Summary
Medical trials utilizing AI navigate complex EU regulations, including GDPR, EHDS, and the EU AI Act, which create legal uncertainties for sponsors and developers. Ensuring compliance requires robust data governance, including clear liability and anonymisation strategies, to mitigate risks associated with data subject objections and overlapping frameworks.
What legal frameworks apply when AI is used in medical trials?
Four EU legislative instruments simultaneously govern AI-assisted medical trials, and no single framework takes unconditional precedence. Sponsors and AI developers must satisfy all four in parallel, which creates overlapping obligations that are not yet fully reconciled at the regulatory level.
The frameworks are:
- GDPR (Regulation 2016/679): The foundational data protection law that applies to any processing of personal health data, which constitutes special-category data under Article 9. Processing is lawful only if a specific condition under Article 9(2) is met, most commonly explicit consent (Article 9(2)(a)) or processing necessary for scientific research purposes (Article 9(2)(j)), combined with appropriate safeguards under Article 89.
- Data Governance Act (Regulation 2022/868): The DGA establishes a framework for data intermediaries and governs voluntary data sharing between organisations. It creates mechanisms through which health datasets held by public bodies may be made available for reuse, including for AI training in medical contexts.
- European Health Data Space (EHDS, Regulation 2025/327): The EHDS is a dedicated EU framework for the primary and secondary use of electronic health data. It explicitly permits secondary use of health data to train, test and validate AI algorithms for medical research, subject to conditions including data access applications to designated health data access bodies. Patients retain a right to object to certain secondary uses, and the EHDS preserves GDPR rights rather than replacing them.
- EU AI Act (Regulation 2024/1689): The EU AI Act classifies AI systems used for medical diagnosis and treatment decisions as high-risk AI systems under Annex III. High-risk systems must comply with transparency, accuracy, robustness and human oversight requirements, and must be registered in the EU database before placement on the market or deployment in a clinical setting.
The SANT study flags that these four instruments were developed on parallel legislative tracks. Their interaction on secondary health data use for AI development is incompletely harmonised, leaving healthcare providers and sponsors to navigate genuinely unresolved questions about which rules govern which processing operations.
How does secondary use of health data for AI development work under the EHDS?
Secondary use under the EHDS means using health data originally collected for patient care or a primary medical trial for a different purpose, such as training an AI diagnostic model. The EHDS permits this under a controlled regime, but sponsors must understand its precise scope and limitations.
Under Articles 33 to 40 of the EHDS, entities wishing to access health data for secondary purposes must submit an application to a national health data access body. Access is granted only where the purpose falls within one of the permitted categories listed in Article 34, which includes developing and training AI systems intended to contribute to public health or healthcare delivery. Access is typically granted under a data permit, which imposes use limitations, security requirements and data minimisation conditions.
The EHDS also provides that natural persons whose data are held in EHDS-governed datasets retain a right to object to secondary uses in certain circumstances, mirroring the GDPR right under Article 21. The SANT study argues that the operationalisation of this right alongside the EHDS secondary-use regime needs clarification, because it is not yet clear under what procedural conditions an objection will override a lawfully issued data permit.
For sponsors of medical trials integrating AI, this creates a practical risk: a dataset assembled for AI training may be challenged by data subjects asserting objection rights even where an EHDS access permit is in place. Building a documented response to this scenario into the trial's data protection impact assessment (DPIA) is strongly advisable before commencing any secondary-use AI project.
Focus: the example of France
In France, secondary use of health data for medical research, including AI model development, is regulated through the Health Data Hub (Plateforme des données de santé) and the CNIL's Méthodologie de Référence MR-001 (updated periodically). MR-001 provides a simplified compliance pathway for sponsors conducting research involving the processing of personal health data where processing meets the conditions described in the methodology. Where AI training falls outside MR-001's scope, sponsors must obtain a specific CNIL authorisation under Article 66 of the French Data Protection Act (Loi Informatique et Libertés, as amended). The EHDS secondary-use regime will progressively overlay these national frameworks once the regulation becomes fully applicable.
Focus: the example of Belgium
Belgium hosts the UCLouvain, whose researcher authored the SANT study. At the national level, secondary use of health data is governed by the Belgian eHealth platform and overseen by the Information Security Committee (Comité de sécurité de l'information). Belgian law implements a sectoral authorisation system that predates the EHDS. Sponsors operating medical trials in Belgium that wish to reuse health data for AI purposes must currently navigate both the Belgian sectoral framework and incoming EHDS requirements, a dual-layer obligation that illustrates precisely the fragmentation the SANT study criticises.
Focus: the example of Germany
Germany has implemented a research data centre for health (Forschungsdatenzentrum Gesundheit, FDZ) under the Digital Healthcare Act (Digitale-Versorgung-Gesetz). The FDZ holds statutory health insurance data and has progressively expanded access for AI research. German sponsors must additionally comply with state-level (Länder) hospital data laws, which vary between the 16 federal states. This creates a further layer of complexity that the EHDS aims to partially harmonise, but which will persist during the transitional period.
What is the liability position when AI contributes to a medical error in a trial?
Liability for AI-assisted errors in medical trials remains legally unresolved at the EU level. The SANT study identifies this as one of its central concerns, noting that existing liability frameworks were not designed for scenarios where an AI system contributes to a clinical decision that results in patient harm.
The core difficulty is allocation: if a high-risk AI system operating under the EU AI Act produces an erroneous diagnostic output that a clinician relies upon, and that reliance contributes to a trial participant receiving incorrect treatment, it is unclear whether liability rests with the AI developer, the deploying sponsor, the investigator or all three in varying proportions.
Current EU instruments that bear on this question include:
For sponsors of medical trials, the practical implication is that the human oversight requirement under Article 14 of the EU AI Act must be genuinely implemented, not merely documented. Investigators must be trained to critically evaluate AI outputs rather than defer to them automatically. Where a trial protocol assigns a diagnostic or risk-stratification role to an AI system, the protocol should specify the human review step, document who reviews AI outputs and retain records of that review in the trial master file (TMF).
Focus: the example of the United Kingdom
The UK has left the EU regulatory framework and applies its own UK GDPR (incorporated by the Data Protection Act 2018) alongside MHRA guidance on AI as a medical device. The UK does not yet have an AI Act equivalent, though the AI Safety Institute and sector-specific regulators including the MHRA and the ICO (Information Commissioner's Office) have published joint guidance on AI governance in healthcare. UK sponsors of medical trials must therefore assess liability under UK tort law and the UK product liability framework separately from any EU-facing obligations.
Focus: the example of the European Medicines Agency (EMA)
The EMA has published reflection papers on the use of AI in regulatory submissions, including guidance on validation requirements for AI-derived endpoints. Where an AI system is used to support a primary or secondary endpoint in a pivotal medical trial, the EMA expects evidence of model performance, robustness testing and documentation of human oversight throughout the study. These expectations interact with EU AI Act high-risk system requirements and must be planned for during protocol development rather than addressed retroactively at submission.
How should sponsors build a defensible AI compliance framework for medical trials?
Sponsors should treat GDPR, EHDS, DGA and EU AI Act obligations as a single integrated compliance workstream rather than four separate checklists. The following architecture reflects current best practice pending clearer EU guidance.
Step 1: Establish the legal basis before data collection begins. Under Article 9(2) GDPR, identify whether scientific research (Article 9(2)(j) combined with Article 89 safeguards) or another ground applies to each processing operation, including initial data collection, AI model training and any secondary use. Document the analysis in the DPIA.
Step 2: Conduct a DPIA for every AI-assisted processing operation. Under Article 35 GDPR, processing of special-category data at scale using automated systems is likely to require a DPIA. For AI-assisted medical trials, the DPIA must assess risks arising from the AI system itself, including accuracy limitations, bias in training datasets and the consequences of erroneous outputs for trial participants.
Step 3: Apply the anonymisation standard consistently. The SANT study calls for clearer anonymisation standards for AI training data. In the absence of final EHDS implementing acts, sponsors should apply the Article 29 Working Party's Opinion 05/2014 on anonymisation techniques (now endorsed by the European Data Protection Board) and document why the standard applied is sufficient for the specific dataset and AI use case.
Step 4: Allocate liability contractually. Contracts between sponsors, CROs and AI tool providers should clearly specify which party is the data controller, which is a data processor under Article 28 GDPR, and who bears responsibility for AI system performance. Where a CRO deploys an AI tool on behalf of a sponsor, the Article 28 data processing agreement must cover the AI system's scope of use, the human oversight measures required and the incident-response procedure if an AI output causes or contributes to patient harm.
Step 5: Register high-risk AI systems before deployment. Under Article 49 of the EU AI Act, high-risk AI systems must be registered in the EU AI database before being placed on the market or put into service. Sponsors deploying a high-risk AI system within a medical trial must verify that the system is registered and that its intended purpose matches the trial use case.
Step 6: Document human oversight in the trial master file. The TMF should contain records of investigator training on AI tool limitations, documentation of the human review step for each AI-generated output used in clinical decision-making, and any deviations where an investigator overrode an AI recommendation and the reasoning recorded.
Conclusion
The SANT study published in October 2026 is not a binding instrument, but it reflects the considered position of the European Parliament's own researchers that the legal framework governing AI use in medical trials is unsettled. Sponsors who wait for definitive regulatory clarity before building their compliance architecture risk being exposed when enforcement accelerates or when the EHDS implementing acts begin to impose direct obligations.
