AI Laws, Regulations, and Standards

Healthcare AI systems used for treatment decisions fall under Annex III of the EU AI Act as high-risk systems. High-risk systems require mandatory conformity assessment (either internal control or third-party notified body assessment), CE marking, registration in the EU database, human oversight mechanisms, and ongoing post-market monitoring—obligations not required for lower-risk categories.

Concept drift monitoring requires continuous evidence of model performance tracking over time. NIST AI RMF's 'Manage' function requires ongoing monitoring and GDPR Article 22 requirements for automated decision-making demand accuracy maintenance. Retraining schedules, drift detection, and version control demonstrate systematic approaches to maintaining model validity as data distributions change—a critical technical and compliance requirement.

EU AI Act Article 5 prohibits real-time remote biometric identification in publicly accessible spaces for law enforcement (with narrow exceptions), creating hard deployment barriers. The US Algorithmic Accountability Act (proposed/enacted in some jurisdictions) requires impact assessments for high-risk systems. This combination creates both prohibition risks and mandatory disclosure requirements—the most restrictive scenario presented.

EU AI Act explicitly lists recruitment and worker management as high-risk (Annex III), triggering mandatory conformity assessment. Canada's AIDA takes a harm-based approach, requiring impact assessments when systems could cause 'material harm'—focusing on outcomes rather than sectoral categorization. This fundamental difference in risk classification methodology is the key compliance distinction organizations must navigate.

Under disparate impact legal theory applicable to both US and EU anti-discrimination law, statistical proof of discrimination shifts burden to the organization to show business necessity AND that no less discriminatory alternative exists. Comprehensive documentation of testing, mitigation efforts, exclusion of protected variables, and alternative exploration demonstrates due diligence and good faith compliance—the strongest legal defense position.

GDPR Article 15(1)(h) and Recital 71 require 'meaningful information about the logic involved' in automated decisions—but this does not mean full algorithmic disclosure. Case law and regulatory guidance establish that patient-specific explanations (feature importance, confidence, model type, validation) satisfy transparency while protecting IP. This balances individual rights with commercial interests, which is the legally correct approach.