WHO Sets Out Six Core Requirements for Regulating AI in Healthcare
The World Health Organization has outlined regulatory expectations for artificial intelligence systems used in medical settings, covering everything from data quality to clinical validation. The guidance addresses developers, regulators, manufacturers and healthcare practitioners deploying AI tools.
The WHO and International Telecommunication Union established a working group on regulatory considerations for AI in health in 2023. The group brought together regulators, policymakers, academics and industry representatives to identify common ground on how AI systems should be developed and validated before reaching patients.
Documentation and Transparency
Developers must document their intended medical purpose and the full development process before releasing an AI system. This includes recording which datasets were selected, what reference standards were used, which parameters were tested and any deviations from the original plan.
The level of documentation required should match the system's risk profile. A high-risk diagnostic tool demands more detailed records than a lower-risk administrative application.
Risk Management Across the Product Lifecycle
AI systems require oversight at every stage: before they reach the market, after deployment and whenever changes are made. Organizations must identify and address specific risks tied to AI, including cybersecurity threats, algorithmic bias and underfitting-where a model performs poorly because it's too simple.
Validation Beyond Training Data
An AI system must perform well on data it has never seen before. Developers should test their models on independent datasets that represent the actual population and setting where the tool will be used.
Clinical validation requirements depend on risk level. Randomized controlled trials remain the gold standard for high-risk tools. For lower-risk applications, prospective real-world testing may suffice. All AI systems should undergo post-deployment monitoring to catch problems once they're in use.
Data Quality Standards
Before release, developers must verify that their training data is sufficient and accurate. They should test for biases, errors and other quality issues that could harm patients if left undetected.
Healthcare organizations should work together to build data ecosystems that make high-quality data sources available for AI development.
Privacy and Data Protection
Privacy safeguards must be built into AI systems from the design phase onward. Developers should understand applicable data protection laws in their jurisdictions and ensure their systems meet or exceed those requirements.
A compliance program should address cybersecurity risks and potential harms from data breaches.
Stakeholder Engagement
Regulators and developers should create platforms where healthcare professionals, patients, manufacturers and oversight bodies can communicate openly. This collaboration accelerates the approval process and builds confidence in new tools.
Ongoing Harmonization Needed
The WHO acknowledges that AI technology is evolving faster than regulatory frameworks. It recommends that international bodies like the International Medical Device Regulators Forum and the International Coalition of Medicines Regulatory Authorities continue working toward consistent standards across countries.
Healthcare organizations deploying AI should familiarize themselves with these considerations. Learn more about AI for Healthcare and AI Research Courses to understand how validation and data quality standards apply in practice.
Your membership also unlocks:
