Neurodata governance

3. Evidence from innovators on data flows and governance

The previous section outlined the complex policy landscape for neurotechnologies and neurodata and the need for nuance; although neurodata are sensitive and require robust protections, their risks vary significantly across contexts, modalities and processing layers. Coherent and proportionate governance depends on understanding these differences rather than applying uniform assumptions.

The data‑mapping that follows was therefore conducted to provide a detailed, evidence‑based understanding of what data neurotechnologies collect, how they are generated, and how risk profiles evolve. This granular view supports responsive and risk‑proportionate safeguards to avoid over‑generalisation that might hinder innovation or fail to protect individuals effectively.

First, to identify policy gaps and support the analysis with concrete, evidence‑based insights, the OECD organised an aforementioned expert workshop in June 2025. The discussions highlighted several issues that could be better understood by examining the current practices of neurotechnology companies. To this end, the OECD conducted a study based on a questionnaire (Annex B) and interviews with 16 companies in 7 OECD member countries. 7 companies are developing a device for health use , 4 are targeting consumer space and 5 see applications of their device in other areas (see study sample in Annex C).

The study sought to generate systematic evidence on three central aspects of neurotechnology products and practices:

1) the diversity of business models and the role of data in company value proposition;

2) the characteristics of devices and services, including detailed mapping of data flows, to understand how neurodata are generated, processed, transferred, and stored in practice;

3) and how neurotechnology companies engage with regulatory frameworks.

This evidence provides an empirical foundation to identify areas of legal uncertainty, compliance challenges, and potential regulatory gaps and to assess whether current governance approaches are fit for purpose and where targeted policy adjustments may be needed. As the evidence collection is based on the study sample which does not necessarily represent all neurodata types, the findings should not be taken as exhaustive.

Company business models and applications

Finding 1) Data plays differentiated roles across neurotechnology business models, with distinct implications for governance, value creation and risk.

Neurotechnology companies operate through a wide range of business models, including research tools, algorithm and analytics services, clinical technologies, wellbeing solutions, and data platforms. This diversity shapes how neurodata are collected, processed, shared, and monetised, and therefore informs the privacy risks and safeguards that must be considered in a privacy assessment.

Some companies market hardware‑centric research tools, generating revenue through device sales and software licences while giving customers full control over the neurodata they collect. Others operate algorithm- and analytics-driven models, licensing proprietary algorithms or building large‑scale neurodata infrastructures to support cognitive AI and advanced human-computer interaction. Companies providing clinical devices and services rely on neurodata to enable diagnosis, therapy optimisation, and closed‑loop neuromodulation.

Organisations focused on wellbeing, neurostimulation, and recovery prediction operate through business to business (B2B) or business to business to consumer (B2B2C) models, creating value through device usage fees, enterprise subscriptions, and performance‑enhancement services. The sample in this study also includes a non‑profit research organisation applying an open‑science model as well as companies whose business models are still evolving (e.g. from device‑based to data‑platform models).

The role of data in company value propositions also differs. Neurodata supports clinical decision‑making and therapy optimisation; trains and validates algorithms; provides evidence for regulatory submissions and longitudinal analytics; and enables personalised, user‑centred insights in wellbeing and performance‑enhancement settings. Each of these uses raises distinct governance and privacy considerations, including anonymisation, consent management, inference risks, re‑identification concerns, and long‑term data retention obligations.

These business model differences translate into distinct privacy and governance implications:

• Neurotechnology models involve different data purposes, types of collectors, user interactions, and multi‑party processing arrangements. Research tools, analytics services, clinical devices, wellbeing programmes, and data‑platform models each raise unique legal and operational questions regarding legal bases for each data use, retention periods, consent pathways, and legitimacy of sharing data with partners;

• Companies face governance challenges in B2B2C models. Several companies reported concerns about downstream control of forbidden data uses, particularly their limited influence over how partner organisations use, combine, or contextualise neurodata. This creates uncertainty around compliance, user transparency, and the risk of unintended secondary uses (e.g., when neurodata collected from patients or consumers while providing them a service, is used by one of the entities for another purpose, without the individual’s knowledge and consent);

• A single privacy model is not feasible. Because neurodata plays different roles across the neurotechnology lifecycle, companies stressed that one‑size‑fits‑all privacy protections do not work. Governance approaches should reflect the sensitivity, regulatory classification, and risk profile of each application and each entity participating in the processing of neurodata;

• Different data uses require different legal bases and safeguards. Neurodata used for clinical decision‑making, algorithm training, evidence generation, and user insights each require an appropriate legal basis, specific safeguards, and clear allocation of responsibilities. Companies highlighted the need for explicit purpose mapping and precise determination of legal roles (controller, processor, joint controller) in line with the purpose limitation principle.

