Healthcare organizations are accelerating AI adoption while confronting a widening patchwork of privacy, security, and AI governance rules across jurisdictions. Participants in a Tuesday (Sept. 8) webinar hosted by the Atlantic Council's Cyber Statecraft Initiative warned that conflicting requirements governing data use, infrastructure, and cross-border transfers could slow clinical trials, pharmaceutical research, and the development of patient-care tools, according to an account by the International Association of Privacy Professionals.
The strain is especially sharp in healthcare because AI systems typically need large volumes of sensitive and diverse patient data. Restricting access to that information can weaken model quality, but processing it exposes organizations to overlapping regulatory obligations and serious consequences when safeguards fail.
"When we develop an AI model, the goal is to drive a benefit for a population," said Ranjit Kumble, VP of enterprise data science and advanced analytics at Pfizer. "If a model is deployed without the right safeguards, the benefit to the population is much, much more uneven."
Divergent rules across the U.S., EU, and China
AI is helping pharmaceutical researchers identify biological targets during early-stage drug development, Kumble said. But companies operating internationally must reconcile different approaches in China, the European Union, and the U.S., along with conflicts among sector-specific and state laws within the U.S.
In Europe, healthcare developers may need to satisfy both the EU General Data Protection Regulation (GDPR) and the EU AI Act, including its requirements for certain high-risk systems. In the U.S., organizations face a more fragmented framework spanning health privacy rules, state consumer privacy statutes, and AI laws that may emphasize disclosures or chatbot transparency rather than the risk-management obligations found in Europe.
This fragmentation creates a practical scalability problem. Kumble said organizations often prepare datasets separately for individual AI projects to ensure the information is "AI ready." Repeating that work as use cases multiply becomes unsustainable. For healthcare professionals working with these systems, AI for Healthcare Courses & Certifications can help build the governance and compliance knowledge required to manage these obligations.
Data access shapes model quality and competitiveness
The burden does not fall only on compliance teams. Different restrictions on sensitive-data processing can determine whether researchers obtain data of sufficient breadth, depth, and quality to train reliable systems. That affects product performance, patient confidence, and a company's ability to compete in an increasingly precise and data-intensive healthcare market.
Daria Bahrami, head of policy at AI cybersecurity company Dreadnode, said faster AI-driven results are forcing companies to make real-time decisions about their tolerance for risks that previously remained in the background. Flexibility should not displace baseline controls, she said. Organizations should assess data processing, retention, and other governance requirements before deploying a tool.
Agentic AI raises the stakes
That assessment is becoming more urgent as healthcare companies experiment with agentic AI systems capable of taking actions with limited human involvement. The risks include agents exceeding their intended permissions or escaping controlled testing environments.
Stephen Moon, Snowflake's global public sector chief technology officer, said organizations must limit agents at both the governance and data-security levels. An agent's potential reach depends heavily on the systems and information it is permitted to access.
For healthcare providers and technology vendors, access controls, data segmentation, and continuous monitoring are patient-safety issues as well as cybersecurity obligations. A compromised AI agent with access to medical records, diagnoses, or prescription systems could cause substantially greater harm than a conventional data leak. Pharmaceutical teams working with these tools may benefit from an AI Learning Path for Pharmaceutical Sales Representatives that addresses AI use in regulated clinical and commercial contexts.
Why this matters for healthcare professionals
Healthcare organizations cannot wait for regulators to harmonize their rules. They need inventories of AI uses and applicable laws, documented pre-deployment reviews, strict limits on agent permissions, and governance structures that accommodate jurisdiction-specific requirements without rebuilding compliance programs for every project.
They also need incident-communications plans grounded in verified facts. Kumble warned that disproportionate or poorly informed coverage of an AI incident can generate panic, making an already difficult event harder to contain. For clinical, data, and compliance teams, the practical next step is to map every AI use case against the specific jurisdictions where patient data originates and where the model will operate - before deployment, not after an incident.
Your membership also unlocks:
