Law, regulation and governance

About 25 minutes · plain language

Rules about AI now come from several levels at once: global, regional, national, health authority and your own workplace. In this lesson you will learn how these layers fit together and what “human oversight” means in daily practice.

Five layers of rules

The figure shows five layers. At the top are global principles from WHO, UNESCO, the OECD and the UN. Then come regional rules such as the EU AI Act, the Council of Europe Convention and the Gulf AI ethics manual. Next are national laws and regulators. Some health authorities set their own rules. Finally, your institution has its own policy. Lower layers are usually more specific and closer to your daily work, but how binding a rule is depends on its type, not its layer: the EU AI Act binds everyone it covers, while a global principle binds no one directly.

Principles versus law

Principles from the OECD, UNESCO and WHO guide policy but do not bind you directly. Laws and regulations do. The EU AI Act is binding law in the European Union; it sorts AI by risk and sets strict duties for high-risk uses, including human oversight. The Council of Europe Convention is the first binding international treaty on AI, for the states that join it.

Medical devices

Medical-device regulators such as the FDA, the MHRA and the Saudi FDA decide which clinical AI tools may be sold, and what evidence makers must provide. Regulators have agreed ten principles of good machine learning practice, covering data quality, representative data, human-AI teamwork and monitoring after launch.

The Gulf

Gulf countries have national AI policies, and health-specific rules exist in Saudi Arabia (for AI medical devices), Abu Dhabi and Dubai. Abu Dhabi’s Responsible AI Standard is mandatory for every licensed health facility that develops, buys or uses AI. Oman’s national policy (Circular 11/2025) sets out principles and expectations for government bodies and regulated institutions, covering human oversight, data protection and documentation. It is a policy rather than a law, but it shows what Omani institutions are expected to do.

Data-protection law applies too

Laws that are not about AI still apply to AI. The most important for health workers are data-protection laws: the EU General Data Protection Regulation (GDPR), Oman’s Personal Data Protection Law (Royal Decree 6/2022), Saudi Arabia’s Personal Data Protection Law and similar laws elsewhere. They treat health data as sensitive, require a lawful reason to use them, and limit sending them outside the country. Pasting patient details into an AI service hosted abroad can breach these laws even if the tool itself is approved.

Human oversight in practice

Oversight is not a signature on a form. It needs three things: knowledge (staff understand what the tool does and how it fails), time (staff can actually check outputs), and authority (staff are allowed to disagree with the tool without blame).