Scaling Artificial Intelligence in Health

3. Current state of implementation of AI in health across OECD Members

AI is rapidly advancing in the healthcare sector, offering transformative potential. Yet its integration must be grounded in a robust, transparent, and fair foundation. The AI in Health Policy Checklist (Chapter 2) provides a structured tool with which countries can begin to identify and address existing gaps across policy in the areas of enablers, guardrails, engagement, and ethics.

As part of this chapter, findings are presented on the current state of AI adoption in health across all OECD countries, drawn through desk research, the OECD survey Health Data Governance, the Impact of Artificial Intelligence on the Health Workforce, and Interoperability and Progress in Implementing the European Union Co‑ordinated Plan on Artificial Intelligence (Volume 1) (OECD, 2025[1]) and reviewed by OECD countries. This analysis is based on the available results as of the writing of this report. While individual responses will change over time, directional findings remain accurate. Together, these sources offer a comparative outlook of national AI readiness in health systems and review OECD Members’ progress toward sector-specific approaches to AI and health.

Review of progress toward the responsible scale of AI in health

This chapter will review progress in OECD countries toward the responsible scale of AI. This will include examining actions toward national strategies or action plans at the intersection of AI and health as part of agreed objectives. The chapter looks at aspects of the checklist across various areas including agreed objectives; better use of health data; enabling the use of AI; building capacity and capability among the health workforce; oversight bodies; and public engagement. These were chosen due to their expert-informed foundational importance in advancing the responsible scale of AI.

Agreed objectives: Strategies that enable the responsible scale of AI in health

A key aspect of establishing agreed objectives is articulating and advancing coherent strategies. This section will consider progress for strategies at the intersection of AI and health, for cloud services, for interoperability, and for digital security (see Table 3.1). This includes a specific look at the AI in health strategies. These areas could benefit from sharing of practices across OECD countries.

AI in Health strategies: An emerging trend for the responsible scale of AI in health is for governments to develop strategies at the intersection at AI and health. This is in part due to establishing a place that can reconcile the balance between forces: market forces (moving fast), health forces (doing no harm), and human forces (scaling to every person). Collectively, an AI in Health strategy would allow countries to “scale fast while doing no harm”.

Countries have taken different approaches in the detail of implementation. In Korea, there is a mention of driving innovation with clear regulatory pathways for medical devices (MOHW, 2024[2]). In Norway, there is emphasis on cross border information sharing and the specific use of Large Language models (Helsedirektoratet, 2025[3]). In Finland, a comprehensive vision for 2035 has been developed with a comparison between radical advancement and cautious profession across healthcare and social welfare (Digifinland, 2025[4]). France has a focus on citizen rights, building trust and transparency, functional national governance and the data foundations to enable sharing, use, and reuse (Ministère du Travail de la Santé et des Solidarités, 2025[5]). In Spain, emphasis has been placed on reliability, utility, humanism, and universality (Ministerio De Sanidad, 2025[6]). In the United States the democratising of AI technologies was highlighted (United States Department of Health and Human Services, 2025[7]). In Ireland, the strategy places a particular focus on the use of AI to improve operational efficiency and enhance the experience of both patients and healthcare staff (Department of Health, 2026[8]). Additional leading practices have emerged, one in Catalonia (Spain) where transparent communication and processes for all stakeholders, including clear pathways for innovators, are emphasised (Salut Generalitat de Cataluyay, 2025[9]). Additionally in India, a strategy was published in February 2026 detailing five key pillars for the human centric and responsible adoption of AI in healthcare, including: prioritising governance, evidence generation, digital and data infrastructure, workforce readiness, and ecosystem enablement (Ministry of Health and Family Welfare, 2026[10]).

Nevertheless, these strategies and action plans have common components: fostering cross-sector collaboration, building human capacity, fostering trust with the public, incentivising quality and trust, support for development and deployment, and improving health data foundations (see Table 3.1).

Table 3.1. Components of national AI in health strategy/action plans

Components of National AI in Health Strategy/Action Plans	Finland	France	Ireland	Korea	Norway	Spain	United States
Innovation and Cross Sector Collaboration	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Establish an AI Advisory Group	No	Partly	Yes	No	Yes	Partly	No
Cross-Border Information Sharing	Partly	Yes	Partly	No	Yes	No	No
Regulatory Guidance and Assessment	Yes	Partly	Yes	Yes	Yes	Yes	No
Use and Implementation of AI (Including Procurement)	Yes	Yes	Yes	No	Yes	Yes	Yes
Use of Large Language Models	Partly	No	No	No	Yes	No	No
Continuous Assessment of Implemented Solutions	No	Yes	Partly	No	No	Partly	No
AI Competency and Training: Building AI Capacity	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Citizen Rights and Trust	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Transparent Communication	Yes	Yes	Yes	No	Yes	Yes	Partly
Promoting Trustworthy and Quality AI Development ( Ethical and Responsible Use to Avoid Potential Harm)	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Research (Targeted support for development and deployment)	Partly	Yes	Yes	Partly	Partly	Partly	Yes
Democratising AI Technologies and Resources to Promote Access	No	No	Yes	No	No	Partly	Yes
Regulatory Pathways for Medical Devices	No	Partly	No	Yes	No	Yes	No
Health Data Utilisation and Quality Data Foundation	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Data Sharing and Data Provisions	No	Yes	Partly	Partly	Yes	Partly	Yes
Modernise Technical Infrastructure	Partly	Yes	Yes	No	No	Partly	Yes
Financial Incentives for Industry	Partly	Partly	No	No	No	No	Yes

Note: AI in Health Strategies were reviewed by the authors, high-level categories were identified for each country to support a comparison.

Source: Helsedirektoratet (2025[3]), “Joint AI plan for the safe and effective use of AI in the Norwegian health and care services 2024 - 2025 – Helsedirektoratet”, https://www.helsedirektoratet.no/rapporter/joint-ai-plan-for-the-safe-and-effective-use-of-ai-in-the-norwegian-health-and-care-services-2024-2025; Digifinland (2025[4]), “AI Ecosystem in Social and Health Services (SOTE)-AI Vision 2035”, https://digifinland.fi/wp-content/uploads/2025/09/SOTE-AI-Ecosystem-AI-Vision-2035.pdf; (Ministère du Travail de la Santé et des Solidarités (2025[5]), “Stratégie intelligence artificielle et données de santé”, https://sante.gouv.fr/IMG/pdf/strategie_donnees_et_intelligence_artificielle.pdf; United States Department of Health and Human Services (2025[7]), “U.S. Department of Health and Human Services: Strategic Plan for the Use of Artificial Intelligence in Health, Human Services, and Public Health”, https://irp.nih.gov/system/files/media/file/2025-03/2025-hhs-ai-strategic-plan_full_508.pdf; MOHW (2024[2]), 인공지능 기반 의료기술 혁신으로 국민건강 증진 < 일반 < 보도자료 < 알림: 힘이 되는 평생 친구, 보건복지부, https://www.mohw.go.kr/board.es?mid=a10503010200&bid=0027&act=view&list_no=1483021&tag=&nPage=1; Ministerio De Sanidad (2025[6]), “Artificial Intelligence Strategy for the National Health System. eIASNS”, https://www.sanidad.gob.es/en/areas/saludDigital/doc/eIASNS_en.pdf; (Department of Health, 2026[8]), “AI for Care - The Artificial Intelligence (AI) Strategy for Healthcare in Ireland 2026 - 2030”, https://www.gov.ie/en/department-of-health/publications/ai-for-care-the-artificial-intelligence-ai-strategy-for-healthcare-in-ireland-2026-2030/.

Additionally, 12 countries – Australia, Belgium, Canada, Czechia, Estonia, Iceland, Israel, Japan, New Zealand, Slovenia, Sweden, and the United Kingdom – have made considerable steps towards providing transparent guidance at the intersection of AI in Health, but do not yet have a published strategy (although some are in development) (see Table 3.2). New Zealand has published a strategic vision for the integration of AI in healthcare, which is grounded in principles of equity, equitable deployment of AI solutions, Māori partnership, and its advancements of digital capabilities across the health workforce (OPMCSA, 2023[11]). Canada has published the Pan-Canadian AI for Health (AI4H) Guiding Principles to aid provinces and territories in the responsible adoption and use of AI, and is incorporating health examples within the national AI strategy (Government of Canada, 2025[12]; CIFAR, 2023[13]).

Table 3.2. Guardrails to establish agreed objectives for AI in health

	National AI Strategy or AI Action Plan Specific to Health	National AI Strategy Referencing Health	Defined National Strategy for Cloud Based Resources for Health	Defined National Interoperability Strategy for Health Data	Defined National Digital Security Strategy for Health
Australia	Partly	Yes	Yes	Yes	Yes
Austria	No	Yes	No	Partly	No
Belgium	Partly	Yes	Yes	Yes	Yes
Canada	Partly	Yes	Yes	Yes	No
Chile	No	Yes	No	Yes	No
Colombia	No	No	No	No	No
Costa Rica	No	No	No	Yes	No
Czechia	Partly	No	No	Partly	Yes
Denmark	No	Yes	Yes	Yes	Yes
Estonia	Partly	No	Yes	Yes	Yes
Finland	Yes	Yes	Yes	Yes	Yes
France	Yes	Yes	Yes	Yes	Yes
Germany	No	No	Yes	Yes	Yes
Greece	No	Yes	Yes	Partly	No
Hungary	No	Yes	Yes	No	Yes
Iceland	Partly	Yes	Yes	Partly	Partly
Ireland	Yes	Yes	Partly	Yes	Yes
Israel	Partly	Yes	Yes	Yes	Yes
Italy	No	Yes	Yes	Partly	Yes
Japan	Partly	Yes	Yes	Yes	Yes
Korea	Yes	Yes	Yes	Yes	Yes
Latvia	No	No	Yes	Partly	Partly
Lithuania	No	Yes	No	Yes	Yes
Luxembourg	No	Yes	Yes	Yes	Yes
Mexico	No	No	No	Yes	No
Netherlands	No	Yes	Yes	Yes	Yes
New Zealand	Partly	Partly	Yes	Yes	Yes
Norway	Yes	Yes	Partly	Yes	Partly
Poland	No	Yes	No	Yes	Yes
Portugal	No	Yes	Yes	Yes	Yes
Slovak Republic	No	Yes	Yes	Partly	No
Slovenia	Partly	Partly	Yes	Yes	Yes
Spain	Yes	Yes	Yes	Yes	Partly
Sweden	Partly	Yes	No	Yes	Yes
Switzerland	No	No	Yes	Yes	No
Türkiye	No	Partly	No	N/A	N/A
United Kingdom	Partly	Yes	Yes	Yes	Yes
United States	Yes	Yes	Partly	Partly	Yes

AI strategies that contain health: To harness the potential of AI to improve efficiency, safety, and quality of health service delivery, clarity is needed to provide direction across the lifecycle of AI. To that end, most OECD countries are developing an overall strategy for AI that contains some consideration for health with 27 countries already having established such a national strategy and/or action plan. Three others, New Zealand, Slovenia, and Türkiye are working towards the publication of a national AI strategy. Chile has advanced an AI strategy and action plan, including a focus on the development of regulatory sandboxes for healthcare and approaches to data anonymisation (MinCiencia, 2025[14]; Chile IA, 2024[15]).

Across the OECD, Finland, France, Ireland, Norway, Korea, Spain and the United States stand out with the emerging practice of a specific national strategy and/or action plan at the intersection of AI and healthcare (see Table 3.1) as of the publication of this document.

Cloud strategies: AI in health is inherently data‑intensive and safety-critical, demanding substantial computing capacity, secure environments, and well-defined regulatory compliance mechanisms. The backbone of this capacity lies in a Cloud Smart approach, which emphasises robust, transparent, and sovereign cloud frameworks which are tailored to the sensitivity and complexity of health data within health systems (Kedi, Ejimuda and Dayo Ajegbile, 2024[16]).

Cloud infrastructure can enable high-performance computing for AI model training and real-time inference, but also ensure strict compliance with data protection regulations such as the GDPR in the EU or Australia’s Privacy Act 1988 (European Union, 2018[17]; Busch et al., 2025[18]). Additionally, cloud infrastructure is resilient enough to support current technological and security needs while remaining adaptable to sustain future digital health innovations. This includes the needs of open by design data infrastructure with established standards to support technically and semantically interoperable sharing of health data across care venues and settings.

Throughout OECD countries, 25 countries have already defined a national cloud infrastructure ensuring AI in health is deployed securely, at scale, and in compliance with national legal frameworks (see Table 3.2). Meanwhile, Ireland, Norway and the United States are making considerable steps toward implementation. For example, Ireland has set a priority to adopt secure, scalable, and cost-effective adoption of cloud in the health system through the Digital for Care strategy (Government of Ireland, 2024[19]). As a leading practice, the United Kingdom, where the NHS Cloud Centre provides a unified framework for scalable cloud adoption across the health system, offering technical guidance and procurement support to ensure compliance, interoperability, and innovation (NHS England Digital, 2025[20]).

Interoperability strategies: While cloud infrastructure provides the secure pathway for scalable solutions for AI operations, interoperability provides the backbone of data use in the AI age with semantic, technical and organisational standards. Without national and compatible international interoperability frameworks, even the most advanced data infrastructure risks reinforcing fragmentation and undermining the scalability and utility of AI solutions.

Across the OECD 27 countries have now adopted a national health interoperability strategy, whilst Austria, Czechia, Greece, Iceland, Italy, Latvia, the Slovak Republic and the United States are making progress adopting frameworks on a national level (see Table 3.2). In Finland, all Finnish healthcare providers must use Kanta Services for standardised electronic patient records, as mandated by the Act on Client Data, and with it a set of defined semantic data standards (1050/2021) (Kanta.fi, 2024[21]). This law enhances cross sectorial interoperability by integrating healthcare and social care data flows. In Denmark, Sundhed.dk, MedCom, and the Danish Health Data Authority collaborate to develop and uphold standardised reference architectures and IT standards to enhance healthcare quality and efficiency (Sundhed.dk, 2024[22]; MedCom, 1994[23]; The Danish Health Data Authority, 2025[24]). Estonia has advanced their interoperability by leveraging e‑Governance, secure data exchange, and a public-centric approach to enhance healthcare (e-Estonia, 2025[25]). Australia’s National Healthcare Interoperability Plan further highlights the strategic alignment of interoperability with the goal of advancing the digital maturity of its health sector (Australian Digital Health Agency, 2023[26]). Similarly, Chile’s national interoperability strategy, centred on transparency and patient-focussed care, is improving data exchange efficiency and strengthening health system co‑ordination (Capurro et al., 2017[27]).

Interoperability is also evolving into a global and system level initiative. Across the European Union, the EHDS is setting the standards for cross border data exchange and use, fostering strong collaboration between member states and health data standards organisations on compatible frameworks (European Commission, 2024[28]). Additionally, the adoption of the International Patient Summary (IPS) within national interoperability strategies demonstrates the value of agreed-upon objectives and shared standards in enabling long-term international health data exchange (The International Patient Summary, 2025[29]).

Digital security strategies: Digital security is another foundational pillar of trusted infrastructure for the responsible scale of AI in health (Sutherland et al., 2023[30]). This includes a trusted cybersecurity framework that ensures secure data storage, transmission, and processing, particularly given the sensitive nature of health information. A robust approach to security for AI in health must address emerging threats such as model manipulation, adversarial attacks, and unauthorised data extraction, all of which pose risks to both patient safety and institutional credibility. Critically, digital security must not be treated as a siloed technical function. It must operate in concert with national cloud strategies and interoperability frameworks, forming an integrated infrastructure upon which AI in health can safely, equitably, and sustainably be built.

Twenty-four OECD countries have embedded national digital security principles into broader cybersecurity strategies, increasingly recognising the specific needs of health and AI (see Table 3.1). Iceland, Latvia, Norway and Spain are currently undergoing efforts to incorporate health within their national digital strategy. Australia’s Digital Health Cyber Security Centre (Australian Digital Health Agency, 2022[31]), Denmark’s National Strategy for Cyber and Information Security planning (The Danish Health Data Authority, 2025[24]), and the Netherlands’ Cybersecurity Agenda provide leading examples of efforts to integrate AI-specific risks into national infrastructure (NLCS, 2022[32]).

Leading practices emerge across these strategies, including the foundations of safety, quality, ethics, and security; competency and training of healthcare professionals and the public; and providing regulatory guidance for AI and associated medical devices (see Table 3.2). Additionally, strategies mention setting a foundation of promoting innovation, cross sector collaboration and the implementation and use of AI in the health system.

Better use of health data

A consistent theme across this report is that timely access to quality data with protections in place is necessary for the responsible scale of AI solutions. This section considers the use of health data for AI solutions, such as catalogues, health data access bodies, and legislation for protection.

Table 3.3. Leading practices to enable better use of health data

	Set of National Procedures for the Cataloguing of Significant Health Data Assets	Defined Central Agency for Health Data Access and Management	National Legislation Related to Health Data Privacy or Protection
Australia	Yes	Yes	Yes
Austria	No	Partly	Yes
Belgium	Yes	Yes	Yes
Canada	Yes	Yes	Yes
Chile	No	No	Yes
Colombia	No	No	Yes
Costa Rica	No	No	Yes
Czechia	No	Yes	Yes
Denmark	Yes	Yes	Yes
Estonia	Yes	Yes	Yes
Finland	Yes	Yes	Yes
France	Yes	Yes	Yes
Germany	Yes	Yes	Yes
Greece	No	No	Yes
Hungary	Yes	No	Yes
Iceland	Yes	Yes	Yes
Ireland	Partly	Yes	Yes
Israel	Yes	Yes	Yes
Italy	Yes	Partly	Yes
Japan	No	No	Yes
Korea	Yes	No	Yes
Latvia	Yes	Partly	Yes
Lithuania	Yes	Partly	Yes
Luxembourg	Partly	Partly	Yes
Mexico	No	No	Yes
Netherlands	Partly	Yes	Yes
New Zealand	Yes	No	Yes
Norway	Yes	Yes	Yes
Poland	Yes	Yes	Yes
Portugal	Partly	Yes	Yes
Slovak Republic	Yes	Yes	Yes
Slovenia	Yes	Yes	Yes
Spain	Yes	Partly	Yes
Sweden	Yes	Yes	Yes
Switzerland	No	No	Yes
Türkiye	Yes	N/A	Yes
United Kingdom	Yes	Yes	Yes
United States	N/A	Partly	Yes

Cataloguing data assets: In line with the OECD Recommendation on Enhancing Access to and Sharing of Data (OECD, 2021[33]), many members are strengthening national approaches to cataloguing health data assets to improve discoverability, interoperability, and responsible analytic use (OECD, 2025[34]).

Across the OECD, 24 countries have established national approaches to cataloguing significant health data (see Table 3.3). As leading practices, Türkiye’s e‑Nabiz system managed by the Ministry of Health centralised its digital platform systematically collecting and organising secure access to a range of health data (EIPA, 2024[35]). This standardisation, interoperability and patient access enables data-driven decision making which supports continuity of care and lays a foundation for responsible (EIPA, 2024[35]). In Slovenia, the Act on Databases in Health provides the legal foundation for the National Institute of Public Health to authorise the collection, management, and use of diverse health datasets (NIJZ, 2022[36]). These datasets are made readily accessible through a centralised data portal, supporting transparency, interoperability, and evidence‑based decision making across the health system (NIJZ, 2022[36]). Denmark’s health data system, enabled by a national civil registration number, offers high-quality, linkable and comprehensive health datasets. Managed by the Danish Health Data Authority, its platforms eSunhed and Research Health Data Getaway support secure access, enabling evidence‑based research and policy through nationally co‑ordinated data infrastructure (Ministry of Foreign Affairs of Denmark, 2022[37]; eSundhed, 2025[38]; Danish Health Data Authority, 2025[39]). In April 2025, it was announced that a new national one point of entry portal, backed by the Novo Nordisk Foundation will further streamline access and analysis, strengthening Denmark’s leadership in health data and innovation (Nordic Life Science, 2025[40]).

Established under the 2019 Act on the Secondary Use of Health and Social Data, Findata serves as Finland’s central data permit authority (Ministry of Social Affairs and Health, 2019[41]). The act enables secure access to data across public and private health entities and requires all key data controllers to produce standardised metadata. Finland’s national approach demonstrates transparency, privacy, and streamlined secondary use of health data (FINDATA, 2025[42]). In France, the Health Data Hub has maintained a national catalogue of health datasets since 2019, supporting discoverability and secure access for authorised analytic uses of health data (Health Data Hub, 2025[43]).

Meanwhile, four countries, Ireland, Luxembourg, the Netherlands and Portugal are advancing efforts to build a national metadata catalogue. The Netherlands is advancing efforts to create a national metadata catalogue for health data. While data remains decentralised, institutions like the National Institute for Public Health and the Environment (RIVM) and Health-RI maintain individual health data catalogues. Work is underway to harmonise these using standards like DCAT-AP, improving data discoverability and interoperability (TEHDAS, 2025[44]).

Health data access bodies: In the EU, the EHDS proposes the creation of Health Data Access Bodies (HDABs) in each Member State and EEA countries by 2027 (European Commission, 2024[28]). These entities will act as national authorities responsible for granting and monitoring access to electronic health data for analytic uses, such as research, innovation, policymaking, and the development of digital health and AI solutions. HDABs are designed to function as both gatekeepers and enablers. They ensure compliance with data protection laws such as the EU’s GDPR, while facilitating AI development by overcoming fragmented data systems and enabling access to high-quality, pseudonymised or anonymised datasets. This dual role represents a leading practice that is critical for the safe scaling of AI in healthcare (European Union, 2018[17]).

According to Article 37 of the EHDS, HDABs are tasked with evaluating data access applications, issuing permits, ensuring secure processing environments, and maintaining transparent public registries (European Commission, 2024[28]). They must also disclose information on approved data uses, protections for individual rights, and resulting outcomes. Additionally, HDABs support cross-border research through the HealthData@EU infrastructure, collaborate with ethics bodies and supervisory authorities, and enable innovation through mechanisms such as regulatory sandboxes (European Union, 2025[45]).

In the developing landscape across OECD countries, HDABs are defined as a central agency for data access and management in which the identified organisation may be formally suitable to be HDABs under the EHDS. HDABs serve as a trusted umbrella arching entity that oversees the regulatory, secure, and ethical use and sharing of health data for research, innovation, public health, and policy development. Currently, 20 countries have established or designated a HDAB under the OECD definition, while seven countries – Austria, Italy, Latvia, Lithuania, Luxembourg, Spain and the United States – are making substantial efforts in designating a central authority (see Table 3.3). In Belgium, the Health Data Agency (HDA) co‑ordinates regional and federal stakeholders to facilitate secure and transparent data use for research and policy (Health Data Agency, 2025[46]). Canada’s Data Access Support Hub (DASH) serves as a national portal to harmonise access to multi-regional health and administrative data (Health Data Research Network Canada, 2025[47]). Australia’s National Health Data Hub (NHDH) consolidates pseudonymised, linked datasets to support evidence‑based policymaking (Australian Institute of Health and Welfare, 2025[48]). In Germany, the Health Data Use Act (GDNG), which entered into force in 2024, establishes the legal foundation for enhanced use of health data and empowers the creation of a national HDAB (Bundesministerium der Justiz und für Verbraucherschutz, 2024[49]). In the United States, the Trusted Exchange Framework and Common Agreement (TEFCA) is a federated health data sharing infrastructure, with planned expansion into analytic data use (ONC, 2025[50]).

The absence of good data governance risks innovation being hindered by legal uncertainty, data silos, and risk-averse culture. Conversely, models like EHDS’s HDAB may provide balance between innovation and individual rights providing a scalable, ethical, and legally compliant foundation for AI in health (European Commission, 2024[28]). Developing national procedures for cataloguing health data involve standardised methods to manage and organise datasets for improved discoverability and access. This includes developing metadata catalogues which support interoperability and compliant health data access for analytic use within and cross border (Scheider and Mallick, 2025[51]; González-García et al., 2021[52]).

Privacy and protection: Privacy and data protection frameworks are long-established regulatory frameworks that apply to AI but were not created for it. These frameworks form the foundation of trustworthy, lawful and transparent data use, as reflected in the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (OECD, 2002[53]). Building on the 1995 EU Data Protection Directive (European Union, 1995[54]), the GDPR has been in force across the EU since 2016 and provides comprehensive cross sector regulation protection for personal data, including health data (European Union, 2018[17]). Other examples include the United States’ Health Insurance Portability and Accountability Act (HIPAA), which was established in 1996 (U.S. Department of Health and Human Services, 2024[55])l; in Switzerland where the Federal Act on Data Protection (FADP), which mentions that all health-related personal data are considered as “sensitive personal data” thus requiring highest level of protection (Swiss Federal Chancellery, 2020[56]); the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada (Office of the Privacy Commissioner of Canada, 2000[57]); and Japan’s Act on the Protection of Personal Information (APPI) (Japanese Government, 2003[58]). Many of these data privacy and protection acts are not health-specific; however, have health-specific provisions in their design.

Penalties for privacy infringements are long-standing features of data protection frameworks, applying across all sectors and types of data. The severity of penalties and enforcement capacity have increased in recent years, rather than introducing new or health-specific measures. Within the EU, the GDPR establishes penalties of up to EUR 20 million or 4% of global turnover for unauthorised access, processing or the loss of any type of personal data (European Union, 2018[17]). The EHDS builds on this regulation, reinforcing existing enforcement mechanisms, including penalties for attempts to re‑identify anonymised data (European Commission, 2024[28]). Similarly, in Australia, amendments to the Privacy Act in 2022 increased penalties up to AUD 2.5 million for a repeated or serious offence (Australian Government, 2024[59]).

Enabling the use of AI

Advances in AI are accelerating at an unprecedented rate, and health is no different. AI in health is evolving, with new publications and technologies emerging in the field daily. To support health administrators, healthcare providers, researchers, industry, and the public to make the best use of this technology, a signal is needed to cut through the noise and support AI to “scale fast while doing no harm”. This section will examine progress with legislation, health technology assessments (HTAs), regulatory sandboxes, procurement, and approval of medical devices.

Table 3.4. Practices enabling the use of AI

	National Legislation Related to AI	National Legislation Specific to AI in Health	National Approach to Health Technology Assessments to Include AI	National Approach for a Regulatory Sandbox for AI in Health	Adapted National Procurement to Account for AI in Health	National Approach to Approval of Medical Devices incorporating AI
Australia	No	No	Partly	No	Yes	Yes
Austria	Partly	No	Partly	Partly	No	Partly
Belgium	Partly	No	Yes	Partly	N/A	Yes
Canada	Partly	No	Partly	No	Partly	Yes
Chile	Partly	No	No	Partly	No	No
Colombia	Partly	No	No	No	No	No
Costa Rica	Partly	No	No	No	No	No
Czechia	Partly	No	No	Partly	No	Partly
Denmark	Yes	No	Yes	Yes	Yes	Yes
Estonia	Partly	No	Partly	Partly	Partly	Yes
Finland	Partly	Partly	Yes	Yes	Partly	Yes
France	Partly	Yes	Yes	Partly	Partly	Partly
Germany	Partly	No	Yes	No	No	Partly
Greece	Partly	No	N/A	No	N/A	Partly
Hungary	Partly	No	N/A	N/A	N/A	Partly
Iceland	No	No	No	No	No	Yes
Ireland	Partly	No	Yes	Partly	Partly	Partly
Israel	No	No	N/A	Partly	No	Yes
Italy	Yes	Partly	Partly	Partly	Partly	Partly
Japan	Yes	No	N/A	Yes	N/A	Yes
Korea	Partly	No	Yes	Partly	N/A	Yes
Latvia	Partly	No	No	Partly	No	Partly
Lithuania	Partly	No	No	Partly	N/A	Yes
Luxembourg	Partly	No	No	Yes	N/A	Yes
Mexico	Partly	No	No	No	No	No
Netherlands	Partly	No	Partly	No	No	Yes
New Zealand	No	No	Partly	Partly	N/A	No
Norway	Partly	No	No	Yes	Yes	Yes
Poland	Partly	No	Yes	Partly	N/A	Yes
Portugal	Partly	No	N/A	No	N/A	Yes
Slovak Republic	Partly	No	N/A	No	No	Partly
Slovenia	Partly	No	No	No	N/A	Yes
Spain	Partly	Partly	No	Yes	N/A	Yes
Sweden	Partly	No	Partly	Partly	No	Yes
Switzerland	Partly	No	No	No	No	Yes
Türkiye	Partly	No	N/A	No	N/A	Yes
United Kingdom	Partly	No	Yes	Yes	Yes	Yes
United States	Partly	No	N/A	No	No	Yes

Legislation for AI: When looking at legislation, the EU AI Act is an emerging leading practice, and 22 countries are in the process of adopting national legislation to compliment the EU AI Act (See Table 3.4) (European Union, 2024[60]). The AI Act was adopted in June 2024 and represents a first of its kind of regulation across OECD countries (European Union, 2024[60]).

Of the EU Countries, Italy has adopted a national AI Act, provisions and Delegations to the government on Artificial Intelligence, which came into effect in October 2025 and Denmark designated national authorities and oversight of the AI Act in May 2025 (Della Repubblica Italiana, 2025[61]; FOLKETINGET, 2024[62]). Outside of the EU, Japan enacted the Act on the Promotion of Research, Development and Utilisation of Artificial Intelligence‑Related Technologies into force in September 2025 to accelerate innovation and responsible use of AI within the country (Government of Japan, 2025[63]). Following the example of the AI Act, the remaining EU countries are looking to enact the legislation at a national level.

An additional 11 OECD countries are working towards AI legislation, such as Canada with the former Artificial Intelligence and Data Act (AIDA) which was introduced to the government in 2021, but was not passed into law (Government of Canada, 2023[64]). The United Kingdom and Norway are well underway in adopting an AI legislation following the example of the EU AI Act, with the countries projecting that the legislation will be passed into law in 2026 (UK Parliament, 2025[65]; Ministry of Digitalisation and Public Governance, 2025[66]).

Another avenue to enable countries to unleash the potential of AI in health is to update health legislation to incorporate AI specific topics, such as protecting patients’ rights, fostering trust, establishing accountabilities and addressing data skewness. France has moved towards this with revisions to the 2021 Bioethics Law for healthcare providers to share information with patients when using AI and to require mandatory human oversight for any AI in decision making (République Française, 2021[67]). These actions legislate the safeguarding of human rights while accounting for the need for advancement in AI within health (See Table 3.4).

Health Technology Assessments: Many countries are also updating their Health Technology Assessment (HTA) frameworks to evaluate AI’s clinical relevance, cost-effectiveness, transparency, and long-term safety. These include Belgium, Denmark, France, Finland, Germany, Ireland, Korea, Poland and the United Kingdom (See Table 3.4). An additional eight countries – Australia, Austria, Canada, Estonia, Italy, the Netherlands, New Zealand, and Sweden are in process.

As a leading practice based on the German DiGA blueprint, France’s PECAN (La prize en charge anticipée numérique) scheme provides a fast-track, one year derogatory reimbursement for mature digital health and remote monitoring solutions, enabling developers to validate benefits while the solution is already reimbursed and in use (G_NIUS, 2025[68]; Olesch Artur, 2024[69]). In Belgium, the Belgian Parliament called for the creation of a fast-track approval and reimbursement pathway. The Belgian National Institute for Health and Disability Insurance (NIHDI) introduced a new evaluation process for health applications, including AI-enabled solutions aiming for reimbursement decisions within 270 days (iclg, 2025[70]). Germany’s DiGA Fast-Track enables rapid reimbursement of certified digital health applications, including AI-driven tools, that demonstrate positive health impact (GTAI, 2025[71]; Schmidt et al., 2024[72]). In Finland, the Ministry of Social Affairs and Health commissioned the development of a dedicated Digi-HTA assessment model designed for digital health technologies which included AI and robotics (Haverinen et al., 2024[73]). Korea has introduced changes in the coverage of advanced medical technologies, where health insurance will include advanced medical technologies such as digital therapeutics and AI-based diagnostics (Ministry of Food and Drug Safety, 2023[74]; Kao and Lakhanpal, 2024[75]).

Regulatory sandboxes: Regulatory sandboxes complement MDR by offering controlled environments where AI tools can be tested in real-world settings under regulatory supervision. These frameworks enable responsible experimentation while providing regulators with critical oversight in a secure, structured context. Across OECD countries this is becoming an emerging practice, with countries like Denmark, Finland, Japan, Luxembourg, Norway, Spain and the United Kingdom having established a sandbox designated for AI in health. In the United Kingdom, the Medicines and Healthcare Products Regulatory Agency (MHRA) recently launched its AI Airlock, marking the country’s first regulatory sandbox for AI in health (CMC Medical Devices, 2025[76]). In Denmark, the Danish Data Protection Authority in collaboration with the Danish Agency for Digitalisation, launched a regulatory sandbox specifically for AI with the aim to reduce time from development to operation (Datatilsynet, 2024[77]). Similarly, countries such as Korea and Poland are actively developing sandbox models to support safe and adaptive AI integration in healthcare (Healthcare Poland, 2024[78]; Chambers and Partners, 2024[79]), (see Table 3.4 for more detail).

Procurement: Procurement serves as a primary governance “gate” and key enabler, shaping which AI tools and solutions are introduced into healthcare environments. Through strategic procurement practices, governments can then set expectations for ethical standards, technical robustness, interoperability, data protection, and clinical relevance before products reach health providers. Across the OECD, countries such as Australia, Denmark, Norway and the United Kingdom have incorporated procurement to account for AI in health (See Table 3.4). Six other countries – Canada, Estonia, Finland, France, Ireland and Italy are still in initial stages but are taking steps towards its integration.

The United Kingdom stands out as a leading example having recently launched a GBP 150 million tender to integrate AI into the NHS, prioritising diagnostics, early disease detection, and operational efficiency with the objective to enhance healthcare delivery, reduce costs, and improve patient outcomes (Phil Taylor, 2025[80]).

Medical device regulation: Following procurement, Medical Device Regulation (MDR) oversees the legal framework to monitor the safety and performance of AI-embedded medical technologies. A key component of MDR is to also provide the levels of risk and classification of medical and non-medical solutions. Integrating AI-specific risk classification into MDR, as already done by 23 OECD countries, ensures that adaptive AI solutions meet clinical effectiveness, safety, and regulatory standards (See Table 3.4). Notably, Ireland and France are currently incorporating oversight for AI within MDR (Scannell and Moore, 2025[81]; Ministère des Solidarités et de la Santé, 2025[82]).

Crucially, MDR is being extended to post-market surveillance, ensuring that AI tools continuously perform safely after deployment. Belgium’s Federal Agency for Medicines and Health Products (FAMHP) framework includes a direction for post-market surveillance to consider any adaptations required (Q-Reg, 2025[83]).

Capacity and capability among the health workforce

Capacity and capability are foundational to the responsible scale of AI in health, ensuring that technologies are not only technically sound but also ethically grounded, operationally viable, and operate with multi-stakeholder engagement throughout the AI lifecycle. This section examines progress of OECD countries in advancing these objectives through targeted workforce developments to build awareness.

Table 3.5. Enabling capacity and capability of health workforce

	National Approach to Improve Health Workforce Awareness and/or Competency
Australia	Yes
Austria	No
Belgium	Partly
Canada	Partly
Chile	Partly
Colombia	Partly
Costa Rica	Partly
Czechia	Yes
Denmark	Yes
Estonia	Yes
Finland	Yes
France	Yes
Germany	Partly
Greece	No
Hungary	Partly
Iceland	No
Ireland	Partly
Israel	Partly
Italy	Partly
Japan	Partly
Korea	Yes
Latvia	Yes
Lithuania	N/A
Luxembourg	Partly
Mexico	Partly
Netherlands	Partly
New Zealand	Yes
Norway	Partly
Poland	Partly
Portugal	No
Slovak Republic	No
Slovenia	N/A
Spain	Partly
Sweden	Yes
Switzerland	No
Türkiye	N/A
United Kingdom	Yes
United States	Partly

Note: Countries were assessed at a national level. Regional or local initiatives in the absence of a national initiative are categorised as “partly”.

Building awareness and capability: Across the OECD, 11 countries have established a national strategy and/or programme aimed at strengthening its health workforce (See Table 3.5). Denmark’s national pilot project CAIDX which aims to strengthen capacity building for clinicians and develop training tools to help healthcare professionals become more confident in utilising AI tools in health (Danish Life Science Cluster, 2025[84]). Australia has set the stage for a national programme with the introduction of a strategic plan for upskilling healthcare professionals in digital competencies, including AI (Australian Digital Health Agency, 2025[85]) Eighteen countries are taking significant steps in developing national approaches (See Table 3.5). Additionally, Estonia is now expanding foundational AI literacy through the national AI Leap 2025 program, targeting 20 000 high school students and training 3 000 teachers (TI-Hüpe, 2025[86]).

Table 3.6. Components of national AI capacity building in health across OECD countries

	France	Korea	Germany	Latvia	Belgium
AI Courses Included in Medical School Curricula	Yes	Yes	Partly	Partly	Partly
Mandatory AI Courses Included in Medical School Curricula	Yes	Yes	Partly	Partly	Partly
Training For Practicing Frontline Healthcare Professionals	Yes	No	Partly	Yes	Partly
Training Programmes with Build-in Mechanisms for Feedback Performance Evaluation and Improvement	N/A	No	Partly	No	Partly

Note: Countries were assessed at a national level. Regional or local initiatives in the absence of a national initiative are categorised as “partly”.

Source: OECD Interviews.

Building capacity: Building capacity and trust in AI is essential to support healthcare providers in adopting and effectively leveraging AI in their practice, and consequently reinforcing public trust in its use, such as the autonomous applications of AI to support the provision of care. Leading practices among OECD countries include the integration of national AI curricula in medical education, as well as implementation of national upskilling training programmes with built-in mechanisms to assess the effectiveness of AI solutions to ensure continuous improvement (OECD, Forthcoming, 2026). Some countries have made significant progress in this regard (see Table 3.6). France has mandated AI and digital health training across all health professional programmes starting in the 2025‑2026 academic year, backed by EUR 119 million to train 500 000 professionals over five years (Comité interministériel de l’Intelligence artificielle, 2025[87]). In Korea, the future health workforce are being equipped with AI competencies through the Medical Bio AI Education programme, which has been integrated into medical curriculum (Ministry of Health and Welfare, 2025[88]). Germany offers certified AI training through its national KI-Campus platform and is advancing plans for a national Masters in Digital Medicine, although national mandates remain absent and implementation is fragmented (KI-Campus, 2022[89]). Latvia supports healthcare upskilling through regional and NGO-led initiatives, including RSU’s AI courses and the Riga TechGirls program, aligned with objectives under its Digital Health Strategy 2029 (Digital Health Uptake, 2025[90]). At the Belgium Flanders AI Research Institute (FARI), AI for the Common Good has launched its training for medical professions, designed to bridge the gap between AI technology and healthcare by educating medical professionals on the application, benefits, and ethical considerations of AI in the medical field (FARI, 2025[91]).These examples highlight varying degrees of institutional maturity and national co‑ordination in AI capacity building across the allied healthcare sector.

Oversight bodies

National oversight bodies, which ensure AI solutions are developed, implemented, and monitored in ways that are effective, safe, ethical, and aligned with the interests of the public good, are guardrails to the responsible scale of AI in health. This section will review progress in establishing formal national oversight bodies to co‑ordinate AI initiatives in the health sector.

Table 3.7. State of AI in health oversight

	Established National Oversight Body for the Use of AI in Health
Australia	Partly
Austria	No
Belgium	Yes
Canada	Partly
Chile	No
Colombia	No
Costa Rica	No
Czechia	No
Denmark	No
Estonia	No
Finland	No
France	Yes
Germany	No
Greece	No
Hungary	N/A
Iceland	N/A
Ireland	N/A
Israel	No
Italy	Partly
Japan	No
Korea	Partly
Latvia	Partly
Lithuania	No
Luxembourg	Yes
Mexico	No
Netherlands	No
New Zealand	Yes
Norway	Yes
Poland	No
Portugal	No
Slovak Republic	No
Slovenia	No
Spain	Yes
Sweden	Partly
Switzerland	No
Türkiye	No
United Kingdom	Yes
United States	Partly

Oversight: Among OECD countries, Belgium, France, Luxembourg, New Zealand, Norway, Spain and the United Kingdom have established a national oversight body, while an additional seven countries (Australia, Canada, Italy, Korea, Latvia Sweden, and the United States) are actively working towards a similar national body (see Table 3.7). New Zealand represents an emerging practice with the National Artificial Intelligence and Algorithm Expert Advisory Group (NAIAEAG). This group oversees AI use within Health New Zealand (Te Whatu Ora), focussing on AI related risk including skewness and inaccuracies (Health New Zealand/ Te Whatu Ora, 2025[92]). In the United Kingdom, the NHS AI Safety Lab provides guidance and regulation to ensure safe AI tools are brought into the NHS while also supporting their deployment (NHS England, 2025[93]). Additionally in the United Kingdom, the Medicines and Healthcare products Regulatory Agency (MHRA) has set out its strategic approach to its regulatory role in AI and providing additional overnight on a national level (GOV.UK, 2024[94]). Luxembourg has also recently progressed in this area through bill n°8 476 to align with the EU AI Act, named the Agency for Medicines and Health Products (ALMPS) as the designated national oversight body for AI in health, specifically for AI systems in medical devices and in vitro diagnostic tools (Elisabeth Margue, 2024[95]; Arendt, 2025[96]).

Public engagement

In building trust with the public, there are opportunities to build public awareness and capability to know how and when to leverage AI solutions – as well as how to choose AI solutions that are fit-for-purpose and clinically validated. Further, enabling the integration of AI solutions while ensuring appropriate safeguards are in place requires careful design to balance individual and community health data rights (OECD, 2025[34]). Public engagement serves essential functions to build capacity and trust.

Table 3.8. State of public engagement for AI in health

	Public Engagement Initiative(s) to Increase Public Understanding of the Capabilities and Usage of AI in Health	Public Assembly for the Design of AI
Australia	Partly	Yes
Austria	No	No
Belgium	No	Yes
Canada	Yes	Partly
Chile	Yes	No
Colombia	No	No
Costa Rica	No	No
Czechia	Partly	N/A
Denmark	Yes	Yes
Estonia	Yes	Yes
Finland	Yes	Yes
France	Yes	Yes
Germany	Yes	Yes
Greece	No	No
Hungary	No	N/A
Iceland	Yes	No
Ireland	No	Yes
Israel	No	No
Italy	Partly	Partly
Japan	Yes	Yes
Korea	Yes	Partly
Latvia	No	No
Lithuania	No	Yes
Luxembourg	Yes	Yes
Mexico	No	No
Netherlands	Yes	No
New Zealand	Yes	Yes
Norway	No	Yes
Poland	No	No
Portugal	No	No
Slovak Republic	Partly	No
Slovenia	Partly	No
Spain	Partly	Yes
Sweden	Yes	No
Switzerland	No	Partly
Türkiye	No	N/A
United Kingdom	Yes	Yes
United States	No	Yes

Note: Countries were assessed at a national level. Regional or local initiatives in the absence of a national initiative are categorised as “partly”.

Building public understanding: Public engagement builds public capacity to critically assess, understand, and ultimately leads to building trust in the use of AI technologies. Trust is not generated by technical performance alone; it emerges through transparency, accountability, and the visible inclusion of public voices throughout the AI lifecycle. When the public recognises that AI solutions reflect collective input, not just expert-driven design, their approach shifts to trust, adopt, and further support these technologies.

Public assemblies: Public assemblies directly inform the design and operationalisation of AI solutions by involving the public in the design of policy solutions, ensuring they are socially responsive and ethically grounded. These efforts also reinforce guardrails by promoting person-centred, rights-based governance. A practice leveraged for meaningful consultation with the public is the establishment of public assemblies.

Across the OECD, member countries are advancing at different paces. Fifteen OECD countries have developed national public engagement initiatives which were aimed at increasing public understanding, alongside 16 countries which have established a formal public engagement platform for the design of AI (see Table 3.8). Among those countries, Denmark has embedded public panels into national AI ethics and health data strategies (Smarter Together Association, 2023[97]). Finland’s AuroraAI programme systematically involves the public in co-designing AI-driven healthcare services (Finnish Government, 2020[98]). Lithuania’s E‑Pilietis portal and initiatives like Kurk Lietuvai formally integrate public feedback into digital health and AI policymaking (Office of the Government of the Republic of Lithuania, 2025[99]). Norway’s Board of Technology fosters public and expert collaboration in scenario planning and system design for digital health services (Teknologirådet, 2025[100]). While approaches vary, these efforts collectively demonstrate an emerging commitment to democratising AI governance and reinforcing societal trust.

Transparent engagement processes further strengthen institutional accountability by challenging industry and policymakers to make their objectives, assumptions, and anticipated impacts clearer. This transparency is fundamental to achieving equitable AI outcomes, higher levels of adoption, sustainability and ultimately, scalability of AI solutions – as highlighted in our AI in Health Policy Checklist.

Priorities for the responsible scale of AI in health

There is an opportunity for a proactive approach that meets at the convergence of healthcare and AI. Today, only 18% of OECD countries have adopted a national strategy or action plan specific to healthcare. Progress is being made as a further 32% are working towards this objective.

This analysis also highlights possible priorities for action to advance the responsible scale of AI in Health (See Table 3.9):

• An oversight body for the use of AI in health (18%)

• Streamlining the national approach to health technology assessments to include AI (24%),

• Establishing a national approach to regulatory sandbox with a focus on AI in health (16%),

• Updating national procurement guidelines to account for AI in health (11%), and

• The establishment of national approach to improve AI in the health workforce (29%).

Table 3.9. Readiness for the responsible scale of AI in health by policy action

Policy Pillars	Policy Areas	Policy Action	Yes	Partly	No	N/A
Guardrails	Agreed objectives	National AI strategy or AI Action plan specific to health	18%	32%	50%	0%
		National AI strategy referencing Health	71%	8%	21%	0%
		Defined national approach for cloud-based resource availability for health	66%	8%	26%	0%
		Defined national interoperability strategy for health data	71%	21%	5%	3%
		Defined national digital security strategy for health	63%	11%	24%	3%
		Average %	58%	16%	25%	1%
Enabling Practices	Better use of health data	Set of national procedures for the cataloguing of significant health data assets	63%	11%	24%	3%
		Defined central agency for health data access and management	53%	18%	26%	3%
		National legislation related to health data privacy or protection	100%	0%	0%	0%
		Average %	72%	10%	17%	2%
Enabling Practices	Enabling the use of AI	National legislation related to AI	5%	84%	11%	0%
		National legislation specific to AI in health	3%	8%	89%	0%
		National approach to health technology assessments to Include AI	24%	21%	34%	21%
		National approach for a regulatory sandbox for AI in health	18%	39%	39%	3%
		Adapted national procurement to account for AI in health	11%	16%	39%	34%
		National approach to approval of medical devices incorporating AI	61%	26%	13%	0%
		Average %	20%	32%	38%	10%
Enabling Practices	Building capacity and capability	National approach to improve AI in health workforce awareness and/ or competency	29%	47%	16%	8%
Guardrails	Oversight, measurement and monitoring	Established national oversight body for the use of AI in health	18%	18%	55%	8%
Engagement	Public engagement	Public engagement initiative(s) to increase public understanding of the capabilities and usage of AI in health	39%	16%	45%	0%
		Public assembly for the design of AI	42%	11%	39%	8%
		Average %	41%	13%	42%	4%

Note: Cells are coloured green where > 66%; orange when between 65‑34%; grey when < 33%

Source: Based on OECD Survey on Health Data Governance, the Impact of Artificial Intelligence on the Health Workforce, and Interoperability. These analyses summarise Tables 3.1 to 3.8.

References

[96] Arendt (2025), New Luxembourg bill designates national authorities under the AI act: the CNPD takes centre stage - Arendt, https://www.arendt.com/news-insights/news/new-luxembourg-bill-designates-national-authorities-under-the-ai-act-the-cnpd-takes-centre-stage/ (accessed on 26 April 2025).

[85] Australian Digital Health Agency (2025), National Digital Health Workforce and Education Roadmap, https://www.digitalhealth.gov.au/healthcare-providers/initiatives-and-programs/workforce-capability (accessed on 16 March 2026).

[26] Australian Digital Health Agency (2023), Connecting Australian Healthcare, http://www.digitalhealth.gov.au (accessed on 30 April 2025).

[31] Australian Digital Health Agency (2022), Cyber Security Strategy 2022-2025, https://www.digitalhealth.gov.au/sites/default/files/documents/adha-cyber-security-strategy-2022-25.pdf (accessed on 30 April 2025).

[59] Australian Government (2024), Chapter 7: Civil penalties — serious or repeated interference with privacy and other penalty provisions | OAIC, https://www.oaic.gov.au/about-the-OAIC/our-regulatory-approach/guide-to-privacy-regulatory-action/chapter-7-privacy-assessments (accessed on 13 May 2025).

[48] Australian Institute of Health and Welfare (2025), National Health Data Hub, https://www.aihw.gov.au/reports-data/nhdh (accessed on 7 May 2025).

[49] Bundesministerium der Justiz und für Verbraucherschutz (2024), “Gesetz zur Nutzung von Gesundheitsdaten zu gemeinwohlorientierten Forschungszwecken und zur datenbasierten Weiterentwicklung des Gesundheitswesens”, https://www.gesetze-im-internet.de/gdng/BJNR0660B0024.html.

[18] Busch, F. et al. (2025), “AI regulation in healthcare around the world: what is the status quo?”, medRxiv, p. 2025.01.25.25321061, https://doi.org/10.1101/2025.01.25.25321061.

[27] Capurro, D. et al. (2017), “Chile’s National Center for Health Information Systems: A Public-Private Partnership to Foster Health Care Information Interoperability”, https://doi.org/10.3233/978-1-61499-830-3-693.

[79] Chambers and Partners (2024), Digital Healthcare 2024 - South Korea, https://practiceguides.chambers.com/practice-guides/digital-healthcare-2024/south-korea (accessed on 30 April 2025).

[15] Chile IA (2024), “Política Nacional de Inteligencia Artificial”, https://minciencia.gob.cl/uploads/filer_public/bc/38/bc389daf-4514-4306-867c-760ae7686e2c/documento_politica_ia_digital_.pdf (accessed on 26 April 2025).

[13] CIFAR (2023), Pan-Canadian AI Strategy, Canadian Institute for HealthResearch, https://cifar.ca/ai/impact/ (accessed on 27 September 2024).

[76] CMC Medical Devices (2025), AI and medical devices: The UK defines a new regulatory path, https://cmcmedicaldevices.com/ai-and-medical-devices-the-uk-defines-a-new-regulatory-path/ (accessed on 30 April 2025).

[87] Comité interministériel de l’Intelligence artificielle (2025), Faire de la France une puissance de l’IA, https://www.santementale.fr/2025/02/lintelligence-artificielle-au-benefice-du-systeme-de-sante-et-de-ses-acteurs/ (accessed on 29 April 2025).

[39] Danish Health Data Authority (2025), FAQ about Danish health data - The Danish Health Data Authority, https://english.sundhedsdatastyrelsen.dk/health-data-and-registers/health-data-denmark/faq-about-danish-health-data (accessed on 27 May 2025).

[84] Danish Life Science Cluster (2025), CAIDX - Clinical AI-based Diagnostics - Danish Life Science Cluster, https://www.danishlifesciencecluster.dk/en/project/caidx-clinical-ai-based-diagnostics/ (accessed on 28 May 2025).

[77] Datatilsynet (2024), New Regulatory Sandbox for AI, https://www.datatilsynet.dk/presse-og-nyheder/nyhedsarkiv/2024/mar/ny-regulatorisk-sandkasse-for-ai (accessed on 30 April 2025).

[61] Della Repubblica Italiana (2025), LEGGE 23 settembre 2025, n. 132. Disposizioni e deleghe al Governo in materia di intelligenza artificiale. (25G00143) (GU Serie Generale n.223 del 25-09-2025), https://www.gazzettaufficiale.it/atto/serie_generale/caricaDettaglioAtto/originario?atto.dataPubblicazioneGazzetta=2025-09-25&atto.codiceRedazionale=25G00143&elenco30giorni=false (accessed on 7 October 2025).

[8] Department of Health (2026), AI for Care - The Artificial Intelligence (AI) Strategy for Healthcare in Ireland 2026 - 2030, https://www.gov.ie/en/department-of-health/publications/ai-for-care-the-artificial-intelligence-ai-strategy-for-healthcare-in-ireland-2026-2030/, https://www.gov.ie/en/department-of-health/publications/ai-for-care-the-artificial-intelligence-ai-strategy-for-healthcare-in-ireland-2026-2030/ (accessed on 12 March 2026).

