Healthcare Regulatory Compliance: A Generative AI Framework for Identifying and Mitigating Risks

Introduction:
As healthcare organizations increasingly rely on AI systems for clinical decision support, ensuring regulatory compliance has become a critical challenge. We propose an AI-powered compliance framework that supports data-driven regulatory risk assessment in healthcare AI workflows. By combining information retrieval, generative reasoning, and interactive visualization, the framework enables early identification of potential compliance risks directly from dataset characteristics and intended clinical use.

Methods:
The framework was evaluated using a scenario-based, data-driven test design based on a hospital readmission prediction dataset comprising ten years of longitudinal patient records with clinical measures, which was used with an AI-based readmission prediction model. Regulatory risk inference was derived directly from dataset characteristics and the intended use of the AI model. The evaluation followed four steps: (i) automated dataset characterization to identify sensitive health attributes, quasi-identifiers, temporal scope, and variables relevant to readmission prediction; (ii) GDPR-orientated risk inference by mapping data properties to requirements related to anonymization, data minimization, and data retention; (iii) classification of the intended use case as a high-risk AI system under the EU AI Act, with inference of obligations for training data governance and documentation; and (iv) dataset and model level screening for potential bias and representativeness issues across demographic and clinical subgroups.

Results:
Using the hospital readmission dataset, the framework identified elevated re-identification and retention risks under GDPR linked to longitudinal data. Variables with limited relevance to readmission prediction were highlighted as potential data minimization concerns. The system classified the use case as a high-risk AI system under the EU AI Act and detected subgroup imbalances indicative of potential regulatory and ethical risks. A review by data governance experts confirmed the relevance of the generated findings.

Conclusions:
The proposed framework supports early-stage regulatory risk assessment for healthcare AI systems, promoting compliance-by-design and trustworthy AI development.