Europe's AI rules have strong instincts but no pathway.

By Jonathan Kron, Co-Founder & CEO. May 15, 2026.

Last week I sat in a European Commission focus group on health data access and clinical AI regulation. A few things I said in that room are worth saying again here, in writing, where they can be referenced and pushed back on.

The system puts companies in an impossible position

There are five major regulatory frameworks that any clinical AI product in Europe needs to navigate at once: GDPR, the EU AI Act, the Medical Devices Regulation (MDR), the In Vitro Diagnostics Regulation (IVDR), and the European Health Data Space (EHDS), which entered into force on 26 March 2025.

Each of them has a logic. Each is justified on its own terms. None of them synchronise with each other, they are implemented differently across Member States, and the interaction effects between them are genuinely unclear, even to the people writing the implementing acts.

Legal advisors do their job well. But they give advice, they don't make decisions. The risk sits with the company. When you're a pre-seed startup and a use case unexpectedly triggers Software as a Medical Device (SaMD) classification faster than you planned for, you make the call anyway. With incomplete information, under pressure, on a tight runway. The problem isn't the advisors. The problem is that the regulatory ambiguity itself forces that situation.

Regulation should not be a mystery or a minefield. Its purpose is patient protection, not a trap for builders who are trying to do the right thing.

The tool that should already exist

What I described in the room was an objective, sourced reference layer for clinical AI regulation. Something that maps what applies to your product and your specific use case, with links to the source provision at every step. Not a summary written by a consultancy and updated annually. The regulation itself, parsed and queryable, with a human-in-the-loop step before anything is relied upon.

The technology to build this exists. It is exactly the same architecture we use at BloodGPT to interpret blood tests safely: a deterministic retrieval layer over the source text, with multiple language models cross-checking outputs and a hard gate that prevents anything from being passed downstream unverified.

The fact that the regulatory profession does not yet have a tool like this is not a technology gap. It's a coordination gap.

And it should not be cost-prohibitive. A startup with limited runway should be able to access the same quality of regulatory navigation as a large enterprise. That is part of what "accessible pathway" actually means in practice.

The EU's governance instincts are strong. The pathway is not.

What regulators in Brussels are enforcing right now in 2026, deterministic pipelines, human oversight at decision points, full audit trails, AI as a controlled component rather than an authoritative source, is exactly what BloodGPT was built on from the start. The governance philosophy is right.

But the pathway to actually get a product through is unclear in ways that are now measurable in capital flight. The US is further ahead on regulatory clarity. The FDA's January 2025 AI/ML guidance, its transparency framework, and its Predetermined Change Control Plans for AI-enabled devices give companies a defined path. The MHRA's AI Airlock and active fast-track discussions in the UK are adding a second viable pathway in English-speaking Europe.

Clinical AI companies build evidence where they can get data and move fastest. If that's consistently the US or the UK, European patients get access to validated AI tools later. Not because European companies don't want to be in Europe. Because the regulatory pathway elsewhere is simply more navigable right now.

The EU has world-class governance standards. It now needs world-class regulatory pathways to match. These are not the same thing.

The data access question underneath everything

There is a harder problem beneath the regulatory framework issue: data access. Clinical AI validation requires real-world clinical data. The EHDS secondary use framework is the right structural answer, but it is not yet operational in most Member States. Finland and Estonia have functioning mechanisms. Elsewhere, companies must negotiate access institution by institution, country by country.

This creates a structural bias. Companies build their validation evidence where they can get data, not necessarily where the patient population is most representative. For BloodGPT specifically, our validation work is currently driven by partnership availability rather than a coherent EU-level data access pathway. Our clinical validation study with Assuta Medical Centers, approximately 100,000 anonymised patient records, exists because of an institutional partnership in Israel, not because of a structured EU pathway to evidence generation.

Operationalising EHDS secondary use access for clinical AI validation, with clear timelines, defined evidence standards, and a recognised pathway from data access to regulatory submission, would be the single most impactful thing the Commission could do for this sector in the near term. Everything else flows from having a workable evidence base.

The businesses leaving matter

I know founders who left the UK for the US. Not because they wanted to. Because the path was clearer and the capital was there. That is a terrible outcome for European healthcare innovation, and it is a self-inflicted wound that the framework, as currently implemented, makes more likely with each passing month.

The vast majority of health tech companies want to be compliant. The question is whether the system makes that possible without killing momentum. Right now, for too many founders, the honest answer is no.

What a mature pathway looks like in practice

One thing I didn't include in my LinkedIn write-up of the session: BloodGPT is actively in partnership discussions with one of Europe's largest lab networks, and the regulatory mapping conversation is already part of that process. Not an afterthought. The clinical use case and the governance framework are being built in tandem, because that is the only way it works at scale.

That is what a mature pathway looks like in practice. You don't build the product and then bolt the compliance on. You build the governance framework alongside the clinical use case, with both sides in the room from the first meeting.

What I am hearing from other founders building healthcare AI in Europe is that regulatory readiness is now part of every commercial conversation from day one, not something that comes up after the technical work is done. That is, in fact, a sign of the system maturing on the user side. The regulators have not caught up yet.

Substantive sessions like the one I joined last week are exactly where the catch-up needs to happen. They need to happen more often, and the answers need to go somewhere concrete. Grateful to the organisers for one that did.

If you're working on a clinical AI product in Europe and running into the same pathway questions, I'd be interested to hear from you. Reach out at [email protected].

About BloodGPT BloodGPT is a B2B healthcare AI platform that turns unstructured laboratory data into standardised FHIR R4 records with clinical interpretation.

Learn more at bloodgpt.com.