The European framework for trustworthy AI in healthcare — from the 7 HLEG criteria to the EU AI Act and practical application in clinical care and industry.
EU High-Level Expert Group on AI, 2019
The European framework for trustworthy AI — not as a compliance checklist, but as a basis for responsible healthcare decisions.[1,2]
“Trustworthy AI has three components, which should be met throughout the system’s entire life cycle: (1) it should be lawful, complying with all applicable laws and regulations; (2) it should be ethical, ensuring adherence to ethical principles and values; and (3) it should be robust, both from a technical and social perspective.”High-Level Expert Group on Artificial Intelligence,
The European framework for trustworthy AI — not as a compliance checklist, but as a basis for responsible healthcare decisions.[1,2]
AI should support human autonomy and professional judgment, not replace them. For high-risk systems, the EU AI Act requires appropriate human oversight: trained people must be able to understand, review and, where necessary, intervene in system outputs.[1][5]
Reliability, safety and robustness must be assessed throughout the life cycle. In regulated high-risk or medical-device contexts, monitoring is also part of the regulatory requirements.[1][5][9]
Health data require particular protection. Data protection, purpose limitation, data quality, access control and governance must be clarified before use.[1][3]
Clinicians must be able to understand and critically assess AI recommendations. Black-box systems can be ethically problematic in high-risk settings when explainability, traceability or accountability are missing.[1]
Training and validation data must be assessed for relevance, quality and representativeness. Known risks are illustrated by pulse oximetry[7] and algorithmic resource allocation.[4]
System impacts must be assessed: equity of care, resource distribution, participation and ecological sustainability.[1]
Responsibilities, auditability, documentation and escalation routes must be clearly defined from procurement through monitoring. Breaches of high-risk system obligations can be sanctioned under the EU AI Act.[1][5]
Regulatory classification
The ethical requirements for trustworthy AI are not only a guiding principle in Europe, but increasingly part of binding regulatory frameworks. For healthcare organizations, this means: Responsible AI must be demonstrably anchored in procurement, data protection, clinical evaluation, operation and monitoring.
Practical relevance
Responsible AI does not become effective through principle papers, but through concrete decisions before procurement, implementation and operation. For decision-makers, this means that benefit, risk, data basis, oversight and accountability must be clarified and demonstrably documented before go-live.
Before any AI procurement, it must be clear which care problem is being solved, what clinical or organizational benefit the system should provide and what risks arise. This includes determining whether a high-risk system or medical device is involved and what role the system will play in the workflow.[1][5]
Responsible AI requires an assessment of training and validation data: Which populations are represented, which groups are missing and which measurement or label biases are known? Gaps relating to age, sex, ethnicity, comorbidity or care context must be documented and considered in the risk assessment.[2][4][7][8]
Human oversight is not an abstract control idea. Before use, it must be clear who evaluates system outputs, who may override or stop them, what qualification is required and how decisions are documented. This keeps AI a support for professional judgment, not a replacement for it.[1][5]
Health data require particular protection. Before go-live, the legal basis, purpose limitation, access concept, deletion periods and data subject rights must be clarified; where a high risk is likely, a data protection impact assessment is required.[3]
A good test result before implementation is not enough. What matters is whether the system works safely, effectively and fairly in the organization’s own care context. Clinical validation, drift monitoring, deviation analysis and reporting routes must be planned before go-live and maintained during operation.[5][9]
Patients and staff need to know where AI is used, what role it plays and who remains professionally responsible. Transparency means not only disclosing AI use, but also communicating limitations, responsibilities and complaint or escalation routes in an understandable way.[1][5][6]
Deepening
The following table shows selected examples of bias types as described in the literature. It does not claim to be exhaustive.
| Bias type | Creation (example) | Consequence in healthcare |
|---|---|---|
| Data bias | Training and validation data incompletely represent relevant patient groups; age, sex, ethnicity, comorbidity and care context must therefore be explicitly assessed.[2] | Poorer diagnostic accuracy for underrepresented groups |
| Historical bias | AI learns from historical treatment and resource decisions — even if they were systemically unfair[4] | Reproducing and reinforcing past inequalities in resource allocation |
| Measurement bias | Pulse oximetry can more frequently miss occult hypoxemia in people with darker skin pigmentation.[7] | Incorrect measurements feed into AI recommendations; for oxygen saturation, this can become clinically dangerous. |
| Label bias | Diagnoses, coding and documentation practices in EHR data can transfer existing care disparities into training labels.[8] | The AI system adopts biases from clinical routine and scales them into future decisions. |
| Algorithmic bias | Proxy variables (e.g. health expenditure instead of disease severity) as target variable[4] | Systematic disadvantage of groups with historically less access to resources |
Implementation recommendation
Ethics in AI implementation is not a separate workstream — it must be built into strategic and operational work from the start. The following recommendations describe how the framework can be effectively implemented:
Every AI introductory discussion should be preceded by the question: What problem is really being solved? And is AI the right solution - or is it creating hype-driven activism with no clear benefit?
HITL is not only a regulatory obligation, but also a change management lever: employees who can override AI recommendations develop trust and competence more quickly in dealing with AI systems.
Before going live, a structured bias audit should be carried out: Which populations are represented in the training data? Where are known gaps and how are they documented?
Patients have the right to know when AI is being used in their treatment. Clinics and practices should make this communication proactive, understandable and low-threshold.
Responsibilities, escalation paths and monitoring protocols must be defined before go-live - not as subsequent documentation, but as an operational reality with clear responsibilities.
AI changes workflows, job profiles and power structures. These secondary effects on equity in care and employees should be explicitly addressed and evaluated in the planning.
Where does your organization stand digitally? In 10-15 minutes you can get a grounded assessment of your digital maturity & AI readiness — based on validated frameworks.
Bibliography
Unless otherwise stated, accessed: April 2026.