WHO Sets Regulatory Framework for Healthcare AI Systems

The WHO and the International Telecommunication Union have published a framework through their Focus Group on AI for Health outlining six regulatory consideration areas for AI systems in healthcare: documentation and transparency, total product lifecycle management, intended use and validation, data quality, privacy and data protection, and stakeholder engagement. The Working Group on Regulatory Considerations drew on regulators, policymakers, academics, and industry representatives across multiple jurisdictions to produce the guidance. The framework recommends a risk-tiered approach throughout an AI system's entire lifecycle, from pre-market development through post-market surveillance. For high-risk tools, randomized clinical trials are identified as the gold standard for clinical validation; for lower-risk applications, prospective real-world deployment trials with accepted comparators are considered appropriate. Documentation requirements, including training dataset composition, demographic representation, and performance metrics, must be transparently disclosed to users. On data and privacy, developers are directed to map applicable data protection regulations early in development, implement compliance programs addressing cybersecurity vulnerabilities and algorithmic bias, and build data ecosystems that enable sharing of quality sources. The framework explicitly flags underfitting, bias amplification, and cybersecurity threats as material risks requiring active management. The WHO working group acknowledges the guidance will require expansion as the technology evolves and calls on bodies including the International Medical Device Regulators Forum and the International Coalition of Medicines Regulatory Authorities to pursue regulatory convergence. Developers and regulators operating across jurisdictions should treat this as an early signal of converging international standards.