Strengthening health data governance legislative frameworks: The foundation of trusted digital health and AI

Forslund argues that digital health and AI can only earn and retain public trust if they are governed through rights-based, equitable and people-centred rules. She says this requires not only fair and transparent governance at national level, but also stronger legislation and regional or global alignment so that countries do not end up with incompatible systems.

She states that digital technology and AI offer major benefits for planning, innovation, patient care, outbreak prediction and stronger health systems, but says those benefits can only be realised equitably and responsibly if governance keeps pace . She then defines the needed governance as fair, transparent, representative and beneficial for all populations, calls for stronger national legislation on collection and use of health data and AI, and warns that without regional and global alignment there will be a patchwork of incompatible rules that undermines trust and cross-border data sharing .

Forslund argues that health data governance work already has a substantial foundation, so governments and institutions should focus on alignment and coordination rather than starting anew. She presents existing principles, model laws and international guidance as practical building blocks for future national, regional and global frameworks.

She says the foundations already exist and that there has been progress at national, regional and global levels, meaning the field does not need to start from scratch . As evidence, she cites Transform Health’s 2022 health data governance principles endorsed by more than 175 organisations and governments, its model law used to support national legislation, the OECD Health Data Governance recommendations backed by 38 member states, WHO AI guidelines, and work by the Health Data Collaborative as possible starting points for broader frameworks .

Forslund stresses that governance must involve meaningful public engagement, not only formal rules. Her point is that people need to be informed and empowered regarding their data rights, and governance systems must provide remedies when data is misused or misinformation causes harm.

She says populations should be informed, engaged and empowered about their data rights, should know where their data goes and how it is used, and should have avenues to seek redress . She adds that if there is misuse of data or problems such as misinformation, people must have practical means to address those harms .

Kashoka argues that successful digital health governance requires a full chain of technology, policy and law. In his view, policies and guidelines may provide direction, but only legislation can create enforceable rights, define responsibilities and guarantee accountability when data governance fails.

He says Zambia’s experience has shown that technology moves faster than policy and policy faster than legislation, but that countries need all three to build trust and sustainability . He explains that policies and guidelines provide direction, whereas legislation establishes rights, responsibilities and enforceable accountability, including rules on access to health data, data sharing, consent, privacy protection and remedies when trust is breached .

Kashoka presents regional cooperation as a practical way to help countries avoid developing laws in isolation. He argues that the Africa CDC process can support legal coherence, cross-border collaboration and interoperable systems, while also allowing African priorities and perspectives to shape global governance discussions.

He notes that Zambia participated in consultations on the Africa CDC-led continental framework and says those consultations have helped shape a framework reflecting African priorities, experiences and aspirations . He adds that the framework can help countries build coherent legal and regulatory approaches, facilitate trusted cross-border collaboration, interoperability, surveillance and research, and ensure that Africa contributes its own people-centred and rights-based perspective to global debates rather than merely adopting external models .

Alshanfari argues that the political will for health data governance is already visible, especially from recent high-level processes, but that momentum must now be translated into implementation. He says the priority is to strengthen national legal frameworks, build wider agreement among stakeholders and develop practical guidance so trust can be established in practice.

He says the political support shown during the World Health Assembly high-level meeting demonstrated that states are ready to act . He then identifies four next-step priorities: building broader consensus, strengthening national capacities and laws, and developing practical implementation guidance, concluding that strong legal frameworks are needed because what is now required is trust .

Alshanfari argues that a workable global framework must be cooperative and flexible rather than one-size-fits-all. He says it should reflect different national levels of digital health maturity, preserve sovereignty and include a broad multistakeholder process that also brings in end users.

He says future work should continue consultations involving governments, international organisations, academia, civil society, the private sector and end users, adding that end users are often forgotten even though they are the people who will use these tools . He further argues that any future framework should support countries at different levels of digital health maturity, respect national sovereignty and proceed through practical cooperation .

Alshanfari emphasises that governance frameworks cannot stop at principles or declarations. They must come with implementation support tailored to the fact that countries differ significantly in their capacity, readiness and stage of digital health development.

He says that although many rules already exist, the real need now is implementation on the ground . He also calls for practical implementation guidance and says future frameworks should support countries at different levels of digital health maturity rather than assuming all countries are equally prepared .

Alshanfari argues that inclusive governance must extend beyond institutions and experts to the people directly affected by digital health tools. He highlights end users as a stakeholder group that is often neglected, even though their participation is essential for legitimacy and practical success.

He calls for consultations involving a wide set of actors and explicitly says that everybody forgets about the end user . He explains that end users are the people who will actually use these tools, which is why they must be part of the governance process .

Bonyo argues that one of the biggest governance failures is not the absence of initiatives, but the fact that they are poorly coordinated. She says multiple actors are working on similar frameworks in isolation, which leads to duplication, parallel processes and weaker implementation.

