Ethical and legal challenges of artificial intelligence-driven healthcare

May combine two claims.

Arterys received FDA clearance in January 2017 for its medical imaging platform, the first machine-learning application used in clinical practice.

“in January 2017, Arterys received clearance from the US FDA for its medical imaging platform as the first ML application to be used in clinical practice [21], [22]”

• cites [21] FDA. Summary K163253, https://www.accessdata.fda.gov/cdrh_docs/pdf16/K163253.pdf; 2017 [accessed 30.04.19].Not checked yet

  Not checked in the free run.

• cites [22] Marr B. First FDA approval for clinical cloud-based deep learning in healthcare. Forbes. https://www.forbes.com/sites/bernardmarr/2017/01/20/first-fda-approval-for-clinical-cloud-based-deep-learning-in-healthcare/#6af107d161c8; 2017 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The AI health market was forecast to grow more than tenfold between 2014 and 2021.

“according to one analysis, the market size will increase more than 10-fold between 2014 and 2021 [1]”

• cites [1] Accenture. Artificial intelligence (AI): Healthcare’s new nervous system, https://www.accenture.com/_acnmedia/pdf-49/accenture-health-artificial-intelligence.pdf; 2017 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based).

A machine-learning system or human-trained algorithm can be only as trustworthy, effective and fair as the data used to train it.

“any ML system or human-trained algorithm will only be as trustworthy, effective, and fair as the data that it is trained with”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The European Commission encourages EU Member States to develop national AI strategies, and several states including the UK and Germany have released one.

“The European Commission ([29], p. 17) encourages all EU Member States to develop a national AI strategy, and several states have already released one such as the United Kingdom (UK) [33], [34], [35] and Germany [36].”

• cites [33] UK Department of Health and Social Care. New code of conduct for artificial intelligence (AI) systems used by the NHS, https://www.gov.uk/government/news/new-code-of-conduct-for-artificial-intelligence-ai-systems-used-by-the-nhs; 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

• cites [34] UK Government. Industrial strategy. Artificial intelligence sector deal, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/702810/180425_BEIS_AI_Sector_Deal__4_.pdf; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

• cites [35] House of Lords. AI in the UK: ready, willing and able?, https://publications.parliament.uk/pa/ld201719/ldselect/ldai/100/100.pdf; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

In May 2018 the FDA granted marketing authorization for OsteoDetect to help clinicians detect distal radius fracture in adults.

“In May 2018, the FDA also granted marketing authorization for Imagen’s software OsteoDetect for helping clinicians in detecting a common type of wrist fracture, called distal radius fracture, in adult patients [27], [28].”

• cites [27] FDA. DeNovo summary DEN180005, https://www.accessdata.fda.gov/cdrh_docs/reviews/DEN180005.pdf; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

• cites [28] FDA. FDA permits marketing of artificial intelligence algorithm for aiding providers in detecting wrist fractures, https://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm608833.htm; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

AI can improve healthcare not only in high-income settings but can also democratize expertise, globalize healthcare and reach remote areas.

“AI has the capability to improve healthcare not only in high-income settings, but to democratize expertise, “globalize” healthcare, and bring it to even remote areas [58].”

• cites [58] Wahl, 2018, Artificial intelligence (AI) and global health: how can AI contribute to health in resource-poor settings?, BMJ Glob Health sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The European Commission stated that the EU should raise public and private AI investment to at least €20 billion by the end of 2020.

“the entire European Union (EU) should strive to increase the (public and private) investment in AI to at least € 20 billion by the end of 2020”

• cites [29] European Commission. Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions. Artificial intelligence for Europe. COM(2018) 237 final, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52018DC0237&from=EN; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Ultromics's EchoGo Pro is an outcome-based AI system with CE marking in Europe that predicts coronary artery disease at an early stage.

“Ultromics’s EchoGo Pro, for example, is an outcome-based AI system with CE marking in Europe that predicts coronary artery disease at an early stage [44].”

• cites [44] Ultromics. http://www.ultromics.com; 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

A user agreement is a contract that an individual accepts without a face-to-face dialog.