Finding 2) Use purposes of neurotechnologies influence regulatory and data protection risk assessments

A data protection impact assessment would need to consider the use purpose context in which neurodata are created, collected and processed, the risk level of the data when collected through invasive or non-invasive devices (invasive collection produces higher level of data quality and accuracy with more processing potential), the modulation performed, and the inferences derived. This assessment will influence the privacy safeguards to be employed.

Regulatory oversight on medical devices already depends on criteria including intended use purpose, degree of invasiveness, and associated risks. The UK’s RHC Neurotechnology Taxonomy illustrates this by noting that categorisation begins with determining whether a technology is invasive and whether it directly modulates neural activity, as these characteristics guide the policy approach (Regulatory Horizons Council, 2022[28]).

Recent taxonomies therefore emphasise classification based on primary intended use - therapeutic, assistive, preventive, enhancing, diagnostic, or research-driven - alongside distinctions related to invasiveness, modulation capability, and data sensitivity (Robinson et al., 2024[29]). As neurotechnologies diversify, use purpose categories have become essential for interpreting regulatory implications, ethical risks, and technological requirements both from the perspective of medical device regulation and for the implementation of data protection regulation. Table 3.1. provides regulatory pathways and ethical issues across a range of neurotechnology device use purposes, aligned with the devices represented in the study sample.

Table 3.1. Use purpose categories of neurotechnology devices

Use purpose	Regulatory path	Ethical focus	Device type (invasive or non-invasive)
Diagnostic	Medical device	Neurodata privacy, data misinterpretation	Both (mostly non-invasive)
Therapeutic	Medical device	Safety, consent, data handling	Both (often invasive)
Assistive/Rehabilitation	Medical device	Expectations, long-term safety	Non-invasive or minimally invasive
Prevention (e.g., early neurodegeneration)	Medical or consumer (depending on claims)	Data privacy, risk of overdiagnosis, misuse	Mostly non-invasive
Communication/Control	Medical or consumer (depending on claims)	Agency, mental privacy, responsibility	Both
Research	Ethics board/IRB oversight or medical device (depending on jurisdiction)	Dual use (i.e., technologies that can be applied for both beneficial and potentially harmful purposes), experimentation risks	Both
Enhancement	Consumer protection (unless medical claims)	equity of access, fairness, authenticity of technologically altered cognition, workplace coercion	Mostly non-invasive
Wellness	Consumer protection	Mental privacy, psychological impact/ user dependence,	Mostly non-invasive

Source: OECD, adapted from RHC Neurotechnology Taxonomy and study sample

Company data practices

This section provides an overview of key data governance considerations arising in the neurotechnology ecosystem. Based on the information collected in the study, it maps the types of data collected by neurotechnology applications, examining what information is captured, by whom, and through which technical mechanisms. It then outlines how these data are processed, stored, retained, transferred, and increasingly analysed through AI-enabled or automated systems.

Across the study sample, companies emphasised that data‑related challenges significantly shape innovation pathways, governance decisions, and geographic strategies. These challenges arise from the interaction between technical characteristics of neurodata, regulatory obligations, and organisational practices. A detailed analysis of these challenges is at the end of this section, following the description of data practices (and summarised in Table 3.4).

Mapping data collection in neurotechnology applications

This section describes what type of data neurotechnology devices collect and the means used to collect them.

What data are collected?

Finding 3) A multitude of data types processed together amplifies both utility and privacy risk. Unlocking value requires appropriate data protection safeguards.

Neurotechnology companies process four broad categories of data: non‑physiological, physiological, inferred, and ancillary (Figure 3.1). Combining these data types amplifies utility but also increases privacy risks.

This finding is supported by the mapped data practices of companies in the study, which show that neurotechnology applications rely on multiple data types obtained through different pathways and routinely merge to improve performance, accuracy, and personalisation.

Figure 3.1. Types of data collected

Source: OECD

Each of the categories above includes data that may be volunteered, observed, derived, or acquired, reflecting the different pathways through which information enters neurotechnology ecosystems (OECD, 2019[30]). This categorisation does not introduce new types of data, but rather helps clarify the channels through which data enter and circulate within neurotechnology applications.

