AI in healthcare is governed to the level of the data it touches.

Uses fall into three families, and they do not carry the same risk. Administrative: scheduling, transcription, billing, correspondence. Clinical support: chart summarization, documentation assistance, note preparation. Decision support proper: triage, imaging, detection.

The third group draws regulatory attention, but the first two hold the real volume. An automatic consultation transcript already processes health information, without any committee having reviewed it.

The inventory precedes everything else. Actual AI use inside clinical and administrative teams almost always exceeds authorized use.

The first belongs to the data itself. Health information that passes through an AI provider leaves the institution's perimeter. The sovereignty question becomes concrete: where the data sits, under which jurisdiction, and how long the provider retains it.

The second concerns the place of the human. The more a system's output resembles an opinion, the stronger the temptation to treat it as one. Supervision is then designed explicitly, calibrated to the risk of the use, rather than left to judgment in the moment.

The third is accountability. When a decision has been informed by a system, it must be possible to name who made it, on what data, and with which version of the system. Without that trace, accountability stops at the first "the system suggested it".

Quebec's Law 25 applies as soon as personal information enters an AI tool, and health information ranks among the most sensitive. The obligations on automated-decision transparency, privacy impact assessments and disclosure outside Quebec are the ones that reach these uses most directly.

On the European side, the AI Act classifies medical devices at the high-risk level, with the requirements that follow: risk management, data quality, human oversight, documentation. An organization exporting an AI-backed service into the Union falls under that regime.

identifiable certifies compliance in AI governance and with Law 25, and aligns practices with the AI Act. Detailed legal interpretation, and the professional-order obligations specific to regulated practitioners, remain with legal counsel and the relevant order.

The AI Index evaluates systems and agents one by one, across the six properties of the iDIA framework, scored on documented evidence. A practice that is stated but never written down hits a ceiling.

In healthcare, three properties are read first. Sovereign: data residency and the exit plan for each provider. Supervised: where the human review points sit, and on what risk criterion they were placed. Accountable: the trace of who produces, validates or corrects each output.

The Responsible AI Practice designation is granted at the threshold, and only there: the Index must reach the designation threshold and no property may fall below the floor. An organization can hold the average and remain undesignated because its Sovereign property gives way.