WHO guidance on AI in health sets out ethical principles, regulatory considerations and recommendations for generative AI, but it is not binding. Enforcement falls to national regulators, most of which lack capacity to assess AI. In practice, much of the real governance of AI in low- and middle-income health systems happens through donor funding conditions and procurement contracts.
Suppose a ministry of health in a low-income country is offered a free AI triage tool by a well-funded foreign partner. The tool comes with a slide deck citing WHO’s ethical principles, an accuracy figure from a study in another country and a promise of local adaptation. Who decides whether it is safe to use?
On paper, the answer is the national medical devices regulator. In reality, that regulator may have a handful of staff, a backlog of medicine registrations, no specialist in software or machine learning and no legal framework that clearly covers an AI tool delivered through a smartphone. The ministry wants the tool. The partner is paying. Everyone agrees on the principles. Nobody is equipped to check them.
This is the governance gap in global health AI. The world is not short of AI health guidance; it is short of institutions able to enforce it, and in that gap, the entities with money, donors, foundations and technology companies, end up governing by default.
What does WHO guidance on AI in health actually say?
WHO has produced a substantial body of guidance, faster than it has for many other technologies.
In June 2021, it published Ethics and governance of artificial intelligence for health, setting out six principles: protecting human autonomy; promoting well-being, safety and the public interest; ensuring transparency, explainability and intelligibility; fostering responsibility and accountability; ensuring inclusiveness and equity; and promoting AI that is responsive and sustainable.
In October 2023, it published Regulatory considerations on artificial intelligence for health, aimed at regulators and covering documentation and transparency, risk management across the product lifecycle, validation with external data, data quality, privacy and data protection, and collaboration between regulators, developers and health systems.
In January 2024, it issued guidance on the ethics and governance of large multi-modal models, the category that includes large language models, with more than 40 recommendations for governments, technology companies and health care providers. WHO has also worked with the International Telecommunication Union and others on benchmarking and evaluation of health AI.
This is serious, thoughtful work. Its limitation is structural: WHO guidance is advisory. It carries moral and technical authority but no enforcement power. It relies on member states to translate it into law and regulation, and on regulators to apply it.
Who actually regulates AI in low- and middle-income countries?
In principle, national regulatory authorities. In practice, the picture is uneven.
WHO assesses national regulators using its Global Benchmarking Tool, which rates regulatory systems from maturity level 1 to 4. Level 3 means a stable, well-functioning, integrated system. Only a minority of national regulators have been assessed as operating at level 3 or above, and those assessments focus on medicines and vaccines. Oversight of medical devices generally lags behind, and software-based devices, including AI, lag further still.
Regulating AI is harder than regulating a conventional device. A regulator needs to judge whether a model was validated on data resembling its own population, how performance is monitored after deployment, what happens when the model is updated, and whether a tool that gives “information” is really making clinical decisions. Those are specialised skills, scarce even in the best-resourced agencies.
Regional initiatives aim to pool capacity. The African Medicines Agency, whose founding treaty entered into force in 2021 and which is based in Kigali, is intended to coordinate and strengthen regulation across the continent. Regional harmonisation and reliance on decisions by trusted regulators elsewhere can help. But reliance creates its own problem for AI: a model approved in Europe or the United States was validated on different populations, diseases and health systems.
Meanwhile, the most ambitious regulatory framework, the EU’s AI Act, which entered into force in August 2024, will not apply its main high-risk requirements to AI in medical devices until August 2027. And its reach is European.
Where do donors and funders fit in?
Here is the part that governance diagrams often leave out. In many low- and middle-income countries, the decisive decisions about which AI tools are used in public health systems are made through funding.
A foundation that funds an AI programme decides which tools are eligible, what evaluation is required and what data-sharing terms apply. A multilateral agency that buys digital tools for countries sets technical requirements in its procurement. A technology company offering a tool for free sets its own terms of use. These choices shape deployment far more directly than a national regulator that is never consulted.
Large programmes are arriving. In January 2026 the Gates Foundation and OpenAI announced Horizon1000, a $50 million initiative to support AI in 1,000 primary care clinics in Africa by 2028, starting in Rwanda. Programmes like this can be forces for good governance: they can require independent evaluation, local validation and data protection. But the governance lives in the programme’s design, not in national law.
At the same time, the global health financing landscape is shifting. The United States formally left WHO in January 2026, a year after the executive order announcing its withdrawal. Donor budgets have tightened across the board. That weakens the multilateral institution producing the guidance and increases the relative influence of private funders and technology firms.
Our earlier piece on how the procurement office is the most powerful quality regulator in your health system made this point about hospitals. It applies with even more force to AI in global health: whoever writes the contract is the regulator.
A worked example: three routes to deployment
This is a hypothetical example, comparing three ways the same AI tool might enter a health system.