The categories of data—non‑physiological, physiological, inferred and ancillary—describe the nature and characteristics of the information generated or used in neurotechnology settings. In parallel, the pathways of data—volunteered, observed, derived, and acquired—refer to the means by which data are captured, provided, or generated during neurotechnology use.

Non-physiological data: mostly volunteered by users but may also be observed through user interactions or derived through analysis (Table 3.2). They include personal attributes and information such as name, date of birth, sex, contact details, payment details, and health‑related details including medical history, clinical assessments, medication, diagnosis, and treatment outcomes. These data are typically provided by individuals explicitly when engaging with neurotechnology in facilitated services (e.g. diagnosis or treatment), research settings or as direct consumers of wellbeing products.

Table 3.2. Non-physiological data collected by companies

Types of non-physiological data
Name
Data of birth
Sex
Account credentials
Email address
Phone number
Informed consent form
Health information (clinical assessment, medical history, medication, medical team, diagnosis, treatment detail, and outcomes)
Payment information (billing details and social security number)
Level of education
Hand dominance

Source: OECD authors based on study questionnaire.

Physiological data: Physiological data refers to information recorded directly from the body by neurotechnology devices, whether implantable or external. These signals are captured in real time as the nervous system functions, and individuals typically play a passive role while companies or service providers collect them. Previously recorded physiological data may also be shared voluntarily or obtained from external datasets.

Physiological data are the most common type of data collected by neurotechnologies. They include neural signals reflecting nervous system activity linked to motor intention, cognitive workload, performance, and clinical conditions. These include direct measurements from techniques such as EEG or indirect functional indicators such as functional Magnetic Resonance Imaging (fMRI) or functional Near‑Infrared Spectroscopy (fNIRS). Additional physiological signals may include cardiovascular, respiratory, or muscle activity. Such data may be collected by implantable or non‑implantable devices.

Inferred data: Generated by transforming or classifying EEG or EMG signals (see Glossary in Annex A) through data analytics. AI systems play a central role in this process by enhancing accuracy, adaptability, and functional capability through advanced inference and pattern recognition. Neurotechnology applications can draw conclusions, by making inferences from the brain and the nervous system (Meng et al, 2024[31]). For example, machine learning models can classify emotional states from EEG signals (Ahmadzadeh Nobari Azar et al, 2024[32]), and statistical patterns in neural and non-neural data can be used to infer mental states (Ienca and Malgieri, 2022[33]). In this category, companies or enterprise users play an active role, while individuals may have limited involvement in the inference process. Because inferred data are produced through analysis of other data types, they primarily align with the derived data pathway.

Some companies also produce analytical reports based on non‑physiological and physiological data. These reports provide users with additional insights such as well‑being indicators, reactions to treatment, or levels of concentration or learning.

Ancillary data: Neurotechnology applications also collect ancillary data—data gathered in support of, or alongside, primary physiological data but not itself a biological signal. These include device logs, timestamps, and user metadata. Ancillary data generally fall into two groups:

• contextual data, describing the circumstances of data collection (e.g. tasks, stimuli, condition);

• behavioural data, capturing observable actions (e.g. response timing).

Ancillary data are typically observed during use, but depending on source and function, they may also be volunteered, derived, or acquired.

Table 3.3. Physiological, inferred and ancillary data

Physiological data	Collected during device usage	Inferred data	Collected during device usage	Ancillary data	Collected during device usage
Raw EEG	Yes	Transformed EEG	Yes	Timestamps	Yes
Raw impedance	Yes	Classified EEG	Yes	Experimental context	Yes
Raw IMU	Yes	Classified EMG Output	Yes	Session duration	Yes
Cardiac, muscle, and pulmonary signals	Yes	Classified EOG Output	Yes	Sensor quality/signal quality	Yes
Physical responses in the form of audio/video recordings (facials expressions, eye movements, blinks)	Yes	Combined data reports	No	Device control data (stimulation parameters)	Yes
Medical imaging data (MRI)	No			Usage metadata (frequency, success rate of clicks, latency)	Yes
				Hardware and system data (battery performance, telemetry)	Yes
				Input from a lifestyle questionnaire	No
				Cognition test results	No

Source: OECD based on study questionnaire.