“a user agreement is a contract that an individual agrees to without a face-to-face dialog ([51], p. 40)”

• cites [51] Klugman, 2018, The ethics of smart pills and self-acting devices: autonomy, truth-telling, and trust at the dawn of digital medicine, AJOBNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

A DeepMind and Moorfields Eye Hospital study published in Nature Medicine in August 2018 reported an AI system that reads eye scans and makes referral recommendations for more than 50 common diagnoses, was trained on 14,884 scans, and had a 94% success rate.

“researchers at DeepMind and Moorfields Eye Hospital in London, UK, published in Nature Medicine the study results of an AI system that can read eye scans and make referral recommendation, comprising more than 50 common diagnoses; the system was trained on 14,884 scans and showed a success rate of 94% [42].”

• cites [42] De Fauw, 2018, Clinically applicable deep learning for diagnosis and referral in retinal disease, Nat Med sourceNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

In February 2020 the European Commission released a White Paper on AI containing a European approach to excellence and trust.

“in February 2020, the European Commission released a White Paper on AI that contains a European approach to excellence and trust”

• cites [40] European Commission. White Paper on artificial intelligence—a European approach to excellence and trust, https://ec.europa.eu/info/sites/info/files/commission-white-paper-artificial-intelligence-feb2020_en.pdf; 2020 [accessed 16.03.20].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Memorial Sloan Kettering stated that errors occurred only during system testing and that no incorrect treatment recommendation was given to a real patient.

“MSK has stated that errors only occurred as part of the system testing and thus no incorrect treatment recommendation has been given to a real patient [56].”

• cites [56] Ross C, Swetlitz I. IBM’s Watson supercomputer recommended ‘unsafe and incorrect’ cancer treatments, internal documents show. STAT, https://www.statnews.com/2018/07/25/ibm-watson-recommended-unsafe-incorrect-treatments; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The European Commission adopted its AI strategy for Europe in April 2018.

“The European Commission adopted its AI strategy for Europe in April 2018.”

• cites [29] European Commission. Communication from the Commission to the European Parliament, the European Council, the Council, the European Economic and Social Committee and the Committee of the Regions. Artificial intelligence for Europe. COM(2018) 237 final, https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52018DC0237&from=EN; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

For some narrow AI tasks, such as sentiment analysis based on text, less data is required.

“there are also cases (e.g., a narrow sentiment AI-based off text) where less data will be required [57]”

• cites [57] Figure Eight. What is training data?, https://www.figure-eight.com/resources/what-is-training-data; 2020 [accessed 17.03.20].Not checked yet

  Not checked in the free run.

May combine two claims.

In healthcare, biased AI could cause false diagnoses and make treatments ineffective for some subpopulations, thereby endangering their safety.

“biased AI could, for instance, lead to false diagnoses and render treatments ineffective for some subpopulations and thus jeopardize their safety”

May combine two claims.

Biases can arise from unrepresentative datasets, from how data scientists and machine-learning systems select and analyze data, or from the context in which the AI is used.

“They can, for example, result from the datasets themselves (which are not representative), from how data scientists and ML systems choose and analyze the data, from the context in which the AI is used [64], etc.”

• cites [64] Price II WN. Medical AI and contextual bias, Harv J Law Technol, available at SSRN: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3347890; forthcoming 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The AI HLEG published Ethics Guidelines in April 2019 that promote Trustworthy AI and list seven key requirements.

“published the Ethics Guidelines in April 2019. The Guidelines promote the slogan “Trustworthy AI” and contain seven key requirements that AI systems need to fulfill in order to be trustworthy”

• cites [30] AI HLEG. Ethics guidelines for trustworthy AI, https://ec.europa.eu/digital-single-market/en/news/ethics-guidelines-trustworthy-ai; 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

How much data an AI needs depends on the particular AI and its tasks.

“In general, it always depends on the particular AI and its tasks how much data will be required.”

• cites [57] Figure Eight. What is training data?, https://www.figure-eight.com/resources/what-is-training-data; 2020 [accessed 17.03.20].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The European Commission agreed a coordinated plan on AI with EU Member States, Norway and Switzerland in December 2018 to promote AI development and use in Europe.

