Healthcare AI 2026

Setting Their Own Speed Limits: Different Jurisdictions , Different Rates of AI Regulation and Oversight

As of last year’s (2025) edition of this guide, the global healthcare artificial intelligence (AI) landscape stood at what we described as an unprecedented inflection point. One year later, the inflection has resolved into something more complicated: divergence. Artificial intelligence is no longer an emerging presence in medicine anywhere in the developed world – it reads images, drafts clinical notes, monitors patients at home, screens claims and accelerates drug discovery on every continent. What remains unsettled, and increasingly contested, is how the law should respond. In 2026, the world’s major jurisdictions are answering that question at conspicuously different speeds and, in some cases, in diverging ways.

The contributions gathered in this guide document that divergence in granular, practical detail. Read together, they also reveal something the headlines obscure: beneath the regulatory turbulence, a handful of shared principles are quietly hardening into a common global grammar for healthcare AI. This introduction surveys both stories – the fragmentation and the convergence – and previews the themes readers will encounter in the chapters that follow.

The great regulatory realignment

The most consequential development of the past year is that the two jurisdictions that once seemed destined to define opposite regulatory poles – the European Union with its comprehensive AI Act, and the United States with its sectoral, agency-led approach – have both moved toward lighter-touch regimes, though for very different reasons.

In Brussels, ambition collided with implementation. The EU AI Act entered into force in 2024 as the world’s first comprehensive horizontal AI statute, classifying AI-based medical devices as high-risk systems subject to demanding conformity obligations. But the harmonised standards, national authorities and assessment infrastructure needed to operationalise those obligations were not ready. In July 2026, the EU’s “Digital Omnibus on AI” entered into force, deferring the high-risk requirements – originally set to apply in August 2026 – to December 2027 for stand-alone systems and to August 2028 for AI embedded in regulated products, including medical devices. A parallel reform proposal for the medical device framework could go further still, leaving the medical device regulations themselves as the primary governing regime for clinical AI. The obligations have not been softened, only postponed; but the postponement is a candid acknowledgment that even the world’s most developed regulatory apparatus is straining to keep pace with the technology it seeks to govern.

In Washington, DC, the shift is philosophical rather than logistical. The current administration has pursued an expressly deregulatory national AI policy, including efforts to pre-empt the growing body of state AI legislation – a confrontation examined closely in the US chapters of this guide. The US Food and Drug Administration, which has now authorised well over a thousand AI-enabled medical devices, is deliberately narrowing its oversight of lower-risk digital health tools while relying more heavily on post-market surveillance.

Meanwhile, other jurisdictions are regulating for the first time. South Korea’s AI Framework Act, effective in January 2026, became the Asia-Pacific region’s first comprehensive AI statute, imposing transparency, impact-assessment, and human-oversight obligations on “high-impact” AI systems in healthcare and requiring labelling of generative AI outputs. China continues its distinctive path of binding, sector-specific rules – algorithm filings, generative AI measures, content labelling – while state policy simultaneously drives some of the world’s most aggressive hospital-level AI deployment. Japan has chosen promotion over penalties. And the United Kingdom is betting on a third way: the MHRA’s “AI Airlock”, the UK’s pioneering regulatory sandbox dedicated to AI as a medical device, has completed two phases, secured multi-year funding, and is feeding directly into a forthcoming UK regulatory framework shaped by a national commission on AI in healthcare.

For multinational developers, providers, and investors, the practical consequence is a compliance map that is more fragmented than it was a year ago while also, paradoxically, more navigable for organisations that build governance around principles rather than around any single statute – a theme to which this introduction returns.

Data: the contested foundation

Every chapter in this guide, from every jurisdiction, ultimately circles back to data. Data is the raw material on which healthcare AI is trained and the most sensitive category of personal information the law protects. The tension between those two facts remains the field’s defining compliance challenge.

Europe is attempting to resolve it by architecture. The European Health Data Space (EHDS) Regulation, which began to apply in March 2026 on a staggered timeline extending into the next decade, creates a common framework for both the primary use of electronic health data across borders and its secondary use for research, innovation and policymaking – with health data access bodies, secure processing environments, and patient opt-out rights standing in for individualised consent. If it works, the EHDS could become the world’s most important experiment in unlocking health data for AI development at scale while preserving public trust. Contemporaneous proposals to relax certain data protection constraints on AI training signal how urgently European policymakers now weigh competitiveness alongside privacy.