No company reported using genetic data. However, some variations of biometric data collection were noted. Eye‑movement data and imaging‑derived phenotypes (e.g., hippocampal volume) may be processed, and some companies treat electrophysiological signals or acoustic voice markers as potential biometric identifiers. Others view specialised signals such as EEG, EMG, or PPG primarily as physiological measurements used for research or monitoring rather than personal identification.

The study showed that combining neural, physiological, behavioural and contextual data are essential as it materially improves accuracy, robustness, personalisation and safety, but also heightens identifiability and inference power. More specifically, merging these data can increase signal robustness (noise compensation across modalities), enable more accurate diagnosis and monitoring, support closed‑loop safety (e.g., adaptive stimulation), and deliver more personalised, inclusive user experiences (e.g., communication/control for users with motor impairments).

Privacy‑by‑design measures can help unlock value while protecting users. Measures include on‑device or edge processing, and privacy enhancing technologies (PETs) such as federated learning, secure enclaves, differential privacy, and controlled‑access research environments. Data minimisation across layers, from raw signals to features and inferences, can further mitigate risks.

Who is collecting data and how?

Finding 4) Clarity of roles of entities participating in neurodata use is essential for compliant access and secondary use

Companies often rely on multiple entities to collect, process, and share neurodata. This creates uncertainty around controller/processor responsibilities, data‑use privileges, and the legal basis for reuse, especially when data feeds into further research or AI model development.

Neurodata can be collected by developers, enterprise users, researchers, or end users. Deployments often involve joint environments (e.g., a developer with a hospital or employer), making data flows complex.

Companies reported that they either do not collect non‑physiological data directly or only gather limited types depending on the service. For research and medical support uses, such data is typically not collected, while consumer services may include names and lifestyle or medical habit information.

Most companies also do not collect physiological data themselves; instead, this is usually collected by customers, collaborators, or hospitals using their products. In some cases, these partners may share the data back with companies, often after anonymizing it.

Acquired data (purchased or licensed) are obtained from third parties under commercial licensing contracts (e.g., when data are acquired from data brokers) or other non-commercial means (e.g., when data are acquired via open government initiatives). Contractual obligations may restrict re-use or sharing.

Data collection frequency varies by application and may be continuous, episodic, or event‑triggered. Data may also be collected via audio or video recordings during training or supervised sessions, with only selected features extracted and retained (e.g., facial expressions, eye movements).

Collecting neurodata requires navigating consent procedures, ethics approvals, and safeguards, especially in clinical and research environments. Even when companies generate data through their own devices, assembling usable datasets requires substantial efforts to ensure effective governance of such devices.

Across the sample, many companies operate primarily as processors of neurodata, while hospitals, healthcare providers, employers, or consumer‑facing service providers function as controllers. However:

• Allocation of controller/processor roles is often unclear

• Distinctions between primary use (service delivery) and secondary use (research, R&D, AI training) are ambiguous

• Device manufacturers often seek access to data generated by clients or research collaborators, but data‑use rights and required safeguards are not always well defined.

These uncertainties create compliance risks, weaken user protections, and may slow legitimate innovation by limiting access to high‑quality, diverse datasets.

Mapping data processing, storage, retention and transfers

This section focuses on the processing of the data and its subsequent storage, retention and potential transfer.

Data processing

Finding 5) The layered processing of neurodata creates evolving risk profiles, requiring privacy‑by‑design safeguards tailored to each layer.

The study produced a framing of data processing which provides a general scheme: 1) capturing raw signals; 2) decoding them; 3) transferring them to local or cloud servers for further analysis and interpretation. This layered architecture underpins optimisation of neurotechnology systems.

Figure 3.2 shows how data routinely collected by companies go through different transformations and analysis. First, raw signals such as raw EEG, impedance and IMU are collected directly from sensors. These raw signals are then aligned in time and linked with contextual information. Next, signals are processed to improve quality or extract useful information, resulting in transformed data such as transformed EEG. The processed signals are then interpreted by algorithms that classify the data into meaningful outputs, such as classified EEG. Usually, all relevant results are combined into unified data reports that summarise the system’s outputs for analysis or downstream use. Figure 3.3 details these actions (with further details in Annex D).

Figure 3.2. Generic overview of data processing and analytics

Source: OECD.

Figure 3.3. Three layers of analytics performed on data

Source: OECD.

Each analytic layer introduces a distinct risk profile, and these risks evolve as neurodata move through successive stages of processing.