“The European Commission [37] also agreed upon a coordinated plan on AI with EU Member States, Norway, and Switzerland in December 2018 to promote the development and use of AI in Europe.”

• cites [37] European Commission. Member States and Commission to work together to boost artificial intelligence “made in Europe”, http://europa.eu/rapid/press-release_IP-18-6689_en.htm; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Using AI in clinical healthcare has great potential to improve it but also creates ethical challenges.

“the use of AI in the clinical practice of healthcare has huge potential to transform it for the better, but it also raises ethical challenges we now address”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Ada is an AI health app that assesses symptoms and gives guidance such as suggesting a doctor visit or emergency care; it is CE-marked class I in Europe and complies with the GDPR.

“Ada [41] is an AI health app that assesses an individual’s symptoms and gives guidance (e.g., suggest to the user a visit to a doctor or to seek emergency care). Ada [41] has been CE-marked (class I) in Europe—a basic requirement to putting a medical device on the market within Europe—and complies with the EU General Data Protection Regulation 2016/679 (GDPR).”

• cites [41] Ada. Your personal health guide, https://ada.com; 2020 [accessed 16.03.20].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Class IIa, IIb, and III devices have higher risk than class I devices and require involvement of a notified body.

“In contrast, class IIa, IIb, and III devices that have a higher risk than class I devices entail the involvement of a notified body, a conformity assessment body designated in accordance with the MDR [Recital 60 and Art. 2(42) of the MDR].”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Europe has taken several steps to address the issue of liability.

“However, Europe has taken several steps to address the issue of liability.”

May combine two claims.

Dinerstein v. Google and Project Nightingale by Google and Ascension are recent case studies showing patient privacy concerns in data sharing and AI use.

“The lawsuit Dinerstein v. Google [70] and Project Nightingale by Google and Ascension [71] are recent case studies showing patient privacy concerns in the context of data sharing and the use of AI.”

• cites [70] Dinerstein v. Google. No. 1:19-cv-04311; 2019.Not checked yet

  Not checked in the free run.

• cites [71] Copeland R. Google’s ‘Project Nightingale’ gathers personal health data on millions of Americans, https://www.wsj.com/articles/google-s-secret-project-nightingale-gathers-personal-health-data-on-millions-of-americans-11573496790; 2019 [accessed 17.03.20].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The MDR's new medical device definition in Article 2(1) treats software used for prediction or prognosis of disease in human beings as a medical device.

“In particular, the new medical device definition in Art. 2(1) of the MDR also considers software that is used for human beings for the Medical purpose of prediction or prognosis of disease as a medical device.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The IVDR will become effective as planned on May 26, 2022, and will especially repeal the Directive on in vitro diagnostic medical devices 98/79/EC.

“The IVDR will become effective as planned on May 26, 2022 (Art. 113(2) and (3) of the IVDR), thereby especially repealing the Directive on in vitro diagnostic medical devices (98/79/EC – IVDD) (Art. 112 of the IVDR) [86].”

• cites [86] European Parliament. Parliament decides to postpone new requirements for medical devices. https://www.europarl.europa.eu/news/en/press-room/20200415IPR77113/parliament-decides-to-postpone-new-requirements-for-medical-devices. 2020 [accessed 23.04.20].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Europe is not yet ready for the new liability challenges that AI-based technology will bring.

“Europe is also not (yet) ready for the new liability challenges that AI-based technology will bring along with it.”

Probably not a substantial claim: may not pass S3 (load-bearing).

MDR Recital 19 states that general-purpose software, even in a healthcare setting, and software for lifestyle and well-being purposes is not a medical device.

“However, the MDR also explicitly clarifies in Recital 19 that “software for general purposes, even when used in a healthcare setting, or software intended for lifestyle and well-being purposes is not a medical device.””

Probably not a substantial claim: may not pass S3 (load-bearing).

Under MDR Rule 11, software intended to monitor physiological processes is class IIa, except software for monitoring vital physiological parameters whose variations could cause immediate danger, which is class IIb.

“Software intended to monitor physiological processes is classified as class IIa, except if it is intended for monitoring vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as class IIb.”

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

There is currently no fully harmonized EU regulatory framework for liability on AI and robotics such as care and medical robots.

