{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,9]],"date-time":"2026-09-09T06:07:12Z","timestamp":1788934032242,"version":"build-2803163510"},"reference-count":45,"publisher":"Frontiers Media SA","license":[{"start":{"date-parts":[[2026,9,9]],"date-time":"2026-09-09T00:00:00Z","timestamp":1788912000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["frontiersin.org"],"crossmark-restriction":true},"short-container-title":["Front. Digit. Health"],"abstract":"<jats:p>Artificial intelligence (AI) is becoming an increasingly important component of healthcare, supporting diagnosis, clinical decision-making, medical imaging, triage, and patient-facing services. While these technologies offer significant opportunities to improve healthcare delivery, they also raise important questions about patient safety, fairness, privacy, transparency, cybersecurity, and accountability. This paper examines the regulatory framework governing medical AI in the European Union, focusing on the interaction between the Artificial Intelligence Act (AI Act), the Medical Device Regulation (MDR), the In Vitro Diagnostic Medical Device Regulation (IVDR), the General Data Protection Regulation (GDPR), and the European Health Data Space (EHDS). Drawing on doctrinal and conceptual regulatory analysis, it argues that many AI-enabled medical systems should be regulated through continuous lifecycle compliance rather than by relying primarily on a one-time assessment at market entry. The analysis identifies the training and validation dataset as a particularly important point of regulatory convergence, especially among the EHDS, GDPR, and AI Act data-governance requirements, and examines how responsibility is allocated across the general-purpose AI value chain under Article 25. Building on this analysis, the paper proposes a compliance-by-design framework that translates overlapping legal requirements into a set of auditable governance artefacts covering system classification, regulatory mapping, data governance, validation, human oversight, conformity assessment, post-market monitoring, and change control. The framework is illustrated through two contested use cases and complemented by recommendations tailored to the responsibilities of different stakeholder groups. The analysis incorporates Regulation (EU) 2026\/1744 (Digital Omnibus on AI), while recognising that supporting guidance, harmonised standards, and implementation of the EHDS continue to evolve and should be checked when the framework is applied. The framework is conceptually derived and illustrated through constructed use cases rather than empirically validated; future work should assess its usability, consistency, and discriminating power through structured expert assessment and Delphi-based consensus methods.<\/jats:p>","DOI":"10.3389\/fdgth.2026.1932256","type":"journal-article","created":{"date-parts":[[2026,9,9]],"date-time":"2026-09-09T05:47:35Z","timestamp":1788932855000},"update-policy":"https:\/\/doi.org\/10.3389\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Governing medical AI under the EU AI Act: an integrated compliance-by-design framework"],"prefix":"10.3389","volume":"8","author":[{"given":"Qaiser","family":"Khan","sequence":"first","affiliation":[{"name":"Empirical Software Engineering in Software, Systems and Services (M3S), Faculty of Information Technology and Electrical Engineering, University of Oulu","place":["Oulu, Finland"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Abdul Raffay","family":"Saeed","sequence":"additional","affiliation":[{"name":"Empirical Software Engineering in Software, Systems and Services (M3S), Faculty of Information Technology and Electrical Engineering, University of Oulu","place":["Oulu, Finland"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1965","published-online":{"date-parts":[[2026,9,9]]},"reference":[{"key":"B1","volume-title":"Ethics and Governance of Artificial Intelligence for Health: WHO Guidance","year":"2021"},{"key":"B2","volume-title":"Regulatory Considerations on Artificial Intelligence for Health","year":"2023"},{"key":"B3","doi-asserted-by":"publisher","first-page":"e081554","DOI":"10.1136\/bmj-2024-081554","article-title":"FUTURE-AI: international consensus guideline for trustworthy and deployable artificial intelligence in healthcare","volume":"388","author":"Lekadir","year":"2025","journal-title":"BMJ"},{"key":"B4","year":""},{"key":"B5","year":""},{"key":"B6","year":""},{"key":"B7","year":""},{"key":"B8","year":""},{"key":"B9","doi-asserted-by":"publisher","first-page":"237","DOI":"10.1038\/s41746-024-01232-3","article-title":"Navigating the EU AI act: implications for regulated digital medical products","volume":"7","author":"Aboy","year":"2024","journal-title":"npj Digit Med"},{"key":"B10","author":"Yeung","year":""},{"key":"B11","doi-asserted-by":"publisher","first-page":"1466","DOI":"10.2307\/1288556","article-title":"Enforced self-regulation: a new strategy for corporate crime control","volume":"80","author":"Braithwaite","year":"1982","journal-title":"Mich Law Rev"},{"key":"B12","year":""},{"key":"B13","doi-asserted-by":"publisher","first-page":"121","DOI":"10.1136\/amiajnl-2011-000089","article-title":"Automation bias: a systematic review of frequency, effect mediators, and mitigators","volume":"19","author":"Goddard","year":"2012","journal-title":"J Am Med Inform Assoc"},{"key":"B14","doi-asserted-by":"publisher","first-page":"1364","DOI":"10.1038\/s41591-020-1034-x","article-title":"Reporting guidelines for clinical trial reports for interventions involving artificial intelligence: the CONSORT-AI extension","volume":"26","author":"Liu","year":"2020","journal-title":"Nat Med"},{"key":"B15","doi-asserted-by":"publisher","first-page":"e070904","DOI":"10.1136\/bmj-2022-070904","article-title":"Reporting guideline for the early stage clinical evaluation of decision support systems driven by artificial intelligence: DECIDE-AI","volume":"377","author":"Vasey","year":"2022","journal-title":"BMJ"},{"key":"B16","doi-asserted-by":"publisher","first-page":"e200029","DOI":"10.1148\/ryai.2020200029","article-title":"Checklist for Artificial Intelligence in Medical Imaging (CLAIM): a guide for authors and reviewers","volume":"2","author":"Mongan","year":"2020","journal-title":"Radiol Artif Intell"},{"key":"B17","doi-asserted-by":"publisher","first-page":"e1002683","DOI":"10.1371\/journal.pmed.1002683","article-title":"Variable generalization performance of a deep learning model to detect pneumonia in chest radiographs: a cross-sectional study","volume":"15","author":"Zech","year":"2018","journal-title":"PLoS Med"},{"key":"B18","doi-asserted-by":"publisher","first-page":"e271","DOI":"10.1016\/S2589-7500(19)30123-2","article-title":"A comparison of deep learning performance against health-care professionals in detecting diseases from medical imaging: a systematic review and meta-analysis","volume":"1","author":"Liu","year":"2019","journal-title":"Lancet Digit Health"},{"key":"B19","doi-asserted-by":"publisher","first-page":"114","DOI":"10.1038\/s41746-024-01106-8","article-title":"Artificial intelligence in digital pathology: a systematic review and meta-analysis of diagnostic test accuracy","volume":"7","author":"McGenity","year":"2024","journal-title":"npj Digit Med"},{"key":"B20","volume-title":"Ethics and Governance of Artificial Intelligence for Health: Guidance on Large Multi-modal Models","year":"2025"},{"key":"B21","doi-asserted-by":"publisher","first-page":"258","DOI":"10.1038\/s41746-024-01258-7","article-title":"A framework for human evaluation of large language models in healthcare derived from literature review","volume":"7","author":"Tam","year":"2024","journal-title":"npj Digit Med"},{"key":"B22","year":""},{"key":"B23","year":""},{"key":"B24","year":""},{"key":"B25","year":""},{"key":"B26","year":""},{"key":"B27","doi-asserted-by":"publisher","first-page":"AIoa2501001","DOI":"10.1056\/AIoa2501001","article-title":"Automation bias in large language model\u2013assisted diagnostic reasoning among physicians trained in AI literacy\u2014a randomized clinical trial","volume":"3","author":"Qazi","year":"2026","journal-title":"N Engl J Med AI"},{"key":"B28","year":""},{"key":"B29","year":""},{"key":"B30","year":""},{"key":"B31","year":""},{"key":"B32","doi-asserted-by":"publisher","first-page":"3005","DOI":"10.3390\/biomedicines13123005","article-title":"Machine learning-enabled medical devices authorized by the US Food and Drug Administration in 2024: regulatory characteristics, predicate lineage, and transparency reporting","volume":"13","author":"Almarie","year":"2025","journal-title":"Biomedicines"},{"key":"B33","year":""},{"key":"B34","year":""},{"key":"B35","year":""},{"key":"B36","year":""},{"key":"B37","year":""},{"key":"B38","year":""},{"key":"B39","doi-asserted-by":"publisher","first-page":"e01","DOI":"10.15420\/ecr.2025.59","article-title":"Ethical, regulatory frameworks for artificial intelligence in clinical research: a European perspective on the artificial intelligence act for ethics committees and researchers","volume":"21","author":"Barucci","year":"2026","journal-title":"Eur Cardiol Rev"},{"key":"B40","author":"Mallardi","year":""},{"key":"B41","author":"Rosmarino","year":""},{"key":"B42","doi-asserted-by":"publisher","first-page":"181","DOI":"10.1111\/j.1467-9930.2010.00318.x","article-title":"Really responsive risk-based regulation","volume":"32","author":"Black","year":"2010","journal-title":"Law Policy"},{"key":"B43","year":""},{"key":"B44","year":""},{"key":"B45","year":""}],"container-title":["Frontiers in Digital Health"],"original-title":[],"link":[{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fdgth.2026.1932256\/full","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,9]],"date-time":"2026-09-09T05:47:36Z","timestamp":1788932856000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.frontiersin.org\/articles\/10.3389\/fdgth.2026.1932256\/full"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,9]]},"references-count":45,"alternative-id":["10.3389\/fdgth.2026.1932256"],"URL":"https:\/\/doi.org\/10.3389\/fdgth.2026.1932256","relation":{},"ISSN":["2673-253X"],"issn-type":[{"value":"2673-253X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,9]]},"article-number":"1932256"}}