• In the first layer (“signal and data”), companies process raw neural activity, with the primary concern being exposure. The risk of identifiability of the neurodata by a non-authorised entity depends on technical characteristics (such as resolution and uniqueness of signal patterns) as well as contextual factors (such as data linkage and storage practices).

• As data progresses into the next layers (“interpretation and decoding”, “application and interactions”), the nature of the risk shifts. Here, neural signals are transformed into features, classifications or inferred states such as attention, intention and emotional responses. At this stage, exposure may be more harmful since the data may be more easily identified, and there are added risks such as inaccurate or probabilistic inferences, attribution of sensitive traits, or uses that profile individuals.

Across all layers, companies face challenges in translating complex, high dimensional data into outputs that are interpretable, actionable, and responsibly used. This includes developing robust models that perform reliably in real world conditions, communicating uncertainty and limitations, and maintaining influence over downstream uses of data within extended value chains. These challenges underscore that data governance is not only about data access, but also about extracting value and meaning from data, which requires considerable investments:

• difficulty of translating high dimensional neurodata into simple, actionable scores that can be understood beyond the neuroscience community;

• ensuring models are robust to real world variability and maintaining stable signal transmission from implant to decoder;

• difficulty anonymising EEG data without destroying its analytical value, as well as challenges in labelling and contextualising EEG data at scale.

Companies report, and the above landscape shows, that while current privacy frameworks provide a baseline for lawful processing, they lack guidance specific to neurodata. Current regulations do not clearly distinguish between different types of neural signals, derived metrics and analytics, creating challenges for innovators in determining how to lawfully process neurodata.

Clarity would be helpful around:

• classification of neural data as biometric, health, sensitive or personal data;

• proportionality of obligations for low risk, anonymised, or research grade signals;

• post‑market oversight, resulting in the need for a flexible framework that supports effectiveness checks and real‑world performance monitoring to accelerate evidence‑based service improvements;

• the secondary use of retrospective data from devices and medical record information.

In response to suggestions to classify all neural data as highly sensitive, companies caution that such an approach could potentially reduce data sharing and slow scientific progress, while its added value for individual protection remains uncertain. Companies argued that “increased risks [results for] end users by forcing the treatment of all brain data as personal information” as this comes with “a need to collect contact information and other uniquely identifiable information to validate one has access to control the brain data.” This perspective suggests that, in certain cases, initially non-identified and potentially difficult-to-identify data, posing limited privacy risks if left as is, might become identifiable through compliance processes, thereby elevating privacy risks scenarios. However, this claim remains contested and highlights the need for careful assessment of trade-offs rather than a generalised conclusion.

Companies reported difficulties in complying with emerging instruments for the responsible use of neurodata. They expressed a strong need for guidance and practical tools to interpret existing regulations. They welcomed opportunities for broader regulatory dialogue as well as cross-regulatory guidance and tools for compliance across legal domains. Some noted direct interactions with the US medical devices regulator (perceived as providing both technological expertise and timely practical responses) as a helpful example guiding implementation of regulatory principles and enhancing clarity.

Additionally, data retention, storage and de-identification are essential elements for the secondary use of neurodata. Regulatory guidelines would be helpful to support the establishment of neurodatasets which will serve as an infrastructure enabling industry growth.

Data storage and data retention

As part of data processing, the study showed that companies use mixed infrastructures:

• On‑device storage (temporarily, encrypted);

• Cloud storage (third‑party or internal);

• On‑premises secure servers, especially for large clinical datasets.

Real‑time on‑device processing is limited by battery and compute constraints, and most processing occurs offline. Multi‑terabyte experiments often require multi‑petabyte storage, raising cost, capacity and security challenges. Some organisations allow users local‑only storage or user opt‑outs from cloud uploads.

Finally, retention periods vary by use case:

• Short retention when only a real‑time estimate is needed (e.g., momentary state detection);

• Longer retention when tracking changes over time for health management;

• Research‑driven retention until study completion (2–10 years);

• Clinical retention based on institutional policy;

• Consent‑dependent retention for patient or identifiable data;

• In some cases, indefinite retention of anonymised datasets or derived reports.

Most companies pseudonymise data, though few perform full anonymisation. Pseudonymisation typically occurs when signals or features leave the user's device and are transferred to servers, with strict controls for re-linking.

