Healthcare providers lack guidance on their legal liability when AI goes wrong

When Mr R., a 64-year-old recovering from a heart attack, left hospital after emergency angioplasty, wearing chest sensors and a wristband monitor, his care represented both the promise and the problem of AI-enabled home care. By day nine at home, a subtle pattern of signs (a rising resting heart rate, poorer sleep, reduced activity) triggered a message to the hospital team. He told them that he had experienced fatigue and breathlessness, but he hadn't deemed it serious. His care was adjusted remotely by the hospital team, symptoms stabilised within 48 hours, and an emergency-department visit was avoided.

Research confirms this works: a 2025 meta-analysis of over 16,000 patients found that remote patient monitoring reduced the risk of first heart-failure hospitalisations by 22%.^[1] But for every Mr R. whose care follows explicit protocols, there are pilots stalling because healthcare providers are concerned about liability, not the performance of these AI tools:^[2] ie, who is accountable when outcomes deteriorate despite available surveillance data?

The adoption bottleneck isn't technical

Health systems implementing AI-enabled home monitoring find that technical performance alone does not determine adoption. For example, a landmark 2024 study of FDA-cleared AI devices found that clinical adoption is remarkably narrow: of 16 billable AI procedures identified, only a handful achieved significant real-world use, with the vast majority seeing negligible clinical uptake despite proven accuracy.^[3] The barrier is procedural: studies reveal that healthcare providers consistently raise questions about who responds when the algorithm flags a risk, what the response protocol should be, and who bears liability if the intervention is inadequate.^[4],[5] The concern isn't whether AI can detect deterioration—sensitivity rates can exceed 94%^[6]—but rather the absence of clear frameworks governing clinical response and accountability.^[7]

The Mr R. vignette illustrates how explicit protocols enable effective care co-ordination. Yet such clarity remains rare. When an alert occurs at 2am, fundamental questions persist: who responds, within what timeframe, and what constitutes appropriate action versus negligent delay? Most critically, where does liability rest when outcomes deteriorate despite surveillance data captured by the system?

Traditional ward-based care concentrates liability within institutional walls, where supervision is continuous. This appears to be the promise of digital technologies: extension of clinical care from hospitals into homes and communities.^[8],[9]

Why clinicians hesitate

Recent surveys find that 66% of physicians now use AI in practice, with 68% recognising at least some advantage in patient care.^[10] However, 87% emphasise that not being held liable for AI-model errors is critical for adoption, and 86% require medical-liability coverage as a prerequisite^[11], reflecting deep concerns when accountability boundaries blur. Professional-liability frameworks—the legal standards governing when providers can be held liable—remain unsettled.^{[12],[13],[14]} As legal-medicine scholars note, adverse events involving AI "will need to be evaluated differently from today", and will "likely require judges, lawyers and expert witnesses to have new skills”.^[15]

Liability distribution remains unclear—whether responsibility falls on the physician, the healthcare facility, AI developers or device producers is unresolved.^[16] Documentation standards are also unclear: should physicians note when rejecting AI recommendations? What constitutes adequate reasoning when overriding an algorithm? The phenomenon of "automation bias", where physicians passively accept erroneous AI outputs, introduces further complexity into standard-of-care assessments.^[17]

The legal standard remains reasonable physician care under common-law negligence frameworks^[18]—a flexible, context-dependent standard. However, new regulations like the EU AI Act are establishing specific procedural requirements that create de facto standardisation: compliance becomes practically mandatory regardless of whether a court would consider it “reasonable”.^[19],[20] For instance, the EU classifies all AI systems in medical devices as "high-risk", triggering mandatory requirements for risk-management systems, data-governance protocols, technical documentation, human-oversight mechanisms and quality-management systems.^[21],[22] Singapore similarly mandates continuous performance monitoring, verification at deployment and adverse-event reporting by healthcare implementers.^[23],[24] The WHO and other bodies suggest there is a need for convergence around monitoring obligations that would standardise AI practices across borders,^[25],[26] but they are not explicit about what should happen.

This creates additional liability exposure when companies producing these devices have not adequately priced in the compliance costs and litigation risk healthcare providers could face. Legal scholars analysing negligence frameworks note that while clinicians retain authority to override algorithmic recommendations, doing so requires documented justification through validation procedures.^[27] Under the EU AI Act, AI-enabled medical devices requiring third-party assessment are classified as "high-risk", elevating procedural scrutiny regardless of their traditional device risk class. Regulatory frameworks continue to evolve; the WHO’s guidance on large multi-modal models in healthcare suggests that compliance requirements and auditing mandates will expand over time.^[28],[29]

There are three risks as a result of inadequate liability frameworks: AI systems failing to flag patient deterioration that should have triggered alerts; alerts generated by the AI system but inadequately acted upon; and over-escalation from algorithmic recommendations causing iatrogenic harm. ^[30],[31] Documentation of AI-assisted clinical reasoning then becomes critical as health systems lack standardised approaches. The EU AI Act's technical-documentation requirements will probably lead to a revamp of existing practices,^[32] however, as de Kok (2025) observes, these requirements may foster a 'harm complex' that shifts the professional burden toward intensive systemic oversight and bias auditing rather than offering a simple reduction in clinical labor.^[33] All these compliance requirements might push healthcare professionals to practice defensive medicine—either ordering unnecessary tests or interventions when the AI flags something, or ignoring the AI system, which would eliminate the cost savings that make remote monitoring financially advantageous.

What standardisation would require

Clarifying accountability would establish operational standards that current regulations leave unresolved. Clear protocols stating who responds to automated alerts, within what timeframe, and with what clinical assessment would anchor liability in defined responsibilities rather than regulation. To resolve current regulatory ambiguity, health systems must implement standardised audit trails, explicit competency frameworks and clear oversight protocols. This accountability architecture ensures that responsibility is distributed through well-defined systems rather than being unfairly accumulated by individual clinicians. What is missing is the accountability architecture that will help AI use in healthcare scale up—it is not complicated, but it is essential.

Views or opinions expressed are those of the author and any individuals cited, and do not necessarily reflect those of Economist Enterprise or any other member of The Economist Group.