Medical AI · Regulation, ethics & governance · Lesson 7 of 7

Liability and consent

Reviewed by Dr. Ram Kumar G, MBBS, MD (Internal Medicine), MPH (USA), on 2026-10-18 · Last updated 2026-10-18

Beginner
Clinical focus
About 25 minutes
Includes exercise

Before this lesson: Software as a Medical Device (SaMD)

In short

When AI contributes to harm, responsibility can fall on the clinician (judged against the standard of care), the organisation that deployed the tool, and the manufacturer (through product liability). In the EU, the revised Product Liability Directive explicitly covers software, including AI, for products placed on the market from 9 December 2026. Patients should generally be told when AI plays a meaningful role in their care, and in some places that is a legal requirement for AI-generated communications and chatbots. Clear documentation, contracts and governance protect both patients and clinicians.

You will learn to

Describe how clinician, organisational and product liability can apply to clinical AI
Explain how the standard of care shapes clinicians' risk when following or overriding AI
Summarise the EU's revised Product Liability Directive as it applies to software
Decide what patients should be told about AI in their care

Who can be responsible

General principles; details differ between legal systems.
Party	Basis	Typical questions
Clinician	Professional negligence: did care meet the standard expected of a reasonable clinician?	Was the AI used appropriately? Was its output checked? Was clinical judgement applied?
Organisation	Duties in choosing, deploying, training staff on and monitoring tools	Was the tool validated locally? Were staff trained? Were alerts and incidents acted on?
Manufacturer	Product liability for defects; regulatory obligations	Was the product defective? Were instructions and warnings adequate?

The clinician's position

Price, Gerke and Cohen (JAMA, 2019) analysed US law and suggested that, while AI is new, clinicians are most exposed when they deviate from the standard of care, for example by following an AI recommendation to give non-standard treatment that causes harm. As AI tools become accepted practice, the standard of care itself may change, and failing to use a validated tool could one day become a risk.

Use AI tools within their intended purpose and the organisation's approved use.
Document your own reasoning, especially when you accept or override an AI recommendation that affects care.
Report AI errors and near misses through incident systems.
Do not paste identifiable data into unapproved tools; data protection breaches are a separate liability.

Product liability for software in the EU

The EU's revised Product Liability Directive, (EU) 2024/2853, explicitly treats software, including AI systems and software updates, as products. It applies to products placed on the market from 9 December 2026, under national laws implementing it. People harmed by defective products can claim compensation without proving fault, and the directive eases the burden of proof in complex technical cases.

A separate proposed AI Liability Directive was withdrawn by the European Commission in 2025, so the revised Product Liability Directive and national fault-based rules remain the main routes.

What to tell patients

Ethics and, increasingly, law point toward telling patients when AI plays a meaningful role. Cohen has argued that the need to disclose depends on how significant the AI's role is and what a reasonable patient would want to know.

Situation	Common approach
Patient talks directly to an AI chatbot	Disclose that it is AI; in the EU this is required under the AI Act from August 2026
AI-drafted messages sent to patients	Disclose AI involvement; California law has required disclaimers on generative AI clinical communications not reviewed by a clinician since January 2025
Ambient recording of a consultation	Ask permission to record, explain how it is used, respect refusal
AI-assisted reading of an image or test, reviewed by a clinician	Explain in general terms in service information; discuss if the patient asks or if AI significantly shaped the decision
Research use of patient data for AI	Ethics approval and consent, or a lawful exemption under data protection law

Not legal or regulatory advice

This lesson explains regulation for learning purposes, as of October 2026. Rules and guidance change; whether a real product is a medical device, and how it is classified, depends on its intended purpose and needs qualified regulatory advice and the current official texts.

Organisational protections

Contracts with vendors that define responsibilities, data use, indemnity, incident reporting and the right to audit.
A register of AI tools in use, with intended purpose, owner, validation evidence and monitoring plan.
Clear policies on approved uses, staff training and how to report problems.
Professional indemnity or insurance arrangements that cover AI-assisted care.

Exercise

Analyse responsibility and disclosure for fictional AI-related incidents.

Data: Three fictional incident scenarios written for the notebook (Created for this course)

For each scenario, identify the clinician, organisation and manufacturer actions that contributed.
Decide what documentation would have helped each party show appropriate care.
Write a short patient-information statement explaining how AI is used in a diabetes clinic.
List the clauses you would want in a vendor contract for an AI decision-support tool.

The runnable notebook and worked solution will be published soon. You can work through the steps with the code on this page in the meantime.

Key takeaways

Clinicians, organisations and manufacturers can each be responsible when AI contributes to harm.
Clinicians are most exposed when deviating from the standard of care; document reasoning.
The EU's revised Product Liability Directive covers software and AI from 9 December 2026.
Tell patients when AI plays a meaningful role; for chatbots and some messages it is required.

Terms used: Ambient AI scribe, Intended purpose (intended use), SaMD (Software as a Medical Device)

FAQ

Who is liable if an AI tool makes a mistake?

It depends on the facts and the jurisdiction. The clinician may be liable if care fell below the standard expected, the organisation for how it deployed the tool, and the manufacturer if the product was defective.

Can I be blamed for following an AI recommendation?

Potentially, especially if the recommendation departed from standard care and you did not apply your own judgement. Use tools within their intended purpose and document your reasoning.

Do I have to tell patients I used AI?

Ethically, patients should be told when AI plays a meaningful role. Legally, disclosure is required in some situations, such as chatbots under the EU AI Act and certain AI-generated patient communications in California.

Does EU product liability cover software?

Yes. The revised Product Liability Directive (EU) 2024/2853 covers software, including AI systems, for products placed on the market from 9 December 2026.

What should a contract with an AI vendor cover?

Responsibilities, intended use, data use and protection, performance commitments, incident reporting, updates, audit rights, indemnity and what happens when the contract ends.

Sources

Educational content only. This material teaches methods; it is not clinical advice. Code, models and examples here are not validated medical devices and must not be used to make decisions about real patients without proper clinical validation, governance and any required regulatory approval. Examples use synthetic or openly licensed de-identified data only. Never paste identifiable patient information into public AI tools. Mentions of models, tools or vendors are for identification, not endorsement.