Health AI regulation around the world: a 2026 tracker

What do health AI rules have in common across countries?

Two layers. A data protection law treats health data as a special or sensitive category, so you need explicit consent or another strong legal basis, tight security and breach reporting. On top, AI-specific rules are arriving: disclosure that users are talking to a machine, crisis protocols, protections for minors and, for higher-risk uses, documented risk management.

A third layer applies only if your product diagnoses, treats or monitors disease: medical device regulation. That brings clinical evidence and pre-market approval, and it is separate from everything below.

Health AI rules by market

Market	Data protection	AI-specific rules	Key dates
United States	HIPAA for covered entities and their vendors; FTC Health Breach Notification Rule for apps outside HIPAA	18 state chatbot laws (2025–26): disclosure, crisis protocols, minors	Tennessee 1 Jul 2026; Washington 1 Jan 2027
European Union	GDPR Article 9: health data is a special category	AI Act: transparency now; high-risk duties later	High-risk standalone 2 Dec 2027; in regulated products 2 Aug 2028
United Kingdom	UK GDPR and Data Protection Act 2018	No single AI law; MHRA regulates AI as a medical device	Ongoing
India	DPDP Act 2023 and DPDP Rules 2025	ICMR ethical guidelines for AI in healthcare (2023)	DPDP duties 13 May 2027
Saudi Arabia	Personal Data Protection Law, enforced by SDAIA; health data is sensitive	SDAIA AI ethics principles	Enforced since 14 Sep 2024
UAE	Federal PDPL; Federal Law No. 2 of 2019 on health data, with localisation rules	Emirate-level health authority policies	Ongoing
Singapore	PDPA	AI in Healthcare Guidelines from MOH, HSA and IHiS (2021)	Ongoing

What changed in the EU in 2026?

The EU adopted the Digital Omnibus on AI, which entered into force on 27 July 2026. It moved the AI Act’s high-risk obligations from 2 August 2026 to 2 December 2027 for standalone systems and 2 August 2028 for AI embedded in products covered by EU safety law, which includes medical devices. Rules on prohibited practices (since February 2025) and general-purpose AI models (since August 2025) were not delayed, and most transparency duties still apply.

What do the US state chatbot laws require?

Most of the 18 laws passed in 2025 and 2026 require three things: tell users clearly that they are talking to an AI, detect crisis and self-harm signals and hand off to real help, and add protections when the user may be a minor. Tennessee bars AI from presenting itself as a licensed mental-health professional from 1 July 2026. Washington’s law takes effect on 1 January 2027 and lets users sue companies directly.

What does India’s DPDP Act mean for health apps?

The DPDP Rules were notified on 13 November 2025. From 13 May 2027, companies must give clear notice, record consent before processing, protect data with reasonable security safeguards, report breaches to the Data Protection Board and affected users, and erase data once its purpose ends. Processing a child’s data needs verifiable parental consent. Penalties for security failures reach ₹250 crore.

How should a health AI team prepare?

1. Map where personal and health data flows, including prompts, logs and analytics.
2. Remove identifiers before data reaches a model wherever the use case allows.
3. Test behaviour, not just policy: disclosure, crisis handling, minors and medical accuracy, in every language you support.
4. Keep evidence: dated test reports and the test suite itself, so you can show what you checked and when.