A policy brief from researchers at the WHO Regional Office for Europe and Aston University finds a major gap in healthcare AI accountability: only 8% of responding Member States have legal liability standards or official guidance, despite widespread use of clinical AI.

The survey covered 50 of 53 invited Member States; 64% reported using AI for clinical diagnostics and 50% had introduced conversational AI for patient assistance, while 92% said clear liability rules were essential and 43 countries cited legal uncertainty as a barrier to adoption.

Other governance safeguards are also scarce: 24% of countries have dedicated health-AI regulators, 10% offer formal complaint channels for harmed patients and 24% require baseline post-market monitoring; policies for certification, procurement and use, and auditing and impact documentation are similarly limited.

The brief says assigning responsibility is difficult because potential causes can span software developers, data suppliers, cloud and hardware providers, healthcare organizations and clinicians; opaque systems that change after deployment can make it hard to determine what failed and who caused harm.

It distinguishes three liability approaches: ordinary fault-based rules, fault-based rules with presumptions that shift evidentiary burdens, and strict liability, which generally requires claimants to show a defect and resulting harm rather than prove fault.

Evidence cited in the brief underscores the challenge: among 429 US safety reports, 25.2% were potentially linked to algorithm performance, while 34.5% lacked enough technical documentation to determine whether software was involved. In a separate study, pneumonia-detection models identified the originating hospital with up to 99.98% accuracy, suggesting they may have relied on image artifacts rather than disease features.

Human oversight does not remove the risk of error, since clinicians can be swayed by incorrect AI recommendations; in a mammography trial, such recommendations reduced diagnostic accuracy from 79.7% to 19.8% for inexperienced radiologists and from 82.3% to 45.5% for experienced radiologists.

European frameworks, including the EU AI Act and medical-device regulations, address product safety before market entry, but the brief says the region lacks a dedicated, harmonized regime for liability after healthcare AI causes harm. The revised Product Liability Directive 2024/2853 sets strict liability for economic operators and expands compensable harms, though its application to continuously retrained and widely deployed clinical AI remains uncertain; national application covers products deployed from December 9, 2026.

The authors call for clear laws assigning responsibilities among developers, healthcare organizations and clinicians, alongside stronger oversight authorities, standardized reporting of adverse events and near misses, and regulatory sandboxes and hospital-based assurance labs for prospective local validation.

They also recommend lifecycle surveillance, clinician reporting of real-world failures, shared audit and evaluation tools, and standards for dataset completeness, representativeness and annotation quality. Transparency should cover model design, training data, assumptions and governance, while avoiding excessive compliance costs or unfairly shifting blame onto individual clinicians.