Data transfers

Companies reported that neurodata are commonly transmitted beyond the device, using methods that vary by application and system design. Transmission approaches fall into four broad categories:

• Local transfer to user‑controlled devices;

• Cloud or networked transfer to remote servers;

• Federated or distributed models, where data remain on the device, but encrypted updates or aggregates are shared;

• Transfers to third parties such as service providers or researchers.

Transmission channels include wired USB connections, Bluetooth or BLE, Wi‑Fi and LAN networks, and wide‑area networks such as cellular systems.

Security practices differ, but typically integrate multiple safeguards:

• Encrypted communication channels (HTTPS/TLS, TLS 1.2+, secure BLE);

• Encryption at rest, often AES‑128 or higher;

• Hardened server environments, access control systems and authenticated cloud portals;

• Network protections, including secure LAN configurations and cloud‑security programmes.

Most companies combine these measures into end‑to‑end strategies, such as devices transmitting encrypted data to authenticated cloud portals where storage and processing occur on secured company servers.

Safeguarding neurodata across its lifecycle also involves organisational measures. Some companies follow ISO/IEC 27001, implement secure software development processes, designate data protection officers, or comply with GDPR, CCPA or Japan’s Privacy Mark. Others rely on national schemes or general internal policies. Despite these controls, they noted persistent challenges: securing data stored on researchers’ devices, maintaining cybersecurity amid growing threats, complying with HIPAA or FDA Class III requirements in clinical contexts, managing encrypted telemetry across multiple sites, and meeting strict hospital security standards, especially around MRI workflows.

Practices regarding external data transfers vary considerably. About half of companies do not share data outside their organisation except when legally required, emphasising that processing and storage occur within secured internal cloud environments, though hospitals may download reports for patients. Some companies expect external sharing to increase for research or collaborative development, while others stated they do not control neurodata generated outside their systems or only receive data from collaborators.

Among those who do share data, most transfer only anonymised, coded, or otherwise de‑identified datasets, for example to research partners, hospitals or universities for joint studies and AI model development. Some already share de‑identified study data under the conditions specified in participant consent. Companies also described safeguards governing such transfers, including obtaining consent where relevant and using formal data‑sharing agreements with clinical or academic partners to ensure compliance and accountability across all parties.

AI and Automated Processing

Finding 6) Neurotech-AI convergence and adaptive systems face regulatory and legal uncertainties

The study shows that while some companies report no use of AI, many rely on varying degrees of automation, and others operate primarily as AI‑driven organisations with neurotechnology components such as neural‑image analysis. Several companies were unable to share details due to confidentiality or because their AI systems remain under development.

Across the sample, companies indicated that signal processing is almost always automated. Neurotechnology devices generate complex, high‑frequency data that must be filtered, cleaned and transformed to be useful. Automation is therefore embedded in tasks such as biomarker identification, real‑time processing, therapy optimisation and model‑drift detection. Yet, automated processing does not necessarily imply use of machine‑learning models.

Where AI or machine learning is used, it typically supports functions that extend beyond basic filtering—for example, interpreting neural activity. Reported applications include brain–computer interfaces, neurofeedback systems, adaptive therapeutic devices, clinical decision‑support tools and neuro‑imaging models. Companies described AI systems that classify mental states, detect sleep stages or anomalies, analyse neural signal patterns, measure memory‑related structures and predict personalised stimulation parameters.

On monitoring and verification of the quality and accuracy of algorithmic outputs, one third of companies disclosed that processes are still under development. Others described a range of approaches to verify the quality and accuracy of algorithmic outputs:

• Continuous performance monitoring for analytical accuracy during clinical trials, studies and multi-site cases;

• Data analytics to support decoder robustness over time;

• Validation against ground-truth datasets such as “gold standard” clinical measures and benchmark EEG datasets;

• Cross-testing across diverse user samples;

• Periodic internal reviews;

• Algorithmic reliability tested using repeated measurements with the same participants;

• Publication of processes in academic journals and peer review;

• Internal audit protocols;

• A data research team verifies outputs using statistical performance metrics (e.g. precision, recall and error rate);

• All updates undergo testing in controlled environments before release to ensure reliability and consistency.

The discrepancy between the pace of technological advances and regulatory evolution is particularly apparent at the intersection of AI and neurotechnology. Companies increasingly work across both domains, using large language models (LLMs) to extract insights from raw neural data. Recent advances have enabled Brain Foundation Models (BFMs), large-scale AI models trained on diverse neuro-datasets. These models can process and interpret neural signals with greater speed and personalisation, potentially transforming neurodata analysis.

