Swedish healthcare's AI governance gap: what Socialstyrelsen's pre-study reveals

Fragmented governance, missing frameworks

Socialstyrelsen's pre-study on AI implementation in Swedish healthcare has found fragmented governance and a lack of common frameworks for following up on AI systems ^[1]. The study points to unclear patient information about when AI is used and insufficient mechanisms to monitor and evaluate AI decisions once they have been made.

These findings matter because they go straight to the requirements healthcare providers will face under both the AI Act and the Medical Device Regulation. The AI Act's transparency rules have applied since 2 August 2026, requiring providers to inform people when they interact with an AI system ^[2]. For high-risk AI under Annex III, which includes triage in emergency care, the logging and oversight requirements apply from 2 December 2027 ^[2].

The pre-study suggests that many healthcare organisations are not ready to meet those obligations. Without clear governance, it becomes hard to know which AI systems are in use, let alone to document what they did or to tell patients about them.

What the law requires

Article 50 of the AI Act says that providers must ensure people are informed when they are interacting with an AI system, unless it is obvious from the circumstances ^[2]. That obligation has been in force since August 2026. For high-risk systems, Article 12 requires automatic logging of events over the system's lifetime, and Article 26 obliges users to monitor the operation and inform the people affected by decisions ^[2].

For medical device software, the Medical Device Regulation requires quality management, clinical evaluation and post-market surveillance ^[3]. Journal entries must be signed under Swedish patient data law, and access to patient records must be documented ^[4].

The common thread is documentation. The law assumes that the provider can show which version of a system was running, what it did and who was informed. Socialstyrelsen's findings suggest that assumption does not hold in many cases.

The evidence problem

The pre-study identifies two linked problems. First, patients are not consistently told when AI is involved in their care. Second, there is no common framework for following up on AI decisions once they have been made ^[1].

That combination creates an evidence gap. If a decision is questioned months later, the organisation needs to know which AI version was in use, what it recommended, whether a clinician reviewed the output and what the patient was told. Without logging and governance structures, that record does not exist.

The problem is not just about compliance. It is about trust. When a patient asks what role AI played in their diagnosis or triage, the answer needs to be specific, documented and checkable. "We used an AI tool" is not enough.

Sealing the record

Here, a digital witness makes the record checkable. The thing to seal is each AI recommendation or decision as it is written to the log: the patient reference (never the patient data itself), the model version, the output and the clinician's review. Sealing takes a fingerprint of the record, so the content stays in the healthcare provider's own systems.

If a decision is questioned later, anyone the provider shares the record with can check that it is exactly what was written on the day. Change a single character in the log and the fingerprint no longer matches.

A witness does not replace the journal system, the access controls or the clinical review. It does not show that the decision was correct or that the model was safe to use. What it does is make it possible to prove that the record of what the AI did has not been edited since it was sealed, even by someone with administrator rights.

That matters under both the AI Act and the Medical Device Regulation, where post-market surveillance and documentation of decisions are required ^[2][3]. It also matters under patient data law, where access logs must be kept ^[4].

Healthcare providers seal the record through WitniumChain's REST API, SDK or MCP server. The fingerprint is sealed when the decision is written. The content stays with the provider. The first 2,000 witnesses a month are free. Read the docs.

How it would work

1. The AI recommends a triage category and writes it to the log.
2. The system seals a fingerprint of the log entry: patient reference, model version, recommendation and clinician's decision.
3. If the decision is questioned months later, the provider recalculates the fingerprint. If it matches, the record is unchanged since the day it was sealed.

What this means for you

If you run AI in Swedish healthcare, Socialstyrelsen's findings are a prompt to ask three questions:

• Do you have a list of every AI system in use, with version numbers and responsible owners?
• Can you show which version of a system ran on a given day, what it recommended and whether a clinician reviewed the output?
• Do patients know when AI is involved in their care, and is that documented?

For high-risk AI, the logging and oversight requirements apply from 2 December 2027. For transparency under Article 50, the clock started in August 2026. The Medical Device Regulation's quality and surveillance obligations are already in force.

The question is not whether AI is useful in healthcare. It is whether you can document what it did, in a way that holds up when someone asks.

What to watch

Socialstyrelsen's pre-study is a starting point. The full study will likely set out more detailed findings and recommendations. Watch for guidance from Socialstyrelsen and IVO, Sweden's health and social care inspectorate, on what counts as adequate documentation of AI use in patient care.

For high-risk AI under Annex III of the AI Act, 2 December 2027 is the date to mark. From that day, triage systems and other high-risk AI in healthcare must meet the logging, oversight and documentation requirements in articles 12 and 26.