An AI tool that helps nurses triage sick children is offered to a lower-income country.
In the first route, the tool arrives through a donor-funded pilot. The donor’s grant requires an evaluation, but it measures usage and user satisfaction, not patient outcomes. The regulator is not consulted because the tool is described as “decision support”. The pilot ends, the grant is renewed, and the tool spreads to more districts. Nobody has checked its accuracy on local children.
In the second route, the tool goes to the national regulator. The regulator has no AI specialists and no specific guidance, so the application sits for 18 months. The developer moves on to a country with a faster process.
In the third route, the ministry, regulator and donor agree a joint pathway before the pilot starts. The regulator relies on an assessment by a mature regulator elsewhere for the basic safety of the software, but requires local validation on 500 cases, reviewed by national paediatricians, before scale-up. The donor funds that validation and a small team at the regulator to review it. The contract requires the developer to notify the regulator of model updates and to share post-deployment performance data. The tool is approved for scale-up within a year, with a monitoring plan.
The third route requires no new global guidance. It requires the funder to pay for the regulator’s capacity and to write enforcement into the contract.
The strongest counterargument: isn’t soft guidance working as intended?
A fair critic would say that expecting WHO guidance to be enforceable misunderstands its purpose. WHO normative guidance has always worked by shaping national laws, professional norms and funder requirements over time. Hard regulation of a fast-moving technology risks locking in rules that are obsolete within a year and could block useful tools in countries that need them most. Many countries have not yet seen much AI deployment; building large regulatory bureaucracies in advance would be wasteful. Soft guidance plus donor conditions, the critic would say, is a sensible, adaptive model.
There is truth in this. Guidance does shape behaviour, and over-regulation is a real risk, particularly where it delays tools with clear benefits. Our piece on why fast approval isn’t the danger, slow withdrawal is argued that the ability to monitor and pull products matters more than the speed of approval.
But that argument cuts against the status quo too. Soft guidance works when someone monitors compliance and can act on failure. With AI, performance can drift after updates and when populations change. Without a regulator able to monitor and withdraw, and without contracts that require reporting, nobody is positioned to notice harm. The problem is not that the guidance is soft. It is that the capacity to act on it is missing where it is most needed, and that the funders filling the gap are not accountable to the patients affected.
What this means for policymakers, donors and regulators
For ministries and national regulators, the practical steps are to define clearly when an AI health tool counts as a medical device, to create a reliance pathway that recognises assessments by mature regulators while requiring local validation, and to insist on post-deployment monitoring and notification of updates. Small, specialised AI review units, possibly shared regionally, are more realistic than building full capacity in every country.
For donors and foundations, accept that you are regulators in practice and act accordingly. Fund regulator capacity alongside AI deployment. Require outcome evaluations, not just usage data. Write model update notification, performance reporting and data protection into contracts. Publish your requirements so they can be scrutinised.
For WHO and regional bodies, the next step is less new guidance and more implementation support: shared evaluation resources, model contract clauses, regional review capacity and help with post-market surveillance.
For technology companies, the lowest-cost way to earn trust is to volunteer for the obligations regulators cannot yet impose: publish validation results by population, notify updates, share performance data and support local evaluation.
Frequently asked questions
What are WHO’s six principles for AI in health?
WHO’s 2021 guidance on ethics and governance of AI for health sets out six principles: protect human autonomy; promote human well-being, safety and the public interest; ensure transparency, explainability and intelligibility; foster responsibility and accountability; ensure inclusiveness and equity; and promote AI that is responsive and sustainable. They are ethical guidance for governments, developers and health systems, not binding regulations.
Is WHO guidance on AI legally binding?
No. WHO guidance on AI in health is advisory. It carries technical and moral authority and is designed to inform national laws, regulations and practice, but WHO cannot enforce it. Legal requirements come from national legislation and regulators, or from regional frameworks such as the EU’s AI Act and medical device regulations.
Does the EU AI Act apply to medical AI?
Yes. AI systems that are medical devices, or safety components of them, requiring third-party assessment are classed as high-risk under the EU AI Act, which entered into force in August 2024. The main high-risk obligations for these systems apply from August 2027, alongside existing EU medical device rules. The Act applies to AI placed on the EU market, not to deployments elsewhere.
Who regulates AI health tools in Africa?
National medicines and medical device regulators hold legal responsibility, but capacity varies widely and few have specialist AI expertise. The African Medicines Agency, based in Kigali, aims to coordinate and strengthen regulation across the continent. In practice, donor funding conditions and procurement contracts also strongly shape which AI tools are deployed and how they are evaluated.
The takeaway
Global health does not need another set of AI principles. It needs regulators with enough staff to apply the ones it has, and funders honest enough to admit they are already governing. Until capacity follows guidance, the rules for AI in most of the world will be written in grant agreements.
Who, in your health system, would actually notice if an AI tool started getting worse?