The convergence of neurotechnology and AI introduces new challenges for complying with existing frameworks. For activities such as AI-driven signal analysis or adaptive clinical decision support, companies report resulting uncertainty in multiple areas including:

• AI validation standards;

• Compliance expectations for AI-enabled functionalities;

• Applicability of existing SaMD concepts (software as medical device) to neurotechnology hardware software combinations;

• Undefined pathways for adaptive and closed‑loop AI-based stimulation;

• Regulatory friction for iterative software updates of devices that rely on machine learning;

• Unclear or overly rigid AI governance which discourages beneficial product updates and favours incumbents over startups;

• Alignment between the GDPR and the AI act.

Companies stressed that provisions on risk categorisation in AI legislation, such as the EU AI Act, create legal uncertainty on how to classify neurodata, which is even more problematic as unclear or overly rigid AI governance favours incumbents over startups. This uncertainty is amplified when these provisions intersect with data protection laws. Companies therefore stressed the importance of early engagement with regulators to develop clear guidance and reduce ambiguity.

Challenges related to data collection and handling

Finding 7) Data-related challenges significantly shape innovation pathways, governance choices, and geographic strategies.

Companies report a wide range of data‑related challenges that significantly shape their innovation pathways, governance choices, and geographic strategies (Table 3.4). Challenges emerge not only from the sensitivity and technical complexity of neurodata, but also from the interaction between data-generation practices, regulatory frameworks, ethical obligations, infrastructure constraints, and business models. These challenges typically stem either from data handling and management issues or from regulatory complexity.

Table 3.4. Reported challenges in data handling and management

Category	Data challenges	OECD Privacy Guidelines Principles
Access to training data	Accuracy & validation Scale & diversity Cost & context	Data Quality (Principle 2); Purpose Specification (Principle 3); Accountability (Principle 8)
Data collection and consent management	Operational cost (consent, recruitment) Ethical compliance & privacy protection Data siloing in frameworks	Collection Limitation (Principle 1) Purpose Specification (Principle 3); Accountability (Principle 8)
Data use	Standardisation, Interoperability Reuse	Use Limitation (Principle 4); Accountability (Principle 8)
Secure data handling and cybersecurity	Device security Access control Staff qualification	Security Safeguards (Principle 5); Accountability (Principle 8)
Data infrastructure	Volume Storage Communication	Openness (Principle 6); Accountability (Principle 8)
Data analysis	Interpretation Value extraction	Use Limitation (Principle 4); Accountability (Principle 8)

Source: OECD.

Access to training data remains limited due to the high cost and complexity of generating high‑quality neurodata, the scarcity of high‑resolution recordings, and certain data localisation requirements in some jurisdictions. Companies increasingly seek cross‑border data reuse to avoid duplicative collection, yet question whether datasets generated in one cultural context, such as sleep studies conducted in Asia, can be validly applied elsewhere.

Data collection and consent management are resource‑intensive processes, as generating neurodata requires direct human participation, expert oversight, and controlled experimental conditions, making large-scale collection difficult. Companies must navigate ethics review, participant recruitment, and safeguards for vulnerable populations, often across multiple institutional and legal frameworks. These essential protections significantly influence the pace and cost of data generation. Though some neurodata sharing initiatives, based on the FAIR data principles, have been established in the past two decades, their sustainability and growth are limited (Martone, 2024[34])

Ensuring effective data use presents additional barriers. Companies face inconsistent data formats, insufficient metadata, limited interoperability between institutions, and difficulties maintaining linkages between patient attributes (e.g., age, gender) and imaging data owing to hospital‑level anonymisation practices. These issues limit discoverability, integration, and reuse.

Requirements for secure data handling and cybersecurity, including privacy protections, ethical compliance, and jurisdiction‑specific rules on storage and transfer, add further operational complexity. These obligations shape what data companies can access, how it can be stored, and whether it can move across borders.

Substantial investment in data infrastructure is required to support reproducible access, secure storage, and standardised processing pipelines. Companies report that without sustained investment in interoperable standards, cataloguing, and interoperable systems, the value of shared or longitudinal datasets is significantly constrained.

Finally, data analysis depends on accurate and expert‑validated training data, which is difficult to produce at scale. Limited dataset diversity, scarce high‑resolution recordings, and variability in data quality restrict the development, testing, and validation of AI‑enabled neurotechnology systems.

