22 Chapters, One Question: Barry Solaiman on What the World’s Legal Systems Get Right and Wrong About AI in Healthcare
Q1. You and your co-editor I. Glenn Cohen brought together a genuinely international collection of legal experts spanning Asia, Europe, and the US, examining both major religious and secular ethical traditions alongside legal frameworks. That is an unusually ambitious scope for a single handbook. What was the most surprising thing you learned in the process of assembling and editing this volume — something about how different legal and ethical traditions actually approach AI in healthcare that you did not fully appreciate before you started compiling contributions from such a genuinely global set of scholars?
Perhaps the most surprising discovery came towards the end of the project, and rather ironically, it concerned developments that had been right under my nose all along.
When we began assembling the handbook, our attention naturally gravitated towards the jurisdictions traditionally associated with technological innovation and regulation, including the United States, Europe, Singapore, South Korea and China. At the time, I was based in Qatar, and I had taken responsibility, alongside two co-authors, for a chapter examining developments across the Gulf Cooperation Council (GCC) countries. I actually left that chapter until quite late in the process, partly because I assumed there would be relatively little to cover.
How wrong I was. When I finally began working on it, I discovered that some of the most interesting and innovative approaches to healthcare AI governance were emerging in the Gulf itself.
This also connected closely with my own work at the time. I was leading a research grant at my university to develop guidelines for AI in healthcare research and development in collaboration with Qatar’s Ministry of Public Health.[1] I subsequently explored developments in Saudi Arabia’s regulation of medical devices, as well as emerging AI governance policies in Dubai and Abu Dhabi, which I found particularly interesting.[2]
What struck me was how easily we can overlook important regulatory developments simply because they are happening outside the jurisdictions we instinctively regard as leaders in the field.
That experience has had a lasting influence on my research. In particular, it helped shape my subsequent scholarship advocating a genuine lifecycle approach to healthcare AI governance, one that looks beyond isolated regulatory interventions and considers how these technologies should be governed throughout their development, deployment and continued use.[3]
——————————
Q2. As co-editor, you had to find a coherent throughline across 22 chapters written by different legal experts working in different jurisdictions with different legal traditions. What did you discover to be the deepest fault line in how countries are approaching AI governance in healthcare — is it primarily a difference in regulatory philosophy, in how liability is assigned, in cultural or religious attitudes toward data and autonomy, or something else entirely that cuts across the more obvious East-West or common-law-versus-civil-law divisions?
I think the deepest fault line is actually a rather mundane one. It is the disconnect between the legal challenges that healthcare AI presents and what regulators are actually doing to address them.
When we structured the handbook, we deliberately began by identifying six major areas of legal concern: discrimination and bias, privacy, data security, informed consent, medical liability and intellectual property. We then examined broader ethical questions before turning to a comparative analysis of developments across different jurisdictions.
What struck me was just how disconnected these two sides of the discussion often were. While legal scholars were identifying these fundamental challenges, much of the regulatory activity focused on adapting existing medical device frameworks to accommodate AI. These frameworks tend to emphasise technical requirements, such as safety, performance and conformity assessment, without necessarily addressing the wider legal questions we had identified in any systematic way.
The EU AI Act represents an important development, but it is a cross-sectoral instrument rather than a framework designed specifically around the legal complexities of healthcare.
Interestingly, I don’t think the traditional distinctions between East and West, common law and civil law, or even different cultural and religious traditions were the defining issue. There are certainly cultural differences in attitudes towards privacy, autonomy and confidentiality, and the consequences of disclosing sensitive medical information may differ considerably between societies. Nevertheless, many of the underlying principles of medical law, including the importance of patient confidentiality, are widely recognised across jurisdictions.
What emerged instead was a much more fundamental problem: a technocratic approach to regulation that concentrates heavily on the technology itself, while giving insufficient attention to the rights of patients and the legal protections and remedies they need.
That disconnect remains, in my view, one of the central challenges in healthcare AI governance. Much of my subsequent research has been concerned with how we might bridge that gap, moving beyond technical compliance towards a more comprehensive approach that takes established principles of medical law seriously throughout the AI lifecycle.
——————————
Q3. The book addresses bias, privacy, data security, medical liability, informed consent, and intellectual property as distinct legal and ethical challenges — but in practice, these issues are deeply entangled with one another in any real AI healthcare deployment. Having synthesized contributions across all of these areas, which of these challenges do you now believe is the most legally and ethically unresolved — the one where the current state of law across most jurisdictions is genuinely inadequate to the reality of how AI is actually being deployed in clinical settings today?
I think the difficulty is that almost all of these issues remain unresolved to some degree. But three stand out to me in particular.
The first is discrimination and bias. We still lack sufficiently clear and concrete requirements concerning the data used to develop and train healthcare AI systems. If a system is intended to be used on a particular patient population, we need to ask whether the underlying training and validation data are actually representative of that population. Otherwise, how confident can we be that the system will perform effectively and safely for the patients it is supposed to serve? I think there is considerable work still to be done in translating concerns about algorithmic bias into meaningful legal and regulatory obligations.
The second is liability, particularly the responsibility of AI developers. Much of the legal discussion has focused on the potential liability of doctors and hospitals when AI systems contribute to patient harm. AI is generally treated as a tool, and existing principles of medical negligence can potentially apply to its use. But what about the developers themselves? In my view, existing approaches to tort liability can make it unnecessarily difficult to hold developers accountable, despite the considerable influence they exercise over how these systems are designed, trained and brought to market. I find that increasingly difficult to justify. We need clearer routes to developer accountability and more effective remedies for patients harmed by these technologies.
The third is informed consent, which I think raises some particularly difficult and debatable questions. We have not fully resolved what happens to informed consent when AI becomes involved in the doctor-patient relationship. For example, if a doctor cannot adequately understand or critically assess an AI-generated recommendation, to what extent can they meaningfully explain that recommendation to a patient? And what does that mean for the patient’s ability to make a genuinely informed decision about their care? I don’t think the answers are straightforward, and there is reasonable disagreement about how far existing legal principles can accommodate these situations.
For me, these three issues illustrate a broader problem. Healthcare AI is changing how clinical decisions are made, but the law has not yet fully addressed what those changes mean for fairness, accountability and patient autonomy.
——————————
Q4. You hold a Fellowship in Bioethics from Harvard Medical School’s Center for Bioethics and led a multidisciplinary grant that developed Qatar’s first national guidelines for AI in healthcare research — giving you direct, hands-on experience translating exactly the kind of comparative legal analysis in this handbook into an actual national policy framework. What is the most important lesson from that Qatar experience about the gap between what a rigorous academic legal analysis identifies as necessary and what a country’s regulators and healthcare institutions are actually capable of implementing in practice?
There is inevitably a gap between what academic legal analysis tells us should happen and what is politically and practically achievable. Working closely with policymakers, not only in Qatar but in other countries as well, has taught me that regulatory progress can only move at the pace that institutions and the people working within them can realistically manage.
One of the most important lessons I’ve learned is to approach policymaking with a degree of humility. As academics, we can sometimes enter these discussions with a long list of things we think need fixing. But I think the more useful question to ask is: where can I actually add value?
That starts with listening. When you sit down with people in government, it’s important to understand their priorities, the constraints they’re working under and what they’re trying to achieve. Often, the questions they ask are particularly revealing, because they tell you a great deal about what is practically possible and where your expertise might be most useful.
I’ve also come to appreciate the value of incremental progress. We might aspire to comprehensive, sophisticated regulatory frameworks, but sometimes a relatively modest improvement is the most realistic and useful outcome at that moment. You build things one brick at a time, and those smaller developments can provide the foundations for more robust regulation later.
For me, this means approaching these relationships as a collaborator rather than simply an external expert offering prescriptions. You listen, work with people to solve the problems they’re facing and, when appropriate, offer your perspective on where things might go next. If policymakers decide not to follow your suggestions, that’s part of the process too.
Perhaps most importantly, you want to build trust and maintain those relationships beyond any single project. Healthcare AI governance is not something that will be resolved in one legislative exercise or policy initiative. These questions will continue to evolve, and having an ongoing dialogue with policymakers creates opportunities to contribute as new challenges emerge.
We also need to remember that policymakers are people with competing responsibilities. AI regulation might be our principal research interest, but for someone in a ministry, it is often just one of dozens of pressing issues demanding their attention. Understanding those human and institutional realities is just as important as understanding the law.
Ultimately, the lesson for me is that effective policy engagement is not simply about having the right legal answers. It is about listening, building trust and helping translate those answers into achievable improvements, however incremental they may initially seem.
——————————
Q5. The book examines the varying responses of international organizations toward AI in healthcare, alongside the responses of individual jurisdictions. Given the pace at which AI capability is advancing — arguably faster than any single national legal system, let alone an international one, can keep up with — what do you believe is the most realistic and useful role that international organizations can actually play in AI healthcare governance right now, as opposed to the role that many policymakers and advocates wish they could play?
In healthcare, I think the World Health Organization (WHO) has been particularly influential in shaping how countries approach AI governance. One of the interesting things I’ve observed in my own research is how WHO guidance and recommendations are filtering down into national regulatory frameworks. I’ve seen this, for example, in developments in Saudi Arabia.
I also have the privilege of serving on a WHO working group examining regulatory considerations for AI in health, which has given me some insight into the work taking place behind the scenes. What’s particularly encouraging is the increasing emphasis on moving beyond broad principles and recommendations towards more detailed, practical guidance that countries can actually use.
These are, in effect, regulatory blueprints that national authorities can draw upon when developing their own frameworks. Rather than prescribing a single approach for every country, international organisations can provide practical models that encourage greater consistency while leaving room for adaptation to local needs and circumstances.
I think that’s probably the right balance. Countries have different healthcare systems, regulatory capacities and priorities, so expecting a uniform international framework to work equally well everywhere would be unrealistic.
For me, the most valuable contribution international organisations can make is to develop credible, technically informed guidance that helps national regulators make better decisions without attempting to make those decisions for them. If international organisations can provide that foundation, while allowing countries the flexibility to implement it in ways that work for them, I think that’s the sweet spot.
——————————
Q6. Beyond your work on this handbook, you have also been researching the regulation of the metaverse and blockchain in healthcare — technologies that raise governance questions related to but distinct from AI. Having now worked across all three of these emerging technology domains from a health law perspective, what is the single most important insight about regulating emerging technology in healthcare — something that applies whether you are talking about AI, blockchain, or the metaverse — that you believe policymakers and legal scholars in any of these specific fields consistently fail to appreciate because they are too focused on the particular technology in front of them?
I think the most important insight is that we need to stop looking at emerging healthcare technologies in isolation and start thinking much more seriously about the digital health ecosystem as a whole.
Some of my most recent research, which is still in development, goes well beyond AI, blockchain and the metaverse. I’m examining a much wider range of technologies, including virtual care, remote monitoring, the Internet of Things, quantum computing, genomics and precision medicine, nanotechnology, and neurotechnology.
What’s becoming increasingly apparent to me is just how interconnected these technologies are. They overlap, interact and continually evolve, creating legal and regulatory challenges that cannot necessarily be understood by examining each technology separately.
I think one of the traps regulators risk falling into is becoming too focused on AI. Of course, AI is enormously important, and in many respects it can be seen as the connective tissue running through different healthcare technologies. But it is only one part of a much larger and increasingly interconnected ecosystem.
This is where my research is now heading. Building on my recent work advocating a true lifecycle approach to healthcare AI governance, I’m exploring how that approach might be extended to the wider digital health ecosystem. Rather than developing separate regulatory responses to every emerging technology, can we identify common legal and regulatory challenges that arise throughout their lifecycles?
For example, regardless of the technology, we need to consider how it is researched and developed, how it is classified and enters the market, how healthcare institutions procure and implement it, and how its performance and risks are monitored once it is in use. These are different stages at which legal questions arise, even if the precise nature of those questions varies between technologies.
Of course, developing such a framework is enormously complicated, and there will always be important differences between technologies that require more specific regulatory approaches. But I think we risk missing the bigger picture if we continue to examine each innovation in isolation.
For me, the challenge is to develop a more coherent approach to governing digital health as an interconnected ecosystem, rather than constantly playing catch-up with one technology after another.
………………………………………………..
Dr Barry Solaiman is an Affiliate of the Harvard Medical School (HMS), Center for Bioethics.
He formerly served as an Associate Professor of Law at HBKU Law in Qatar and an Adjunct Assistant Professor of Medical Ethics in Clinical Medicine at Weill Cornell Medicine – Qatar, where he served as Co-Director of the Intersection of Law and Medicine Conference Series, and an Adjunct Lecturer at Northwestern University Qatar. He holds a PhD in Law from the University of Cambridge. He was Editor-in-Chief of both the Cambridge International Law Journal, and Medicine and Law. He is co-editor of the “Research Handbook on Health, AI and the Law”, which is the leading book in the field, and is a member of the World Health Organization’s (WHO) Working Group on Regulatory Considerations for AI in Health. He has published in leading journals on the regulation of AI in healthcare and was Lead Principal Investigator for a grant at HBKU that created guidelines for the development of AI in healthcare research. His work on AI has received the Science and Sustainability Award from the British Council.
[1] Published here: https://doi.org/10.13140/RG.2.2.10590.14402
[2] Saudi Article here: https://doi.org/10.1007/s41649-024-00285-6
[3] True Lifecycle Approach research: here: https://www.nature.com/articles/s41746-025-01614-1 and here: https://doi.org/10.1017/amj.2025.10091
Research Handbook on Health, AI and the Law
Edited by Barry Solaiman, and I. Glenn Cohen,
Publication Date: 2024 ISBN: 978 1 80220 564 0 Extent: 432 pp