[4] Digifinland (2025), “AI Ecosystem in Social and Health Services (SOTE)-AI Vision 2035”, https://digifinland.fi/wp-content/uploads/2025/09/SOTE-AI-Ecosystem-AI-Vision-2035.pdf (accessed on 6 October 2025).

[90] Digital Health Uptake (2025), Digital Health Strategy 2019-2029, https://digitalhealthuptake.eu/radar-repository/digital-health-strategy-2019-2029-latvia/ (accessed on 7 May 2025).

[25] e-Estonia (2025), e-Health, https://e-estonia.com/solutions/e-health-2/e-health-records/ (accessed on 30 April 2025).

[35] EIPA (2024), e-Nabiz, https://www.eipa.eu/epsa/e-nabiz-electronic-and-personal-health-record-system/ (accessed on 27 May 2025).

[95] Elisabeth Margue (2024), Bill 8476, https://www.chd.lu/fr/dossier/8476 (accessed on 26 April 2025).

[38] eSundhed (2025), eHealth, https://www.esundhed.dk/ (accessed on 27 May 2025).

[28] European Commission (2024), European Health Data Space (EHDS), https://health.ec.europa.eu/ehealth-digital-health-and-care/european-health-data-space_en.

[45] European Union (2025), HealthData@EU, https://acceptance.data.health.europa.eu/home (accessed on 6 May 2025).

[60] European Union (2024), “Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 an”, https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng.

[17] European Union (2018), General Data Protection Regulation (GDPR) – Legal Text, https://gdpr-info.eu/ (accessed on 26 April 2025).

[54] European Union (1995), “Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data”, https://eur-lex.europa.eu/eli/dir/1995/46/oj/eng (accessed on 14 October 2025).

[91] FARI (2025), FARI rolls out AI Academy with an AI Introduction for the Medical Professions - Fari Institute, https://www.fari.brussels/news-and-media-article/fari-rolls-out-ai-academy-with-an-ai-introduction-for-the-medical-professions (accessed on 28 May 2025).

[42] FINDATA (2025), What is Findata? - Findata, https://findata.fi/en/faq/what-is-findata/ (accessed on 27 May 2025).

[98] Finnish Government (2020), AuroraAI Programme, https://valtioneuvosto.fi/en/projects-and-legislation/project?tunnus=VM098:00/2020 (accessed on 30 April 2025).

[62] FOLKETINGET (2024), L 154 Forslag til lov om supplerende bestemmelser til forordningen om kunstig intelligens., https://www.ft.dk/samling/20241/lovforslag/l154/index.htm (accessed on 7 October 2025).

[68] G_NIUS (2025), Prise en charge anticipée numérique (PECAN) | G_NIUS, https://gnius.esante.gouv.fr/fr/financements/fiches-remboursement/prise-en-charge-anticipee-numerique-pecan (accessed on 6 May 2025).

[52] González-García, J. et al. (2021), “Catalogue of EHDS services for secondary use of health data Catalogue of EHDS services for secondary use of health data 1 (12) 0 Document info 0.1 Authors Author Partner 0.2 Keywords”, http://www.tehdas.eu. (accessed on 27 May 2025).

[94] GOV.UK (2024), MHRA’s AI regulatory strategy ensures patient safety and industry innovation into 2030 - GOV.UK, https://www.gov.uk/government/news/mhras-ai-regulatory-strategy-ensures-patient-safety-and-industry-innovation-into-2030 (accessed on 26 April 2025).

[12] Government of Canada (2025), Pan-Canadian AI for Health (AI4H) Guiding Principles - Canada.ca, https://www.canada.ca/en/health-canada/corporate/transparency/health-agreements/pan-canadian-ai-guiding-principles.html, https://www.canada.ca/en/health-canada/corporate/transparency/health-agreements/pan-canadian-ai-guiding-principles.html (accessed on 30 June 2025).

[64] Government of Canada (2023), “Artificial Intelligence and Data Act”, https://ised-isde.canada.ca/site/innovation-better-canada/en/artificial-intelligence-and-data-act.

[19] Government of Ireland (2024), Digital for Care: A Digital Health Framework for Ireland 2024-2030, https://www.gov.ie/en/department-of-health/publications/digital-for-care-a-digital-health-framework-for-ireland-2024-2030/ (accessed on 9 May 2025).

[63] Government of Japan (2025), 人工知能関連技術の研究開発及び活用の推進に関する法律 | e-Gov 法令検索, https://laws.e-gov.go.jp/law/507AC0000000053, https://laws.e-gov.go.jp/law/507AC0000000053 (accessed on 2 March 2026).

[71] GTAI (2025), The Digital Health Market in Germany, https://www.gtai.de/en/invest/industries/healthcare-market-germany/digital-health (accessed on 7 May 2025).

[73] Haverinen, J. et al. (2024), “Finnish Digi-HTA Assessment Model for Digital Health and an International Comparison”, Communications in Computer and Information Science, Vol. 2084 CCIS, pp. 309-321, https://doi.org/10.1007/978-3-031-59091-7_20/TABLES/2.

[46] Health Data Agency (2025), Health Data Agency, https://www.hda.belgium.be/en/about_us (accessed on 7 May 2025).

[43] Health Data Hub (2025), Health Data Hub, https://www.health-data-hub.fr/ (accessed on 14 October 2025).

[47] Health Data Research Network Canada (2025), DASH | HDRN Canada, https://hdrn.ca/en/dash/about-dash/ (accessed on 7 May 2025).

[92] Health New Zealand/ Te Whatu Ora (2025), Artificial Intelligence and Algorithm Expert Advisory Group – Health New Zealand | Te Whatu Ora, https://www.tewhatuora.govt.nz/corporate-information/about-us/expert-groups/artificial-intelligence-and-algorithm-expert-advisory-group (accessed on 26 May 2025).

[78] Healthcare Poland (2024), The Role of Healthcare Poland in Shaping Poland’s Digitalization Strategy, https://healthcarepoland.pl/the-role-of-healthcare-poland-in-shaping-polands-digitalization-strategy/ (accessed on 30 April 2025).

[3] Helsedirektoratet (2025), Joint AI plan for the safe and effective use of AI in the Norwegian health and care services 2024 - 2025 - Helsedirektoratet, https://www.helsedirektoratet.no/rapporter/joint-ai-plan-for-the-safe-and-effective-use-of-ai-in-the-norwegian-health-and-care-services-2024-2025 (accessed on 26 April 2025).

[70] iclg (2025), Digital Health Laws and Regulations Report 2025 Belgium, https://iclg.com/practice-areas/digital-health-laws-and-regulations/belgium (accessed on 7 May 2025).

[58] Japanese Government (2003), Act on the Protection of Personal Information Act No. 57 of ( 2003), https://www.cas.go.jp/jp/seisaku/hourei/data/APPI.pdf.

[21] Kanta.fi (2024), What are the Kanta Services?, https://www.kanta.fi/en/what-are-kanta-services (accessed on 30 April 2025).

[75] Kao, C. and S. Lakhanpal (2024), “Health Technology Assessment (HTA) for Medical Devices in Asia Pacific 2. Contextualising HTA for Medical Devices in APAC”, https://apacmed.org/wp-content/uploads/2024/04/HTA-for-medical-devices-in-Asia-Pacific_FINAL.pdf (accessed on 30 April 2025).

[16] Kedi, W., C. Ejimuda and M. Dayo Ajegbile (2024), “Cloud computing in healthcare: A comprehensive review of data storage and analysis solutions”, World Journal of Advanced Engineering Technology and Sciences, Vol. 2024/02, pp. 290-298, https://doi.org/10.30574/wjaets.2024.12.2.0291.

[89] KI-Campus (2022), Erste zertifizierte Online-Kurse zu KI in der Medizin | AI Campus, https://ki-campus.org/press/zertifizierte-medizin-kurse (accessed on 29 April 2025).

[23] MedCom (1994), Om os - MedCom, https://medcom.dk/om-os/ (accessed on 30 April 2025).

[14] MinCiencia (2025), “Política Nacional de Inteligencia Artificial y Plan de Acción”, https://www.minciencia.gob.cl/areas/inteligencia-artificial/Inteligencia-Artificial/politica-Nacional-Inteligencia-Artificial-Plan-Accion/ (accessed on 26 April 2025).

[82] Ministère des Solidarités et de la Santé (2025), État des lieux de l’intelligence artificielle en santé, https://sante.gouv.fr/actualites/presse/communiques-de-presse/article/publication-de-l-etat-des-lieux-de-l-intelligence-artificielle-ia-en-sante-en (accessed on 30 April 2025).

[5] Ministère du Travail de la Santé et des Solidarités (2025), “Stratégie intelligence artificielle et données de santé”, https://sante.gouv.fr/IMG/pdf/strategie_donnees_et_intelligence_artificielle.pdf (accessed on 3 October 2025).

[6] Ministerio De Sanidad (2025), Artificial Intelligence Strategy for the National Health System. eIASNS, https://www.sanidad.gob.es/en/areas/saludDigital/doc/eIASNS_en.pdf, https://www.sanidad.gob.es/en/areas/saludDigital/doc/eIASNS_en.pdf (accessed on 3 March 2026).

