandated instrument, but they closely mirror the technical documentation requirements set out in Annex IV of the EU AI Act for high-risk AI systems.

Under the EU AI Act, Article 6 and Annex III classify AI systems intended to support clinical diagnosis or patient management as high-risk AI systems. High-risk AI systems must meet requirements including data governance (Article 10), technical documentation (Article 11), transparency (Article 13), human oversight (Article 14) and accuracy and robustness (Article 15). The AI Passport model that CHAIN is piloting maps directly onto several of these obligations.

For life sciences organisations developing or procuring AI-assisted diagnostic or decision-support tools, the AI Passport offers a practical template. It also aligns with the ESC's AI Gateway framework, which is chaired by CHAIN's scientific coordinator, Professor Folkert Asselbergs of Amsterdam University Medical Centre. Organisations that begin structuring their own AI documentation according to similar principles, covering training data provenance, validation methodology, performance metrics and known limitations, will find the transition to formal EU AI Act conformity assessments considerably less burdensome.

Focus: the European Society of Cardiology as coordinating authority

The ESC acts as the coordinating body for CHAIN and brings with it the EuroHeart registry network, which already standardises cardiovascular outcome data across 18 member countries. This existing infrastructure means that CHAIN is not starting from scratch on data harmonisation. Instead, it is layering AI validation workflows and governance standards onto an established, quality-assured dataset. For investigator sites feeding data into EuroHeart-aligned registries, this creates a new compliance consideration: the secondary use of trial-adjacent registry data for AI training or validation must be evaluated against GDPR Article 5(1)(b) (purpose limitation) and, where applicable, EHDS Article 35 (secondary use permit).

How does CHAIN's federated data model interact with GDPR and investigator site obligations?

CHAIN's federated ecosystem connects hospitals, health data hubs and disease registries without centralising raw personal data. In a federated model, algorithms are sent to the data rather than data being sent to the algorithm, which reduces but does not eliminate data protection risk. GDPR (Regulation (EU) 2016/679) applies wherever personal data are processed, including within federated nodes, and investigator site GDPR compliance obligations remain in force at each participating institution.

The key legal questions for investigator sites participating in or adjacent to CHAIN-style networks are:

1. What is the lawful basis for processing personal health data (GDPR Article 9(2)(j), scientific research, is most commonly relied upon, combined with a suitable national derogation under Article 89)?
2. Has a Data Protection Impact Assessment (DPIA) been completed, as required under GDPR Article 35(3)(b) for large-scale processing of special-category health data?
3. Are data subjects informed of secondary uses through a transparent privacy notice, satisfying GDPR Articles 13 and 14?
4. Who is the data controller at each node, and how are controller-to-controller or controller-to-processor relationships documented through appropriate agreements?

The EHDS, which entered into force in March 2025, adds a layer of secondary-use governance. Under EHDS Article 33, health data access bodies (HDABs) in each member state will authorise secondary use of electronic health data. Investigator sites and clinical networks that contribute data to federated AI validation environments will need to determine whether HDAB authorisation is required in addition to, or instead of, existing GDPR research exemptions. These obligations sit alongside, and do not replace, investigator site GDPR compliance duties under the trial's clinical study protocol and the site's own records of processing activities (Article 30).

Focus: France and the CNIL's position on AI and health data

In France, the Commission Nationale de l'Informatique et des Libertés (CNIL), the national data protection authority, has issued specific guidance on AI systems trained on health data. The CNIL requires that processing for AI development built on health data be covered either by a specific authorisation or by a Méthodologie de Référence (MR). For research involving AI training on data collected at investigator sites, MR-001 (the CNIL's reference methodology for health research involving human subjects) provides the most relevant framework. Sites operating under MR-001 must ensure that the scope of their compliance commitment covers downstream AI validation activities if data are shared with networks such as CHAIN.

Focus: the ICO's federated data guidance for AI in health

In the United Kingdom, the Information Commissioner's Office (ICO) has published guidance on privacy-enhancing technologies (PETs), including federated learning, acknowledging that federated architectures reduce but do not eliminate re-identification risk. The ICO expects organisations to conduct a DPIA before deploying federated AI on health data, to assess residual risks from model inversion or membership inference attacks, and to implement technical safeguards such as differential privacy or secure aggregation. UK-based investigator sites contributing to international federated AI networks must also consider whether the transfer of model outputs or aggregated statistics constitutes a restricted transfer under the UK GDPR, triggering the need for transfer impact assessments or reliance on the UK's international data transfer agreement (IDTA).

Focus: the Dutch Data Protection Authority and Amsterdam UMC's role

As CHAIN is scientifically coordinated from Amsterdam University Medical Centre, Dutch data protection law is immediately relevant. The Autoriteit Persoonsgegevens (AP), the Dutch supervisory authority, applies GDPR strictly in the context of health data AI. Amsterdam UMC, as a public research institution, would typically rely on GDPR Article 6(1)(e) (public task) and Article 9(2)(j) (scientific research) as its dual legal basis. The AP has indicated that pseudonymisation alone is insufficient for high-risk health AI processing and that organisational measures, access controls and audit trails are required alongside technical safeguards.

Comparing AI governance instruments relevant to CHAIN

What should clinical organisations do now?

CHAIN is a 36-month programme that launched in October 2026. Its AI Passport model and EHDS alignment will generate practical outputs, including templates, governance frameworks and validated tool repositories, that clinical organisations and their legal teams should monitor. In the interim, several preparatory steps are advisable.

First, clinical sites and sponsors should review their existing GDPR Article 30 records to determine whether their data processing activities descriptions are broad enough to cover participation in federated AI validation environments. If they are not, an update and a supplementary DPIA will be needed before any data are contributed to networks of the CHAIN type.

Second, organisations procuring or developing AI tools for cardiovascular or other clinical applications should begin structuring internal documentation in a manner consistent with the EU AI Act's Annex IV requirements, even if the formal conformity assessment timeline has not yet reached their product category. The AI Passport model offers a useful starting template.

Third, investigator sites operating under MR-001 in France, or under equivalent national frameworks in other member states, should liaise with their data protection officers to confirm that their compliance coverage extends to AI-adjacent secondary uses. The boundary between primary trial data collection and downstream AI training is not always clearly defined in existing consent forms or ethics committee submissions.

Iliomad's GDPR and EU AI Act compliance services for clinical trials and life sciences organisations are designed to address precisely these intersecting obligations, covering DPIAs, investigator site GDPR audits, EU AI Act readiness assessments and ongoing Data Protection Officer support.

Explore iliomad's clinical trials data protection services and request a scoping call.