She explicitly says there is a coordination problem that is creating duplicity, and describes how many actors are in the space but are not talking to each other . Drawing on her experience in drafting the Africa data governance policy, she says national offices often did not know what was happening and were developing their own parallel frameworks, illustrating the siloed nature of the process .

Bonyo argues that governance discussions are too focused on executive actors and too often leave out other institutions with crucial legal roles. She stresses that parliaments are needed to pass laws, while judiciaries are increasingly shaping rules where legal frameworks are incomplete.

She says members of parliament are excluded from these processes and refers to comments from the chairperson of the parliamentary network on internet governance, who raised this issue at the Africa Tech AI and Governance Summit . She also says the judiciary is often neglected even though courts are increasingly determining what the law should be in areas where there is a vacuum or lacuna in data and AI governance .

Bonyo argues that many countries already have strategies and policies, but struggle to put them into practice. She attributes this to weak budgets, insufficient skills and the uncritical importation of Western governance models that do not fit local health systems and realities.

She says that from the Africa AI Governance Index, the conclusion was that policy is not the problem; implementation is, because many African countries have national AI strategies and some include health data, but they lack budgets and the skill sets needed to implement them . She also criticises the borrowing of Western strategies without local adaptation, using the example that African systems must account for realities such as community health workers, who are central locally but do not exist in the same way in Western models .

Bonyo argues that institutional arrangements are often mismatched to the technical complexity of AI and health data governance. She says data protection authorities are being given AI governance responsibilities by default, even when they lack the technical expertise and resources required, so policy and technical capacity need to be linked more effectively.

She says many people do not understand the distinction between sensitive data and health data, and argues that capacity building should begin with data protection authorities . Referring to the Africa AI Governance Index, she says data protection authorities are often acting as default AI officers, noting that Rwanda only recently launched a dedicated AI agency while Ghana’s AI functions still sit within the data protection authority, which demonstrates the need to give these institutions stronger technical skills for health data governance .

Mathieson frames the discussion as a progression from national legal challenges to regional and global alignment, with an emphasis on actionable outcomes. Her moderation highlights the need to connect different policy processes and stakeholder perspectives so that discussions lead to concrete next steps rather than remaining fragmented.

She introduces the panel as bringing diverse perspectives on challenges, needs and the path forward, and says she expects the discussion to lead to very concrete actions . She also explicitly describes the intended sequence of the discussion as starting with national legal issues and challenges, then building up to global alignment, opportunities and actions .

Campos Neto argues that the private sector is a core actor in digital health and AI governance because it develops much of the ICT and standards infrastructure on which these systems depend. He says governance frameworks must include private sector actors and provide legal clarity so they can innovate responsibly within predictable rules.

He says one major stakeholder frequently missing from these discussions is the private sector, and explains that within ITU, work on ICTs and standards is strongly driven by private sector members . He adds that if high-speed technologies such as AI are brought into the system without private sector involvement, governance will not work, and that what these actors want is a clear and understandable legal environment in which to operate .

Campos Neto argues that data sharing failures are not simply a result of greed or commercial secrecy. He says actors often hold data because they fear liability or do not know how to share it safely, which is why better technical standards, machine-discoverable datasets and standardised agreements are necessary.

He says data is often hoarded not only by the private sector but also by institutions, and that this is sometimes due to fear and uncertainty about how to share it safely rather than simple greed . As practical examples, he refers to the European Health Data Space as a positive initiative, but says it still needs more interconnecting technical frameworks, machine-discoverable datasets and template agreements to automate safe data use and reduce the time and difficulty involved in negotiating bilateral access arrangements, especially where firms treat data as trade secrets .

Campos Neto argues that AI is a broad label covering technologies with very different ages, risks and levels of maturity, so a single uniform regulatory approach would be misguided. He supports risk-based and context-sensitive legislation that reflects actual use cases and does not impose unnecessary burdens that would suppress innovation.

He says AI is a misnomer because it is not one thing, but many technologies ranging from decades-old systems to tools developed only months ago, each with different implications, maturity and risk profiles . He therefore argues that legislation should reflect risk, speed of technological change, maturity and use case, with stronger safeguards for riskier applications, while also ensuring frameworks do not overburden innovation .

The participant argues that governance discussions will have limited value unless they produce practical systems that citizens can actually use to share their health data. They express frustration with the slow pace of current initiatives and ask whether any jurisdiction already offers a public institution through which citizens can share data in practice.

The participant says that the European Health Data Space is moving incredibly slowly and suggests that if there are no concrete proposals for actual data sharing, the process is not very meaningful . They then ask whether there is anywhere in the world where citizens who want to share their data can do so through a public institution, which underscores the demand for a practical and publicly accountable mechanism .