The intersection of GDPR Article 9, the EHDS secondary-use regime, the DGA's data-sharing mechanisms and the EU AI Act's high-risk system requirements demands a proactive and documented compliance approach. Liability allocation, anonymisation standards and the operationalisation of patient objection rights are the three areas most likely to attract supervisory scrutiny in the near term.
Iliomad advises sponsors, CROs and AI developers on data protection compliance for clinical trials and AI-assisted healthcare tools. Contact our team to discuss how to structure your GDPR, EHDS and EU AI Act compliance framework before your next study begins.
Speak to an iliomad specialist about clinical trial data protection
FAQs
Our frequently questions
The European Medicines Agency (EMA) has published reflection papers on the use of AI in regulatory submissions, including guidance on validation requirements for AI-derived endpoints. Where an AI system is used to support a primary or secondary endpoint in a pivotal medical trial, the EMA expects evidence of model performance, robustness testing, and documentation of human oversight throughout the study. These expectations interact directly with EU AI Act high-risk system requirements and must be planned for during protocol development rather than addressed retroactively at the time of submission. Sponsors should ensure that AI validation documentation is integrated into their trial planning from the outset to meet both EMA and EU AI Act standards.
Sponsors should treat GDPR, EHDS, DGA, and EU AI Act obligations as a single integrated compliance workstream rather than four separate checklists. Best practice involves six key steps: (1) Establish the legal basis before data collection begins; (2) Conduct a DPIA for every AI-assisted processing operation; (3) Apply the anonymisation standard consistently; (4) Allocate liability contractually between all relevant parties; (5) Register high-risk AI systems before deployment; and (6) Document human oversight in the Trial Master File. Sponsors who wait for definitive regulatory clarity before building their compliance architecture risk being exposed when enforcement accelerates or when the EHDS implementing acts begin to impose direct obligations.
National frameworks vary significantly across EU Member States and currently layer on top of incoming EHDS requirements, creating dual-layer compliance obligations. In France, secondary use of health data is regulated through the Health Data Hub and CNIL's Méthodologie de Référence MR-001; where AI training falls outside MR-001's scope, sponsors must obtain specific CNIL authorisation. In Belgium, a sectoral authorisation system overseen by the Information Security Committee predates the EHDS, meaning sponsors must navigate both frameworks simultaneously. In Germany, sponsors must comply with the federal Forschungsdatenzentrum Gesundheit (FDZ) framework as well as varying state-level (Länder) hospital data laws across 16 federal states. The EHDS aims to partially harmonise these national frameworks, but fragmentation will persist during the transitional period.
Liability for AI-assisted errors in medical trials remains legally unresolved at the EU level. The core difficulty is allocation: if a high-risk AI system produces an erroneous diagnostic output that a clinician relies upon, leading to incorrect treatment of a trial participant, it is unclear whether liability rests with the AI developer, the deploying sponsor, the investigator, or all three in varying proportions. For sponsors, the practical implication is that the human oversight requirement under Article 14 of the EU AI Act must be genuinely implemented, not merely documented. Investigators must be trained to critically evaluate AI outputs, and where a trial protocol assigns a diagnostic or risk-stratification role to an AI system, the protocol should specify the human review step, document who reviews AI outputs, and retain records of that review in the Trial Master File (TMF).
Secondary use under the EHDS means using health data originally collected for patient care or a primary medical trial for a different purpose, such as training an AI diagnostic model. Under Articles 33 to 40 of the EHDS, entities wishing to access health data for secondary purposes must apply to a national health data access body. Access is granted only where the purpose falls within permitted categories listed in Article 34 — including developing AI systems intended to contribute to public health — and is typically subject to a data permit imposing use limitations, security requirements, and data minimisation conditions. Importantly, data subjects retain a right to object to secondary uses in certain circumstances, and it remains unclear under what procedural conditions an objection will override a lawfully issued data permit. Sponsors are strongly advised to address this risk in their Data Protection Impact Assessment (DPIA) before commencing any secondary-use AI project.
Four EU legislative instruments simultaneously govern AI-assisted medical trials, and no single framework takes unconditional precedence. Sponsors and AI developers must satisfy all four in parallel: the GDPR (Regulation 2016/679), the Data Governance Act (Regulation 2022/868), the European Health Data Space (EHDS, Regulation 2025/327), and the EU AI Act (Regulation 2024/1689). These four instruments were developed on parallel legislative tracks, and their interaction on secondary health data use for AI development is incompletely harmonised, leaving healthcare providers and sponsors to navigate genuinely unresolved questions about which rules govern which processing operations.
