AI for healthcare and life sciences
Patient and research data under GDPR and medical confidentiality.
Research
Context
Hospitals, insurers and life sciences companies hold the most sensitive personal data. AI can cut documentation and research work, if the data never leaves a controlled environment.
Hospitals, health insurers, pharma and medtech firms want AI, but EU law guards patient and research data closely. Lindstead sets out what must run in-house, which models qualify and what each system must meet.
Case study (anonymised): Clinical documentation AI at a regional hospital group A European regional hospital group, around 5,000 staff.
Need a first decision? The AI Sovereignty Scan covers readiness, regulation and hosting in ten working days.
EU health AI use outpaces strategy and training
The WHO Regional Office for Europe surveyed health authorities in all 27 EU Member States from June 2024 to March 2025. Clinical AI is widespread. Strategy and training lag behind.
Three in four EU health systems use AI diagnostics. One in nine has a national AI strategy for health.
Share of Member States reporting each item, EU27 compared with the full WHO European Region, %
¹ AI-assisted diagnostics, for example in radiology, dermatology or ophthalmology; includes established use, pilots and informal use (EU: 41% established, 33% piloting or informal). ² Conversational platforms (chatbots) for patient assistance. ³ AI training offered as part of in-service training requirements for health and related professionals. ⁴ National AI strategy specific to the health sector; most other EU states cover AI in a digital health or cross-sectoral AI strategy instead. ⁵ 50 of 53 WHO European Region Member States responded (94%), including all 27 EU Member States.
Source: WHO Regional Office for Europe, Artificial intelligence is reshaping health systems: state of readiness across the European Union, 20 April 2026
View data table
| Category | Series 1 | Series 2 |
|---|---|---|
| AI diagnostics¹ | 74% | 64% |
| Chatbots² | 63% | 50% |
| Private AI R&D | 74% | 64% |
| Staff AI training³ | 26% | 24% |
| Health AI strategy⁴ | 11% | 8% |
Series 1: EU27. Series 2: WHO European Region⁵. Unit: %
Challenges
Only about a quarter of Member States train health staff in AI. Hospitals, insurers and medtech firms cannot wait for national authorities. Each AI programme needs its own staff training and clear accountability.
- Patient data cannot travel freely Health data is a special category under GDPR Article 9, and large-scale processing needs an impact assessment first. US-owned AI services add CLOUD Act access to data stored anywhere. Every external tool needs a legal basis.
- Device or not a device Intended purpose decides. EU guidance puts software that only stores or transfers records outside the MDR, but a drug-interaction alert is a device. A wrong call means needless certification or an uncertified device in clinical use.
- Clinician time is the constraint Physicians are ageing, so documentation load limits capacity. A drafting tool that doctors must check line by line saves no time. Quality must be proven on the organisation's own letters.
- Security law already applies NIS2 rates healthcare providers, pharmaceutical manufacturers and medicinal product research as highly critical. The Dutch Cyberbeveiligingswet has applied since 15 August 2026, next to NEN 7510 and NEN 7513 access logging. AI that reads patient records inherits these duties.
- GMP rules for AI unsettled Draft EU GMP Annex 22 said probabilistic models such as large language models should stay out of critical GMP applications. The EMA is reconsidering after its 2025 consultation. Pharma teams plan against an unfinished standard.
Over a third of EU doctors are aged 55 or over
Just over a third of EU doctors were 55 or older in 2024, according to Eurostat. Ten Member States, including Italy, Poland and Belgium, exceeded 38%.
In ten EU countries over 38% of doctors are 55 or older. Bulgaria tops the list at 54.6%.
Share of physicians aged 55 or over in the total number of physicians, 2024, selected EU countries, %
¹ Eurostat estimate. Practising physicians, except Slovakia (professionally active) and Greece (licensed to practise). Selected countries shown; Luxembourg not available. Countries above 38% not shown: Estonia (45.1%), Czechia (40.1%), Lithuania (39.7%), Cyprus (38.3%).
Source: Eurostat, Healthcare personnel statistics: physicians (dataset hlth_rs_phys), reference year 2024, data extracted July 2026
View data table
| Category | Value | Group |
|---|---|---|
| Bulgaria | 54.6% | 1 |
| Latvia | 45.6% | 1 |
| Italy | 44.3% | 1 |
| Hungary | 44.3% | 1 |
| Poland | 40.1% | 1 |
| Belgium | 38.1% | 1 |
| France | 34.1% | 2 |
| Germany¹ | 32.2% | 2 |
| Spain¹ | 31.5% | 2 |
| Netherlands | 23.2% | 2 |
Group 1: Above 38% (one of ten such EU countries). Group 2: Below 38%. Unit: %.
Key regulation
Many doctors will reach retirement age within the next decade, while an ageing population needs more care. AI that cuts paperwork adds capacity. Its business case is clinician hours returned to patients.
| Framework | Relevance |
|---|---|
| GDPR | Health data is a special category under Article 9, with strict processing conditions. |
| EU AI Act | AI in regulated medical devices is high-risk, with obligations from 2 August 2028. |
| NIS2 | Healthcare providers are in scope. |
| European Health Data Space | Rules for the use and secondary use of electronic health data across the EU. |
How Lindstead helps
- AI strategy Workload map from ward to back office Lindstead sorts each use case by data sensitivity, device status, applicable rules and volume. The board gets a recommendation per use case: in-house, European cloud or external API.
- Regulation and risk Register mapped to GDPR, MDR and AI Act Lindstead registers each AI system with its data flows, impact assessment, device status, AI Act risk class, NIS2 duties and deadlines. Privacy, security and quality leads maintain it.
- Model selection Models tested on clinical language Lindstead tests open-weight models on de-identified samples of the organisation's own documents and checks each licence. The result is a scored shortlist with origin and supply-chain notes.
- Infrastructure and cost Cost case for in-house clinical AI Lindstead compares own servers, European cloud GPUs and external APIs over three years, sized on real volumes. The model shows where own hardware pays off.
- Deployment First use case inside the hospital network Lindstead takes one non-device use case, such as discharge letters, live on infrastructure the organisation controls. It includes access control, evaluation, record-level logging, audit documentation and handover.
- Model stewardship Watch on models, MDR guidance and GMP Lindstead checks new models, licence changes, Annex 22 and AI Act guidance every month. The board gets a quarterly note with recommended actions.
Case study (anonymised)
Clinical documentation AI at a regional hospital group
A European regional hospital group, around 5,000 staff
Specialists wanted help with discharge and referral letters, and some departments were testing AI informally. The data protection officer had stopped a US-hosted pilot.
The board asked what was allowed, what it would cost and where to start.
What Lindstead did
- Inventory and triage Lindstead mapped all AI use, including informal use. It sorted each use case by data sensitivity, volume and possible device status.
- Rules and risk Lindstead drafted impact assessment input and device qualifications. It mapped duties under the AI Act, the national NIS2 law and national health data security standards.
- Models and cost Clinicians scored three or four open-weight models on de-identified letters in the local language. Lindstead costed own servers, a European cloud and an external API over three years.
- Board decision paper Lindstead wrote a recommendation with options, costs and risks. It added a reference architecture and a phased roadmap.
What the client received
- AI register with device and risk classification
- Impact assessment input for discharge letters
- Model shortlist scored by clinicians on letters in the local language
- Three-year cost comparison: own servers, European cloud, API
- Board paper with reference architecture and phased roadmap
The decision
The board approved a supervised discharge letter pilot on infrastructure the group controls, with a named model and hosting option.
Use cases with unclear device status stayed closed.
Pharma uses AI at twice the rate of the wider economy
Eurostat's enterprise survey skips hospitals but covers pharmaceutical manufacturers. Their AI use has climbed steeply since 2023.
EU pharmaceutical manufacturers' AI use rose from 15.7% in 2021 to 41.3% in 2025, twice the rate of all enterprises.
Share of enterprises with 10 or more persons employed using at least one AI technology, EU27, %
¹ The 2025 questionnaire added AI for generating pictures, video or audio, which was not asked in 2024; no AI data were collected in 2022. ² NACE Rev. 2 division C21: manufacture of basic pharmaceutical products and pharmaceutical preparations. ³ Enterprises with 10 or more persons employed in NACE sections C to J, L to N and group 95.1, excluding the financial sector; health care providers (section Q) are outside the survey scope.
Source: Eurostat, Artificial intelligence by NACE Rev. 2 activity (isoc_eb_ain2), updated 15 June 2026; Eurostat news release, 11 December 2025
View data table
| Category | Series 1 | Series 2 | Series 3 |
|---|---|---|---|
| 2021 | 15.7% | 6.9% | 7.7% |
| 2023 | 17.3% | 6.8% | 8.1% |
| 2024 | 25.8% | 10.6% | 13.5% |
| 2025¹ | 41.3% | 17.3% | 20% |
Series 1: Pharmaceutical manufacturing². Series 2: All manufacturing. Series 3: All enterprises³. Unit: %
Opportunities
In 2025, 41.3% of EU pharmaceutical manufacturers used AI, against 17.3% in manufacturing and 20.0% across all enterprises. That raises the bar for life sciences rivals and suppliers. Most pharma firms still report no AI use.
- Discharge and referral letters Drafts from the patient record that the clinician reviews and signs. Running the model in-house keeps the full record inside the organisation.
- Research on controlled data Analysis of research and registry data in-house. From March 2029 the European Health Data Space allows secondary use, including training and testing algorithms, only in secure processing environments under a data permit.
- Claims and correspondence review Summaries of claims files and member correspondence for health insurer assessors, who keep the decision. Health data favours in-house or European hosting.
- Regulatory and quality documents Drafting and checking technical files, deviation reports and submissions for pharma and medtech, outside critical GMP decisions. Confidential product knowledge stays on own infrastructure.
Frequently asked questions
-
The main frameworks are:
- GDPR: Health data is a special category under Article 9, with strict processing conditions.
- EU AI Act: AI in regulated medical devices is high-risk, with obligations from 2 August 2028.
- NIS2: Healthcare providers are in scope.
- European Health Data Space: Rules for the use and secondary use of electronic health data across the EU.
-
Organisations in this sector most often face three issues:
- Patient data cannot travel freely: Health data is a special category under GDPR Article 9, and large-scale processing needs an impact assessment first. US-owned AI services add CLOUD Act access to data stored anywhere. Every external tool needs a legal basis.
- Device or not a device: Intended purpose decides. EU guidance puts software that only stores or transfers records outside the MDR, but a drug-interaction alert is a device. A wrong call means needless certification or an uncertified device in clinical use.
- Clinician time is the constraint: Physicians are ageing, so documentation load limits capacity. A drafting tool that doctors must check line by line saves no time. Quality must be proven on the organisation's own letters.
- Security law already applies: NIS2 rates healthcare providers, pharmaceutical manufacturers and medicinal product research as highly critical. The Dutch Cyberbeveiligingswet has applied since 15 August 2026, next to NEN 7510 and NEN 7513 access logging. AI that reads patient records inherits these duties.
- GMP rules for AI unsettled: Draft EU GMP Annex 22 said probabilistic models such as large language models should stay out of critical GMP applications. The EMA is reconsidering after its 2025 consultation. Pharma teams plan against an unfinished standard.
-
The use cases with the clearest value are:
- Discharge and referral letters: Drafts from the patient record that the clinician reviews and signs. Running the model in-house keeps the full record inside the organisation.
- Research on controlled data: Analysis of research and registry data in-house. From March 2029 the European Health Data Space allows secondary use, including training and testing algorithms, only in secure processing environments under a data permit.
- Claims and correspondence review: Summaries of claims files and member correspondence for health insurer assessors, who keep the decision. Health data favours in-house or European hosting.
- Regulatory and quality documents: Drafting and checking technical files, deviation reports and submissions for pharma and medtech, outside critical GMP decisions. Confidential product knowledge stays on own infrastructure.
-
Yes. Open-weight models can run on-premise or in a European private cloud, which keeps data and model access under the organisation's control. Whether that is cheaper than an external API depends on sustained volume, and whether it is required depends on data sensitivity and regulation. Lindstead's break-even analysis shows the volume at which own infrastructure pays off.
-
Intended purpose decides. Under MDCG 2019-11 (revised June 2025), tools that only store, transfer or format records fall outside the MDR. Tools that suggest dosages or flag interactions can be devices. A drafting tool with the clinician as author usually falls outside, depending on its claims. AI in a device needing notified body assessment is high-risk under the AI Act from 2 August 2028.
-
Health data is a special category under GDPR Article 9, so large-scale processing needs a data protection impact assessment first. The European Data Protection Board said in December 2024 that such a model is not automatically anonymous. From March 2029 the European Health Data Space adds a permit route for training and testing algorithms in secure processing environments.
-
Life and health insurance risk assessment and pricing, and emergency healthcare patient triage, are high-risk under the AI Act. After the Digital Omnibus, Regulation (EU) 2026/1744, these duties apply from 2 December 2027. Medical devices and other regulated products follow on 2 August 2028. None apply yet.
Related research
- Open-weight models for on-premise use
- Where Should Your AI Run? The 2026 European Briefing
- Self-hosting or API: where is the break-even point?
Sources
- European Commission, European Health Data Space Regulation (EHDS), accessed September 2026
- Regulation (EU) 2025/327 (EHDS), Article 53: purposes for secondary use
- Official Journal of the EU, Regulation (EU) 2026/1744 (Digital Omnibus on AI), July 2026
- Mayer Brown, EU AI Act news: Digital Omnibus on AI, July 2026
- EU AI Act, Annex III: high-risk AI systems, point 5
- EU AI Act, Article 6: classification rules for high-risk AI systems
- Medical Device Coordination Group, MDCG 2019-11 rev. 1: qualification and classification of software, June 2025
- GDPR, Article 9: processing of special categories of personal data
- GDPR, Article 35: data protection impact assessment
- European Data Protection Board, Opinion on AI models and GDPR principles, 18 December 2024
- US Department of Justice, The Purpose and Impact of the CLOUD Act (white paper), April 2019
- DLA Piper, NIS2 series part 1: application to the life sciences sector, 28 October 2024
- NISD2, NIS2 for healthcare organisations
- Rijksoverheid, Cyberbeveiligingswet en Wet weerbaarheid kritieke entiteiten vanaf 15 augustus 2026 van kracht, 7 July 2026
- Inspectie Gezondheidszorg en Jeugd, Vragen over NEN 7510
- Besluit elektronische gegevensverwerking door zorgaanbieders, articles 3 and 5
- European Medicines Agency, GMP multistakeholder workshop on Annex 22 (artificial intelligence), 30 June to 1 July 2026
- European Commission, Stakeholders' consultation on EudraLex Volume 4: Chapter 4, Annex 11 and new Annex 22, 2025
- Eurostat, Healthcare personnel statistics: physicians, July 2026
Discuss the priorities in healthcare and life sciences.
A 30-minute meeting covers the use case, sector requirements and next step.