Health Care AI Needs Regulation at Every Stage of Its Lifecycle
Health care artificial intelligence is moving faster than the legal structures meant to govern it. In a 2025 review in the American Journal of Law & Medicine, Solaiman argues that the most workable response is a True Lifecycle Approach—a framework that follows AI from research and development through approval and into clinical deployment, rather than treating regulation as a one-time checkpoint.
The central problem is familiar to anyone watching AI enter clinical workflows: a system can appear safe and effective in development, gain clearance through an approval pathway, and then behave differently once it reaches real patients, busy clinicians, and changing clinical data streams. A static regulatory model cannot keep pace with software that may learn, drift, or be updated after deployment. In health care, those shifts are not abstract technical issues. They can change triage decisions, imaging reads, risk scores, and treatment recommendations in ways that directly affect patient safety.
The paper frames this gap as a legal and ethical failure, not simply an administrative inconvenience. Existing structures were built for medical technologies with more predictable lifecycles. AI behaves differently because its performance depends on data quality, training conditions, model updates, and the clinical context in which it is used. A device that performs well in a controlled setting may not behave the same way in routine practice, where edge cases, workflow pressures, and local population differences are unavoidable.
Development Rules Must Start Before an AI System Reaches Patients
In the research and development phase, Solaiman argues for robust guidelines and certification processes to ensure that health care AI is built within ethical and safety boundaries. That stage matters because the downstream risk is often engineered long before any patient encounters the tool. Bias in training data, weak validation methods, unclear performance thresholds, and opaque design choices can all be embedded early, then carried forward into clinical use.
A one-sentence reality check belongs here: unsafe design choices do not disappear at the regulatory gate.
The paper’s practical implication is straightforward. If health systems wait until deployment to interrogate an AI product, they are already managing harm rather than preventing it. Development-stage governance should therefore require clearer standards for testing, documentation, and certification, with attention to whether an algorithm was built for a narrow dataset but is being marketed for a broader clinical population. The stronger the initial evidence base, the less likely clinicians are to inherit a tool whose limitations only become visible after use on real patients.
Approval Pathways Need to Fit AI, Not Just Legacy Device Categories
Solaiman then turns to the approval stage, where health care AI is often forced into existing medical device frameworks that were not designed for adaptive software. The paper does not argue for abandoning current regulation entirely. Instead, it calls for tailored rules that reflect the distinct challenges posed by AI, especially systems that may change over time or depend on post-market data inputs.
This is where a conventional device mindset can break down. A fixed implant or instrument is judged largely on its manufactured form. An AI model may be judged on a version that is no longer the one operating at the bedside. Regulatory oversight therefore has to account for model updates, retraining, and the possibility that performance in one setting will not translate cleanly to another. In practice, approval should not be treated as the finish line. It should be one checkpoint in a continuous chain of review.
The paper’s discussion implies a regulatory architecture built around responsiveness. Health care AI should not be cleared and forgotten. Instead, oversight should follow the system as it evolves, with rules that can distinguish between low-risk software support and higher-stakes tools used in diagnosis, triage, or treatment selection. That distinction is especially important when an algorithm’s output could influence urgent bedside decisions.
Clinical Deployment Is Where Governance Gaps Become Patient Risk
The sharpest concerns arise after deployment. Once an AI system enters clinical practice, it interacts with workflow, staffing patterns, electronic records, and the clinical judgment of physicians and other professionals. Solaiman identifies this phase as the place where current laws are most inconsistent and least able to keep pace with AI advancement.
Deployment is also where regulatory fragmentation becomes most dangerous. Different institutions may use different procurement standards, different monitoring processes, and different thresholds for accepting an AI tool into practice. Without a coherent framework, one hospital may rigorously monitor model performance while another relies on vendor assurances and informal clinical acceptance. Patients then receive care under uneven protections, even when the same type of technology is in use.
The paper argues that a coherent regulatory system should keep patient safety at the center throughout the AI lifecycle. In clinical terms, that means monitoring for performance drift, reviewing adverse outcomes, and clarifying accountability when a system contributes to an error. It also means recognizing that bedside deployment is not passive implementation. AI becomes part of medical decision-making, and decision-making carries responsibility.
Qatar, Saudi Arabia, and the UAE Offer Working Examples
To move beyond theory, Solaiman draws on pioneering examples from Qatar, Saudi Arabia, and the United Arab Emirates as models for global implementation. These jurisdictions are presented as practical references for how health systems can begin building governance structures that match the speed and complexity of AI adoption.
The significance of those examples lies in their usefulness as policy laboratories. Health care systems do not need identical legal traditions to learn from one another. They need workable mechanisms for oversight, certification, and clinical accountability. By pointing to countries already developing these models, the paper suggests that lifecycle governance is not a distant ideal. It is already taking shape in parts of the world that are actively planning for AI in health care delivery.
The lesson from those examples is not that any single country has solved the problem. The paper is more restrained than that. It argues instead that the broad regulatory direction is becoming visible: AI in health care needs rules that begin before development, continue through approval, and persist after deployment. Anything less leaves obvious gaps between innovation and patient protection.
Why a Static Legal Model Fails at the Bedside
At its core, the review makes a simple claim with large clinical consequences. Health care AI cannot be governed safely by laws that only examine one stage of its life. A system that is ethically designed but poorly monitored can still harm patients. A system that is approved under an outdated device framework can still drift away from its validated performance. A system that is deployed without clear accountability can still produce inconsistent or unsafe care.
The paper’s proposed lifecycle approach is attractive because it aligns regulation with the actual behavior of AI. These systems are not inert objects; they are dynamic tools whose risks shift over time. Clinical governance has to move with them. If regulators, institutions, and vendors treat approval as the endpoint, they miss the most important part of the story: what happens after the technology reaches the patient.