Each EU member state currently operates its own national health data governance framework alongside the incoming EHDS requirements, creating a dual-layer compliance obligation during the transitional period. In France, secondary use of health data for AI development is regulated through the Health Data Hub and CNIL's Méthodologie de Référence MR-001; where AI training falls outside MR-001's scope, sponsors must obtain specific CNIL authorisation. In Belgium, secondary use is governed by the eHealth platform and the Information Security Committee under a sectoral authorisation system that predates the EHDS. In Germany, the research data centre FDZ holds statutory health insurance data for AI research, but sponsors must also comply with varying state-level (Länder) hospital data laws across 16 federal states. The EHDS will progressively overlay these national frameworks, but sponsors must currently navigate both layers simultaneously.
Sponsors should integrate GDPR, EHDS, DGA and EU AI Act obligations into a single compliance workstream. The six key steps are: (1) Establish the legal basis under Article 9(2) GDPR before data collection begins and document it in the DPIA; (2) Conduct a DPIA for every AI-assisted processing operation, including risks from accuracy limitations, training dataset bias and erroneous outputs; (3) Apply a consistent and documented anonymisation standard, currently guided by the EDPB-endorsed Article 29 Working Party Opinion 05/2014; (4) Allocate liability contractually between sponsors, CROs and AI tool providers, specifying controller/processor roles and incident-response procedures; (5) Register all high-risk AI systems in the EU AI database before deployment, as required by EU AI Act Article 49; and (6) Document human oversight throughout the trial master file, including investigator training records and logs of AI output reviews and overrides.
Liability for AI-assisted errors in medical trials remains legally unresolved at the EU level. When a high-risk AI system produces an erroneous diagnostic output that a clinician relies upon, causing a trial participant to receive incorrect treatment, it is currently unclear whether liability rests with the AI developer, the deploying sponsor, the investigator, or a combination of all three. The EU AI Act imposes conformity and human oversight duties but does not create a direct civil liability regime. The revised Product Liability Directive (2024/2853) extends liability to AI outputs, and GDPR Article 82 covers data-related harm. To manage this risk, sponsors must genuinely implement the human oversight requirements of EU AI Act Article 14, train investigators to critically evaluate AI outputs, specify human review steps in trial protocols, and document all AI-generated outputs reviewed in the trial master file (TMF).
Under Article 9(2) of the GDPR, processing of special-category health data is only lawful if a specific condition is met. In the context of AI-assisted medical trials, the two most commonly applicable grounds are explicit consent (Article 9(2)(a)) and processing necessary for scientific research purposes (Article 9(2)(j)), the latter requiring appropriate safeguards under Article 89. Sponsors must identify and document the applicable legal basis for each distinct processing operation — including initial data collection, AI model training, and any secondary use of data — before data collection begins, and this analysis must be recorded in the DPIA. Waiting until after data collection to establish the legal basis is a significant compliance risk.
Under Articles 33 to 40 of the EHDS, entities wishing to use health data originally collected for patient care or a primary medical trial for a secondary purpose — such as training an AI diagnostic model — must submit an application to a national health data access body. Access is granted only where the purpose falls within permitted categories listed in Article 34, including developing and training AI systems intended to contribute to public health. A data permit is issued with use limitations, security requirements and data minimisation conditions. Importantly, data subjects retain a right to object to certain secondary uses, and it remains legally unclear whether such an objection can override a lawfully issued data permit. Sponsors should address this risk explicitly in their Data Protection Impact Assessment (DPIA) before starting any secondary-use AI project.
Four EU legislative instruments simultaneously govern AI-assisted medical trials: the GDPR (Regulation 2016/679), which applies to any processing of personal health data as special-category data; the Data Governance Act (Regulation 2022/868), which governs voluntary data sharing and reuse of datasets held by public bodies; the European Health Data Space (EHDS, Regulation 2025/327), which permits secondary use of health data to train and validate AI algorithms for medical research; and the EU AI Act (Regulation 2024/1689), which classifies AI systems used for medical diagnosis and treatment as high-risk and imposes transparency, accuracy, robustness and human oversight requirements. No single framework takes unconditional precedence — sponsors must satisfy all four in parallel.
Find out how iliomad can help your company.
Only visible in production
AI passports and EHDS: what the CHAIN network means for health AI governance
The EU CHAIN network introduces AI Passports and federated health data models. Learn what this means for GDPR compliance, high-risk AI obligations and clinical sites.
Healthcare Data Breaches, AI Transparency and Clinical Research Standards: Weekly Digest
This week: Danish CPR breach, IQVIA Garante fine, OpenAI EU watermarking, Epic MyChart flaws, NIH funding decline and cancer trial QoL standards.
Vendor clinical trials: audit trails, logging gaps and sub-processor obligations
Understand vendor GDPR obligations in clinical trials, including audit-trail requirements, sub-processor controls and breach notification under Articles 28, 33 and 34.