Elsewhere the tensions are being worked out less systematically in professional guidance, privacy regulation and, increasingly, litigation. Regulators across the common-law world have emphasised that recording and processing patient encounters with AI tools requires genuine, informed consent, and courts are beginning to test what happens when consent workflows exist on paper but fail at the bedside. Cross-border data transfer restrictions, particularly in Asia, continue to push developers toward localisation, federated (decentralised) learning and privacy-enhancing technologies. The lesson emerging worldwide is uniform: data governance is no longer a back-office compliance function but a first-order design constraint for any healthcare AI enterprise.

Liability comes of age

For years, commentary on healthcare AI liability was necessarily anticipatory. That period is ending on multiple continents at once. In the United States, coverage-denial algorithms and ambient documentation tools are now the subject of active litigation and discovery. Elsewhere, the change is legislative: EU member states must transpose the bloc’s new Product Liability Directive by December 2026, extending strict liability expressly to software and AI systems, easing evidentiary burdens for claimants confronting opaque technologies, and expanding the range of economic operators who can be held responsible.

The contributors to this guide, writing from very different legal traditions, converge on a shared forecast. As AI systems become more capable and more autonomous, the population of potential defendants will expand beyond treating clinicians and hospitals to encompass developers, vendors and deployers throughout the supply chain. Causation will grow harder to untangle. And contractual risk allocation – indemnities, limitations of liability, insurance requirements, audit rights – will do much of the work that tort doctrine has not yet learned to do. Specialised AI liability insurance products are already appearing in some markets, an early signal that the private sector is pricing risks the courts have only begun to adjudicate.

Amid this movement, one principle remains strikingly stable across jurisdictions: the human professional retains ultimate responsibility for patient care. Australian regulatory guidance, Austrian professional law, Canadian regulatory colleges, American state statutes and corporate practice of medicine doctrines, and Chinese physician-training mandates all express the same rule in different legal vocabularies – AI may inform clinical judgment, but it may not replace it. Human oversight is the closest thing healthcare AI law has to a global constitutional norm, and readers will find it woven through virtually every chapter that follows.

Equity and the Global South’s own course

Algorithmic bias remains a universal concern. Systems trained on unrepresentative data can entrench the very disparities AI promises to reduce, and tools validated in one population may underperform in another. What has changed is who is setting the agenda. International harmonisation efforts – including the World Health Organization-led Global Initiative on AI for Health – continue to promote shared ethical and regulatory standards with particular attention paid to low- and middle-income countries. But those countries are no longer merely recipients of guidance. India’s national strategy for AI in healthcare, released in early 2026, is notable for explicitly prioritising responsible innovation over precautionary restraint. Coming from a government already deploying AI at population scale in its public health system, the strategy represents a deliberate departure from the caution-first framing that has dominated global AI ethics. The bottom line? The centre of gravity in global health AI governance is becoming genuinely multipolar.

Generative AI: the shared frontier

If any single issue unites regulators worldwide, it is uncertainty about generative AI. Ambient documentation tools built on large language models (LLMs) have become healthcare AI’s commercial breakout category across markets, easing a global epidemic of clinician burnout even as they raise novel consent and confidentiality questions. Consumer-facing chatbots are drifting into the practice of medicine – most acutely in mental health, where several jurisdictions have moved from disclosure requirements toward outright restrictions on AI-delivered therapy. Hospital systems in Asia are piloting “agent” architectures that manage entire clinical workflows. Yet no major regulator has fully answered the foundational question: how should frameworks built for static, locked devices evaluate adaptive systems that generate novel content? The provisional answers now emerging – sandboxes, staged authorisations, mandatory labelling, post-market monitoring – will shape the field for the next decade, and they feature prominently in this year’s Trends and Developments articles.

Conclusion: governance as the common language

The paradox of 2026 is that as external rules have grown less settled – deferred in Europe, contested in the United States, nascent in much of Asia – the legal risk facing healthcare AI stakeholders has not diminished. It has migrated into litigation, into contracts, into professional discipline, and into the gap between what organisations say about their AI and what actually happens in the clinic. In such an environment, the strongest protections are often the ones organisations build for themselves: internal governance practices that remain sound no matter which jurisdiction’s rules apply. AI governance structures with real authority, documented human oversight of consequential decisions, honest patient-facing disclosure and consent, rigorous validation and bias monitoring, careful vendor diligence, and security calibrated to where regulation is heading – these commitments satisfy the strictest regimes while positioning organisations to adapt as less-strict jurisdictions tighten their own rules, as they eventually will.

The chapters that follow offer detailed, jurisdiction-specific guidance from leading practitioners on every element of this landscape. Their differences are instructive; their points of agreement are more instructive still. Healthcare AI has become ordinary. The legal profession’s task – shared across every jurisdiction represented in this guide – is to ensure that the obligations surrounding it are treated as anything but.