“There is currently no fully harmonized EU regulatory framework for liability on AI and robotics such as care and medical robots in place.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The NTF found that liability regimes are mainly regulated by EU Member States, except strict liability of producers for defective products, which is regulated at EU level by the Product Liability Directive.

“The NTF’s findings include that liability regimes are mainly regulated by the EU Member States except for strict liability of producers for defective products that is regulated by the Product Liability Directive at the EU level ([93], p. 3).”

• cites [93] NTF. Liability for artificial intelligence and other emerging digital technologies, https://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupMeetingDoc&docid=36608; 2019 [accessed 18.03.20].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Under MDR Rule 11, all other software is classified as class I.

“All other software is classified as class I””

Probably not a substantial claim: may not pass S3 (load-bearing).

In February 2020 the European Commission published a report on the safety and liability implications of AI, the IoT, and robotics.

“Only recently, in February 2020, the European Commission also published a report on the safety and liability implications of AI, the IoT, and robotics [39].”

• cites [39] European Commission. Report from the Commission to the European Parliament, the Council and the European Economic and Social Committee. Report on the safety and liability implications of Artificial Intelligence, the Internet of Things and robotics, https://ec.europa.eu/info/sites/info/files/report-safety-liability-artificial-intelligence-feb2020_en_1.pdf; 2020 [accessed 16.03.20].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S4 (based).

New AI-based technologies create challenges for current liability regimes.

“New AI-based technologies also raise challenges for current liability regimes.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Class I devices have a low level of vulnerability, and their conformity assessment can generally be carried out under the sole responsibility of manufacturers.

“For example, class I devices have a low level of vulnerability and thus the conformity assessment procedure can generally be carried out under the sole responsibility of the manufacturers [Recital 60 and Art. 52(7) of the MDR].”

Probably not a substantial claim: may not pass S3 (load-bearing).

In October 2019 the Medical Device Coordination Group released nonbinding guidance on qualification and classification of software under the MDR and IVDR.

“In October 2019, the Medical Device Coordination Group also released nonbinding guidance on qualification and classification of software under the MDR and IVDR [87].”

• cites [87] MDCG. Guidance on qualification and classification of software in regulation (EU) 2017/745—MDR and Regulation (EU) 2017/746—IVDR, https://ec.europa.eu/docsroom/documents/37581; 2019 [accessed 18.03.20].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The FDA draft guidance states that the agency also intends to focus regulatory oversight on software functions that are devices but are not classified as CDS.

“The FDA also clarifies in its draft guidance that it also intends to focus its regulatory oversight on software functions that are devices but are not classified as CDS ([78], pp. 24–27).”

• cites [78] FDA. Clinical Decision Support Software. Draft guidance for Industry and Food and Drug Administration Staff, https://www.fda.gov/media/109618/download; 2019 [accessed 17.03.20].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Two EU regulations, the Medical Device Regulation 2017/745 and the In Vitro Diagnostic Medical Devices Regulation 2017/746, entered into force on May 25, 2017.

“There are also new legal developments in the EU: Two new EU Regulations entered into force on May 25, 2017, namely, the Medical Device Regulation [2017/745—MDR; see Art. 123(1) of the MDR] and the Regulation on in vitro diagnostic medical devices [2017/746—IVDR; see Art. 113(1) of the IVDR].”

Probably not a substantial claim: may not pass S3 (load-bearing).

A CE marking indicates conformity with applicable MDR requirements so that a medical device can move freely within the EU and be put into service according to its intended purpose.

“A CE marking (similar to the current MDD) will especially indicate the conformity with the applicable requirements set out in the MDR so that a medical device can move freely within the EU and be put into service in accordance with its intended purpose [Recital 40 and Art. 2(43) of the MDR].”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The MDR will repeal the Medical Device Directive 93/42/EEC and the Directive on active implantable medical devices 90/385/EEC.

“The MDR will repeal the Medical Device Directive (93/42/EEC – MDD) and the Directive on active implantable medical devices (90/385/EEC – AIMD) (Art. 122 of the MDR).”

Probably not a substantial claim: may not pass S3 (load-bearing).

In November 2019 the independent Expert Group on Liability and New Technologies-New Technologies Formation released a report on liability for AI and other emerging digital technologies such as IoT.

“Further, in November 2019, the independent Expert Group on Liability and New Technologies—New Technologies Formation (NTF) that was set up by the European Commission released a report on liability for AI and other emerging digital technologies such as IoT [93].”

• cites [93] NTF. Liability for artificial intelligence and other emerging digital technologies, https://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupMeetingDoc&docid=36608; 2019 [accessed 18.03.20].Not checked yet

  Not checked in the free run.

May combine two claims.

Although the Streams app does not use AI, the case highlighted the potential for harm to privacy rights when developing technological solutions.

“Although the Streams app does not use AI, this real-life example has highlighted the potential for harm to privacy rights when developing technological solutions ([35], p. 90).”

• cites [35] House of Lords. AI in the UK: ready, willing and able?, https://publications.parliament.uk/pa/ld201719/ldselect/ldai/100/100.pdf; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The MDR contains a new classification rule that focuses explicitly on software.

“In particular, the MDR contains a new classification rule that focuses explicitly on software.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The FDA launched a Software Pre-Cert Pilot Program.

“There are many other important FDA initiatives we cannot do justice here, including its Guidance on Software as a Medical Device (SAMD): Clinical Evaluation [79] and the launch of the so-called Software Pre-Cert Pilot Program.”

• cites [79] FDA. Software as a Medical Device (SAMD): clinical evaluation, https://www.fda.gov/media/100714/download; 2017 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Under the MDR, medical devices are classified into classes I, IIa, IIb, and III based on intended purpose and inherent risks.

“Similar to the MDD, medical devices under the MDR will be classified into four categories, namely, classes I, IIa, IIb, and III, based on the intended purpose of the medical devices and their inherent risks [Art. 51(1) of the MDR] (Fig. 12.1 ).”

May combine two claims.

The Pre-Cert Pilot Program will let some digital health developers become precertified based on criteria such as patient safety, clinical responsibility, and product quality, and bring lower-risk software-based medical devices to market with streamlined FDA review or no review.

“The latter will enable some digital health developers to become precertified based on excellence in identified criteria (e.g., patient safety, clinical responsibility, and product quality) and bring their lower-risk software-based medical devices with more streamlined FDA review to market or no review at all ([80], pp. 5–7; [81]).”

• cites [80] FDA. Digital Health Innovation Action Plan, https://www.fda.gov/downloads/MedicalDevices/DigitalHealth/UCM568735.pdf; 2017 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

• cites [81] FDA. Digital Health Software Precertification (Pre-Cert) Program, https://www.fda.gov/medicaldevices/digitalhealth/digitalhealthprecertprogram/default.htm; 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Hospitals may have negligent credentialing duties when they "hire" an AI, similar to duties to review credentials and practice of physicians and staff.

“One interesting theory for hospital liability is “negligent credentialing”—just as hospitals may be liable if they do not adequately review the credential and practice of physicians and other staff they employ [91], they may have similar duties when they “hire” an AI.”

• cites [91] Bezaire J, Felton KW, Greve P, Allen D. Hospital negligent credentialing liability, https://www.willistowerswatson.com/en-US/Insights/2017/08/hospital-negligent-credentialing-liability; 2017 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

May combine two claims.

Depending on the decision's impact, AI-based CDS software could be classified as class III if it may cause death or irreversible deterioration, or class IIb if it may cause serious deterioration or surgical intervention.

“Depending on the decision’s impact, the AI-based CDS software could even be classified as a class III (if it may cause “death or an irreversible deterioration of a person’s state of health”) or class IIb device (if it may cause “a serious deterioration of a person’s state of health or a surgical intervention”) (Rule 11 in Chapter III of Annex VIII of the MDR).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Because medical devices were needed to combat COVID-19, the European Parliament postponed the MDR's application by one year to May 26, 2021.

“However, due to the need for medical devices to combat COVID-19, the European Parliament [83] postponed the MDR’s application by one year (i.e., May 26, 2021).”

• cites [83] FDA. Proposed regulatory framework for modifications to artificial intelligence/machine learning (AI/ML)-based Software as a Medical Device (SaMD), https://www.fda.gov/media/122535/download; 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

May combine two claims.

Cyberattacks often cross national boundaries, and data sharing and breaches commonly extend beyond US and European borders.

“While the latest legal developments in the US and Europe will hopefully promote the safety of AI-driven products, services, and processes in the healthcare sector, cyberattacks are often a global issue; data sharing and breaches frequently do not stop at the US or European borders but occur around the world [53].”

• cites [53] Gerke, 2019, Ethical and legal issues of ingestible electronic sensors, Nat Electron sourceNot checked yet

  Not checked in the free run.

May combine two claims.

Where personal data are collected, controllers must generally inform data subjects about automated decision-making, including profiling, and provide meaningful information about the logic, significance, and envisaged consequences.

“For example, where personal data are collected, the controllers must generally provide data subjects with information about “the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data sub”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Debates continue over open science and innovation, greater data sharing, and access to these technologies and their data.

“At the same time, there are continuing discussions about open science and innovation and the primary objective of more data sharing as well as increasing debates over access to such technologies and the pertinent data [115], [117].”

• cites [115] Carrier, 2009Not checked yet

  Not checked in the free run.

• cites [117] Lemley, 2011, Who chooses open-source software?, Univ Chic Law RevNot checked yet

  Not checked in the free run.

May combine two claims.

The WannaCry ransomware attack was a worldwide cyber incident that disabled the UK National Health Service, affected FedEx, and infected over 300,000 machines across 150 nations.

“The need for increased cybersecurity was shown in the “WannaCry” ransomware attack, a global cyberattack using sophisticated hacking tools that crippled the National Health Service (NHS) in the UK, hit the international courier delivery services company FedEx and infected more than 300,000 computers in 150 countries [111].”

• cites [111] Graham C. NHS cyber attack: Everything you need to know about ‘biggest ransomware’ offensive in history, https://www.telegraph.co.uk/news/2017/05/13/nhs-cyber-attack-everything-need-know-biggest-ransomware-offensive; 2017 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

CISA strengthens US cyber defense capacity and assists federal agencies in supplying security tools, assessments, and incident response for sensitive networks.

“CISA augments the US national capacity to defend against cyberattacks and will help the federal government provide cybersecurity tools, assessment skills, and incident response services to safeguard sensitive networks [107].”

• cites [107] US Department of Homeland Security. Cybersecurity, https://www.dhs.gov/topic/cybersecurity; 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The California Consumer Privacy Act of 2018 became effective on January 1, 2020.

“Inspired by the EU GDPR, California recently has taken action at the state level: The California Consumer Privacy Act of 2018 (CCPA) became effective on January 1, 2020 (Cal. Civ. Code § 1798.198).”

Probably not a substantial claim: may not pass S3 (load-bearing).

The EU Cybersecurity Act sets out the tasks, objectives, and organizational matters for ENISA.

“The Act also lays down the tasks, objectives, and organizational matter relating to the European Union Agency for Cybersecurity (ENISA) [Art. (1)(a)].”

• cites [Art. (1)(a)]Not checked yet

  Not checked in the free run.

May combine two claims.

Data subjects have a right of access to their personal data and to information about automated decision-making, including profiling, and its logic, significance, and consequences.

“In addition, data subjects have the right of access to the personal data concerning them that are being processed and the information about “the existence of automated decision-making, including profiling, (…) and (…) meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject” [Art. 15(1)(h) of the GDPR].”

Probably not a substantial claim: may not pass S3 (load-bearing).

President Donald Trump signed the US Cybersecurity and Infrastructure Security Act of 2018 (H.R.3359) into law on 16 November 2018.

“There is also new progress in the US: The Cybersecurity and Infrastructure Security Act of 2018 (H.R.3359) was signed into law by President Donald Trump on November 16, 2018 [107].”

• cites [107] US Department of Homeland Security. Cybersecurity, https://www.dhs.gov/topic/cybersecurity; 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The GDPR has applied since May 25, 2018 in all EU Member States and introduced a new era of EU data protection law.

“The General Data Protection Regulation (GDPR—2016/679) has been applied since May 25, 2018 [Art. 99(2) of the GDPR] in all EU Member States and introduced a new era of data protection law in the EU.”

May combine two claims.

Various intellectual property rights can protect AI and its data, often through contracts, copyright, trade secrets or confidence law, and, in Europe, database rights; competition law and personal data rights may also apply.

“AI—and the data that fuels it—can be protected by various intellectual property rights (IPRs), typically involving a combination of long contracts, copyright, trade secrets/the law of confidence, and/or—in Europe—database rights, as well as may also comprise competition law and personal data integrity rights ([118], [119], p. 123).”

• cites [118] Burbidge R. Medical data in a twist—Technomed v Bluecrest, http://ipkitten.blogspot.com/2017/09/medical-data-in-twist-technomed-v.html; 2017 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

• cites [119] Minssen, 2018, Big data in the health and life sciences: what are the challenges for European Competition Law and where can they be found?Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim.

Under GDPR Article 22(1), data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them.

“Under Article 22(1) of the GDPR, data subjects shall also “have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.””

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

That law changed the Homeland Security Act of 2002 and renamed the National Protection and Programs Directorate as CISA.

“This Act (Sec. 2) amended the Homeland Security Act of 2002, and, in particular, redesignated the National Protection and Programs Directorate of the Department of Homeland Security as the Cybersecurity and Infrastructure Security Agency (CISA) (Sec. 2202; 6 U.S.C. 652; [113]).”

• cites [113] Congress. Summary: H.R.3359—115th Congress (2017-2018), https://www.congress.gov/bill/115th-congress/house-bill/3359?q=%7B%22search%22%3A%5B%22cybersecurity+and+infrastructure%22%5D%7D&r=1; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

May combine two claims.

The WannaCry incident led to UK national responses and to the EU's Cybersecurity Act (Regulation (EU) 2019/881), which took effect on 28 June 2019.

“Events like these not only resulted in reactions at the national level such as in the UK [112] but also prompted a new Cybersecurity Act [Regulation (EU) 2019/881] that came into force on June 28, 2019.”

• cites [112] Smart W. Lessons learned review of the WannaCry Ransomware Cyber Attack, https://www.england.nhs.uk/wp-content/uploads/2018/02/lessons-learned-review-wannacry-ransomware-cyber-attack-cio-review.pdf; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

May combine two claims.

The GDPR is broader in scope than US HIPAA, which covers only specific health information generated by covered entities or their business associates.

“The EU’s GDPR is thus a lot broader in its scope compared to US’ HIPAA, which only covers specific health information generated by “covered entities” or their “business associates” (discussed in Section 4.3.1).”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Regulation (EU) 2018/1807 entered into force in December 2018 and has been directly applicable since May 28, 2019.

“As complementation to the GDPR, the Regulation (EU) 2018/1807 entered into force in December 2018 and has been directly applicable since May 28, 2019 (Art. 9 of Regulation 2018/1807).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Profiling is a subset of processing with two additional requirements: the processing must be automated and for evaluation purposes.

“Thus the term “profiling” is a subset of the term “processing” with two additional requirements, namely, the processing must be (1) automated and (2) for evaluation purposes ([102], p. 52).”

• cites [102] Goodman, 2017, European Union regulations on algorithmic decision making and a “Right to Explanation”, AI MagNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

The Act creates an EU certification scheme for ICT products, services, and processes so that they meet sufficient cybersecurity standards.

“In particular, it lays down a European cybersecurity certification framework to ensure that certified information and communications technology (ICT) products, ICT services, and ICT processes in the EU fulfill an adequate level of cybersecurity [Art. 1(1)(b)].”

• cites [Art. 1(1)(b)]Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The EU Cybersecurity Act seeks strong cyber resilience, cybersecurity, and trust within the EU and the smooth operation of the internal market.

“The new Cybersecurity Act’s goals are to achieve a high level of cyber resilience, cybersecurity, and trust in the EU while ensuring the internal market’s proper functioning [Art. 1(1)].”

• cites [Art. 1(1)]Not checked yet

  Not checked in the free run.

May combine two claims.

US patent rulings have made precision medicine patents more difficult, though not impossible, to secure, while Europe uses a more permissive eligibility standard, including for natural biomarkers.

“In the US, recent patent law decisions made it harder—but not impossible—to obtain patent protection for precision medicine inventions, whereas in Europe, a less stringent standard of patent eligibility is applied such as for nature-based biomarkers [122].”

• cites [122] Aboy, 2019, How does emerging patent case law in the US and Europe affect precision medicine?, Nat Biotechnol sourceNot checked yet

  Not checked in the free run.

May combine two claims.

Whether these rights exist may cause underinvestment where incentives are weak and may create blocking effects, anticommons problems, or obstacles to open innovation elsewhere.

“The un/availability of such rights could not only lead to underinvestment in some areas due to a lack of incentives but also block effects for anticommons scenarios and open innovation in other areas ([120], p. 323).”

• cites [120] Minssen, 2018, Big data and intellectual property rights in the health and life sciencesNot checked yet

  Not checked in the free run.

May combine two claims.

Competitors or patent examiners might use AI to forecast incremental innovation or show that a patent lacked novelty or an inventive step.

“However, AI systems could also be used by competitors or patent examiners to predict incremental innovation or to reveal that a patent was ineligible for patent protection due to, for example, the lack of novelty or inventive step [121], [123].”

• cites [121] Gervais D. Big data and intellectual property law, http://www.ceipi.edu/en/news/piece-of-news/?tx_ttnews%5Btt_news%5D=10942&cHash=2f3a1ea32cb69dd6b7ed38659ef6e440; 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

• cites [123] Maloney D. AI patent trolls now on the job for drug companies, https://hackaday.com/2019/01/30/ai-patent-trolls-now-on-the-job-for-drug-companies; 2019 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

AI has tremendous potential for improving the healthcare system.

“AI has tremendous potential for improving our healthcare system, but we can only unlock its potential by already starting now to address the ethical and legal challenges facing us.”

May combine two claims.

Patents may sometimes be inapplicable to big data or deployed tactically in new ways.

“Other rights, such as patents, may not always be applicable, or they may be tactically used in novel ways ([120], p. 323).”

• cites [120] Minssen, 2018, Big data and intellectual property rights in the health and life sciencesNot checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Data with diversity and many signals seems more useful and valuable, since machine learning involves ongoing experimentation.

“For instance, diverse data that provides a multitude of signals appears to be more useful and thus valuable since ML is a dynamic experimentation process ([126], p. 2).”

• cites [126] Kamenir E. Themes and takeaways from the FTC hearings on the intersection of big data, privacy, and competition, https://www.competitionpolicyinternational.com/wp-content/uploads/2018/11/North-America-Column-November-2018-7-Full.pdf; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Probably not a substantial claim: may not pass S3 (load-bearing).

Data value varies and often hinges on factors such as how it is used and how unique it is.

“The value of data differs and often depends on multiple factors, including its usage and uniqueness ([126], p. 2).”

• cites [126] Kamenir E. Themes and takeaways from the FTC hearings on the intersection of big data, privacy, and competition, https://www.competitionpolicyinternational.com/wp-content/uploads/2018/11/North-America-Column-November-2018-7-Full.pdf; 2018 [accessed 08.08.19].Not checked yet

  Not checked in the free run.

Classified as probably not a substantial claim.

The paper identifies four main ethical challenges for realizing AI's full healthcare potential: consent to use, safety and transparency, fairness and bias, and data privacy.

“We have also discussed four primary ethical challenges that need to be addressed to realize the full potential of AI in healthcare: (1) informed consent to use, (2) safety and transparency, (3) algorithmic fairness and biases, and (4) data privacy.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Europe emerges as a global player in AI ethics.

“In contrast, Europe emerges as a global player in AI ethics.”

• AssumptionRests on an assumption: In April 2019, the European Commission's AI expert group released ethics guidance for trustworthy AI.

Classified as probably not a substantial claim.

The paper analyzes five legal challenges in the US and Europe: safety and effectiveness, liability, data protection and privacy, cybersecurity, and intellectual property.

“This has been followed by an analysis of five legal challenges in the US and Europe, namely, (1) safety and effectiveness, (2) liability, (3) data protection and privacy, (4) cybersecurity, and (5) intellectual property law.”