Regulatory engagement

Reported engagement with public authorities varies widely across the study sample in terms of depth, purpose, and regulatory experiences by jurisdiction. All companies indicated interaction with medical‑device regulators and relevant policy processes, whereas almost none reported engagement with data protection authorities. Companies described navigating regulatory processes not only for compliance, but also to influence emerging governance frameworks and support innovation. Three findings emerged: 1) widespread but differentiated engagement patterns, 2) divergent regulatory experiences across regions, and 3) different rationales for engaging with regulators.

Engagement patterns and rationales

Finding 8) Regulatory engagement patterns are widespread and differentiated; Finding 9) Companies could act as co‑architects of neurotechnology governance frameworks, particularly around data protection, safety, and ethical design

Most companies report active interactions with medical-device regulators, while a smaller subset described limited or very early engagement. In contrast, companies generally do not engage with data protection authorities on neurodata-related privacy questions. Only one company reported participating in a regulatory sandbox while the rest have not had any contact. Nevertheless, interactions of data‑protection, consumer‑protection, and AI‑oversight authorities are expected to expand significantly as neurotechnologies evolve.

Company responses indicated that regulatory engagement is seen as a core operational activity shaping development timelines and resource allocation. A majority engage primarily in product‑specific regulatory processes, including device approvals, clinical trial permissions and formal regulatory designations. Examples include engagement with:

• U.S. FDA: Early Feasibility Studies, Breakthrough Device Designation, 510(k) submissions, De Novo pathways, and PMA processes;

• Japan PMDA / MHLW (Ministry of Health, Labour and Welfare): medical‑device registrations and case‑by‑case consultations;

• EU Notified Bodies: CE marking or conformity assessments;

• UK MHRA (Medicines and Healthcare products Regulatory Agency): clinical trials authorisations;

• Korea MFDS (Ministry for Food and Drug Safety): clinical and device approvals and Breakthrough Device discussions.

Several companies reported being involved in policy‑shaping and governance‑related engagement. Activities include:

• Collaborating with international organisations (e.g., OECD, UNESCO) by participating in working groups, consultations and workshops;

• Contributing input to national initiatives or ethics authorities (e.g., U.S. Government Accountability Office, KEK Switzerland);

• Providing subject‑specific perspectives on matters such as risks of over‑regulation or neuroscientific issues like sleep science.

Some companies engaged with government institutions or regulators to provide technical expertise and know-how, for example by:

• Contributing to analyses on neurodata governance, risk management, and privacy protections;

• Providing information on neurodata classification, mental privacy and other uses;

• Offering expert input on sleep-related public health challenges.

Company responses indicated that engagement with regulators and government institutions is not only compliance‑driven but also serves broader strategic purposes, including strengthening investor credibility, supporting international expansion, shaping emerging standards and reducing technological or financial risks early in R&D. Smaller companies noted that limited resources constrain their ability to participate in wider policy discussions, despite recognising their strategic value.

Insights on medical device regulation

Finding 10) Divergent medical device regulatory experiences across jurisdictions

A prominent cross‑company observation concerns the contrast between U.S. and EU medical devices regulatory processes, which has strategic implications for market entry and R&D location. Companies characterised the US system as “centralised, accessible, and pragmatic”. Those engaging with the FDA consistently reported: 1) direct early contact with regulators, 2) clear, targeted feedback—often through multiple free pre‑submission meetings, 3) a problem‑solving orientation focused on “what makes sense”. This predictability supports de‑risking at early development stages and has encouraged companies to initiate first‑in‑human trials in the US.

In contrast, company feedback described regulatory experiences in the EU as “fragmented, variable, and resource intensive”. Companies interacting with EU Notified Bodies report: 1) decentralised processes with differing rules and price structures, 2) critical reliance on costly consultants, 3) broad compliance expectations, and 4) requirements to justify conformity with extensive technical standards.

Companies also noted significant difficulties navigating EU medical‑device pathways, noting inconsistent requirements and limited opportunities for early dialogue. Additionally, they reported uncertainty around GDPR and AI Act compliance when data categories and risk levels of use cases are not clearly defined and from unresolved questions about whether neural data may become a new category of sensitive data.

This fragmentation reportedly results in higher compliance costs, extended timelines, and weaker regulatory certainty, prompting some companies to prioritize non‑EU jurisdictions for initial regulatory steps.