Artificial Intelligence is transforming biomedical research, but innovation alone is not enough. To unlock the full potential of health data, researchers must also ensure that new technologies are developed responsibly, transparensively, and in full alignment with Europe’s evolving legal and ethical framework.
This is the focus of HEREDITARY Deliverable 7.2, an in-depth legal and ethical study that moves beyond theoretical compliance to analyse how European legislation applies to the project’s real-world research activities and federated architecture. Building on the foundations established in Deliverable 7.1, the study assesses how HEREDITARY’s technologies align with the latest European regulations while identifying the challenges that must still be addressed as the project progresses.
GDPR remains at the heart of HEREDITARY
One of the main conclusions of the study is that the General Data Protection Regulation (GDPR) continues to be the cornerstone governing the project’s processing of health and genetic data.
HEREDITARY’s federated approach supports several key GDPR principles, including data minimisation, privacy by design, and reducing the need to transfer sensitive information between institutions. By keeping patient data within each participating organisation, the project significantly reduces many traditional data-sharing risks.
However, federated learning is not automatically GDPR compliant. Even when raw data never leaves local institutions, model parameters, analytical outputs or derived inferences may still reveal personal information under certain circumstances. For this reason, GDPR compliance must be ensured throughout the entire data lifecycle, including data collection, local processing, federated model training, analytics, output generation, storage, and cross border collaboration.
Preparing for the European Health Data Space
Another major focus of Deliverable 7.2 is the European Health Data Space (EHDS), one of the EU’s flagship initiatives for enabling secure secondary use of health data across Europe.
The analysis concludes that HEREDITARY is already strongly aligned with many of the EHDS objectives. Its emphasis on interoperability, privacy-preserving data analysis and federated infrastructures positions the project as a promising contributor to future European health data ecosystems, including potential integration with HealthData@EU infrastructures.
AI Act: responsible AI goes beyond today’s requirements
Because HEREDITARY currently operates as a research infrastructure, many obligations introduced by the AI Act are likely to remain limited during the project’s research phase. Nevertheless, the Deliverable stresses that this situation is dynamic. If AI components developed within HEREDITARY eventually evolve into clinical decision-support tools or become deployed in operational healthcare settings, additional regulatory requirements related to risk management, transparency, human oversight and conformity assessment could become applicable.
This forward-looking assessment allows the consortium to anticipate future obligations long before technologies reach clinical practice.
DGA & NIS2: Governance and cybersecurity as key enablers
The Data Governance Act (DGA) reinforces principles that closely match HEREDITARY’s federated design, promoting secure processing environments, interoperability, responsible reuse of protected datasets and transparent governance mechanisms. Meanwhile, the NIS2 Directive highlights the growing importance of cybersecurity in distributed health data infrastructures.
Federated learning offers important privacy advantages, but it also introduces new types of cybersecurity risks, including model poisoning, inference attacks and parameter leakage. The study concludes that cybersecurity, data protection and governance must be addressed as an integrated framework, recognising that protecting health data is both a legal obligation and a prerequisite for trustworthy biomedical research.
Looking beyond compliance: ethics in federated AI
HEREDITARY combines genomics, artificial intelligence and cross-border health research. This makes ethical governance essential throughout the project. The study identifies ongoing challenges related to fairness, transparency, explainability, accountability, informed participation and responsible stewardship of research data.
Federated architectures substantially reduce the need for centralised data sharing, but they do not eliminate ethical risks associated with bias, re-identification, opaque AI models or the downstream use of research outputs. These issues require continuous assessment as both technologies and regulations evolve.
Bringing regulation closer to real-world research
One of the most valuable contributions of Deliverable 7.2 is its Use Case-Specific Analysis, presented in Annex 3.
Instead of relying on abstract legal interpretation, WP7 evaluates how European regulations apply to the concrete research scenarios developed across HEREDITARY’s five clinical use cases. It connects legal analysis directly with real technical workflows. This practical assessment also addresses one of the consortium’s previously identified governance gaps: situations where one partner’s analytical tools are applied to another partner’s datasets within the federated infrastructure.
These findings will now guide the final phase of Work Package 7, where the consortium will identify the remaining regulatory and ethical gaps and develop concrete recommendations to ensure that the HEREDITARY framework remains not only innovative, but also compliant, trustworthy and sustainable for future healthcare research across Europe.
Recent Comments