[66] Ministry of Digitalisation and Public Governance, N. (2025), “Paving the way for safe and innovative use of AI in Norway”, https://www.regjeringen.no/en/aktuelt/gjor-norge-klar-for-trygg-og-innovativ-ki-bruk/id3093081/ (accessed on 26 April 2025).

[74] Ministry of Food and Drug Safety (2023), Guidance on the Review and Approval of Artificial Intelligence (AI)-based Medical Devices, https://www.mfds.go.kr/eng/brd/m_40/view.do?seq=72627 (accessed on 30 April 2025).

[37] Ministry of Foreign Affairs of Denmark (2022), New national Danish Research Health Data Gateway assists researchers with accessing data, https://investindk.com/insights/new-national-danish-research-health-data-gateway-assists-researchers-with-accessing-data (accessed on 27 May 2025).

[10] Ministry of Health and Family Welfare (2026), Strategy for Artificial Intelligence in Healthcare for India (SAHI), https://www.ictworks.org/wp-content/uploads/2026/02/India-Strategy-for-Artificial-Intelligence-in-Healthcare.pdf (accessed on 3 March 2026).

[88] Ministry of Health and Welfare, R. (2025), Promoting the training of more than 1,000 talents in the fields of AI diagnosis and prediction, new drug development, and medical device development for 5 years, https://www.mohw.go.kr/board.es?act=view&bid=0027&cg_code=&list_no=1487140&mid=a10503010100&tag (accessed on 16 March 2026).

[41] Ministry of Social Affairs and Health (2019), Act on the Secondary Use of Health and Social Data, https://stm.fi/documents/1271139/1365571/The+Act+on+the+Secondary+Use+of+Health+and+Social+Data/a2bca08c-d067-3e54-45d1-18096de0ed76/The+Act+on+the+Secondary+Use+of+Health+and+Social+Data.pdf.

[2] MOHW (2024), 인공지능 기반 의료기술 혁신으로 국민건강 증진 < 일반 < 보도자료 < 알림 : 힘이 되는 평생 친구, 보건복지부, https://www.mohw.go.kr/board.es?mid=a10503010200&bid=0027&act=view&list_no=1483021&tag=&nPage=1 (accessed on 26 April 2025).

[93] NHS England (2025), NHS AI Lab, NHS Transformation Directorate, https://transform.england.nhs.uk/ai-lab/ (accessed on 15 April 2025).

[20] NHS England Digital (2025), NHS Cloud Policies and Guidance, https://digital.nhs.uk/services/cloud-centre-of-excellence/strategy/nhs-cloud-policies-and-guidance (accessed on 7 May 2025).

[36] NIJZ (2022), Podatki | Nijz, https://nijz.si/podatki/ (accessed on 27 May 2025).

[32] NLCS (2022), The Netherlands Cybersecurity Strategy 2022-2028, National Coordinator for Counterterrorism and Security (NCTV), https://english.nctv.nl/topics/netherlands-cybersecurity-strategy-2022-2028/documents/publications/2022/12/06/the-netherlands-cybersecurity-strategy-2022-2028 (accessed on 30 April 2025).

[40] Nordic Life Science (2025), New Danish national gateway to health data, https://nordiclifescience.org/new-danish-national-gateway-to-health-data/ (accessed on 27 May 2025).

[34] OECD (2025), “Facilitating the secondary use of health data for public interest purposes across borders”, OECD Digital Economy Papers, No. 376, OECD Publishing, Paris, https://doi.org/10.1787/d7b90d15-en.

[1] OECD (2025), Progress in Implementing the European Union Coordinated Plan on Artificial Intelligence (Volume 1): Member States’ Actions, OECD Publishing, Paris, https://doi.org/10.1787/533c355d-en.

[33] OECD (2021), “Recommendation of the Council on Enhancing Access to and Sharing of Data”, https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0463 (accessed on 14 October 2025).

[53] OECD (2002), OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, OECD Publishing, Paris, https://doi.org/10.1787/9789264196391-en.

[99] Office of the Government of the Republic of Lithuania (2025), E-pilietis, https://epilietis.lrv.lt/lt/ (accessed on 30 April 2025).

[57] Office of the Privacy Commissioner of Canada (2000), The Personal Information Protection and Electronic Documents Act (PIPEDA) - Office of the Privacy Commissioner of Canada, https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/ (accessed on 26 April 2025).

[69] Olesch Artur (2024), PECAN: France’s fast-track scheme for digital health applications, https://icthealth.org/news/pecan-frances-fast-track-scheme-for-digital-health-applications (accessed on 7 May 2025).

[50] ONC (2025), TEFCA, https://www.healthit.gov/topic/interoperability/policy/trusted-exchange-framework-and-common-agreement-tefca (accessed on 7 May 2025).

[11] OPMCSA (2023), “REPORT: Capturing the benefits of AI in healthcare for Aotearoa New Zealand - Full report - December 2023 - Office of the Prime Minister’s Chief Science Advisor”, https://doi.org/10.17608/k6.OPMCSA.24814101.

[80] Phil Taylor (2025), UK kicks off £150m tender process for healthcare AI | pharmaphorum, https://pharmaphorum.com/news/uk-kicks-ps150m-tender-process-healthcare-ai (accessed on 29 April 2025).

[83] Q-Reg (2025), Belgium Regulatory Process for Medical Devices, https://qreg.co.uk/belgium-regulatory-requirements/ (accessed on 30 April 2025).

[67] République Française (2021), LOI n° 2021-1017 du 2 août 2021 relative à la bioéthique (1) - Légifrance, https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000043884384 (accessed on 26 April 2025).

[9] Salut Generalitat de Cataluyay (2025), Salut IA - Sistema de Salut de Catalunya, https://iasalut.cat/en/ (accessed on 26 April 2025).

[81] Scannell, B. and L. Moore (2025), Ireland Appoints Its AI Act Competent Authorities - WILLIAM FRY, https://www.williamfry.com/knowledge/ireland-appoints-its-ai-act-competent-authorities/ (accessed on 30 April 2025).

[51] Scheider, S. and M. Mallick (2025), “Exploring Metadata Catalogs in Health Care Data Ecosystems: Taxonomy Development Study”, JMIR Formative Research, Vol. 9, https://doi.org/10.2196/63396.

[72] Schmidt, L. et al. (2024), “The three-year evolution of Germany’s Digital Therapeutics reimbursement program and its path forward”, npj Digital Medicine, Vol. 7/1, pp. 1-8, https://doi.org/10.1038/s41746-024-01137-1.

[97] Smarter Together Association (2023), Citizen sourcing local health policy with AI assisted idea curation - Smarter Together, https://smarter-together.org/story/reinventing-local-government-through-collective-intelligence-and-artificial-intelligence-how-a-danish-municipality-harnessed-citizen-insights/ (accessed on 30 April 2025).

[22] Sundhed.dk (2024), Background: Danish eHealth Portal, https://www.sundhed.dk/borger/service/om-sundheddk/om-organisationen/ehealth-in-denmark/background/ (accessed on 9 March 2026).

[30] Sutherland, E. et al. (2023), “Fast-Track on digital security in health”, OECD Health Working Papers, No. 164, OECD Publishing, Paris, https://doi.org/10.1787/c3357f9f-en.

[56] Swiss Federal Chancellery (2020), SR 235.1 - Federal Act of 25 September 2020 on D... | Fedlex, https://www.fedlex.admin.ch/eli/cc/2022/491/en (accessed on 26 April 2025).

[44] TEHDAS (2025), “Second Joint Action Towards the European Health Data Space – TEHDAS2”, https://tehdas.eu/ (accessed on 27 May 2025).

[100] Teknologirådet (2025), Fremsyn og involvering Arkiver, https://teknologiradet.no/category/fremtidstenkning-og-involvering/ (accessed on 30 April 2025).

[24] The Danish Health Data Authority (2025), Cyber and information security strategy, https://english.sundhedsdatastyrelsen.dk/cyber-security/cyber-and-information-security-strategy (accessed on 7 May 2025).

[29] The International Patient Summary (2025), The International Patient Summary – key health data, worldwide, https://international-patient-summary.net/ (accessed on 7 May 2025).

[86] TI-Hüpe (2025), Media – TI-Hüpe, https://www.aileap.ee/media (accessed on 29 April 2025).

[55] U.S. Department of Health and Human Services (2024), Health Information Privacy, https://www.hhs.gov/hipaa/index.html (accessed on 9 March 2026).

[65] UK Parliament (2025), Artificial Intelligence (Regulation) Bill [HL] - Parliamentary Bills - UK Parliament, https://bills.parliament.uk/bills/3942 (accessed on 26 April 2025).

[7] United States Department of Health and Human Services (2025), U.S. Department of Health and Human Services: Strategic Plan for the Use of Artificial Intelligence in Health, Human Services, and Public Health, https://irp.nih.gov/system/files/media/file/2025-03/2025-hhs-ai-strategic-plan_full_508.pdf (accessed on 26 April 2025).