AI in Healthcare and the Board’s Duty of Care

Ghana has no AI law for healthcare yet; that does not diminish the duty of care that healthcare boards owe their patients. Hospital directors and board members who wait for legislation before establishing appropriate AI oversight may still be judged on whether they exercised reasonable care when AI entered clinical practice.

In this article, “board” means the governing board of a hospital, clinic, diagnostic laboratory or imaging centre, health system or other healthcare institution in Ghana, whether public, private or faith-based. Where a private laboratory or small practice has an owner-operator and no formal board, the same points apply to whoever carries governance responsibility.

AI is moving into healthcare diagnostics, triage, treatment planning, and laboratory work, but the legal framework was written for human decision-makers. In large hospitals, AI is crawling through the electronic health records (EHR) of patients.

A clinician owes a patient a direct duty to act with reasonable skill and competence, and the professional councils regulated under the Health Professions Regulatory Bodies Act, 2013 (Act 857), including the Medical and Dental Council, enforce that standard.

When an artificial intelligence tool sits directly between the clinician and the patient, it creates a complex legal vacuum. In Ghana, as in most jurisdictions, resolving this exposure requires addressing a core trilemma distributed across three operational fronts, none of which has a settled answer:

1. 1.The clinician: If a doctor relies on a registered diagnostic tool that returns a wrong reading and the patient is harmed, is the doctor protected for trusting the tool, or negligent for missing the error?
2. 2.The hospital: Did the institution take reasonable care in vetting, buying, and supervising a third-party model before it reached patients?
3. 3.The developer: Is the vendor responsible where the cause is biased training data, poor design, or a defect in the software?

The board of directors of a healthcare institution sits squarely behind that second question. Decisions regarding whether to adopt artificial intelligence, which clinical tools to approve, and how to supervise them are core board and executive responsibilities, and they are precisely where an institution’s liability exposure is created.

Ghana has no omnibus AI statute, so regulation is split by use. The Food and Drugs Authority (FDA Ghana) registers software that works as a medical device, and publishes a guideline for registering software as a medical device. That guideline carries a 2017 reference, which suggests it predates models that keep learning after release. The Health Facilities Regulatory Agency (HeFRA) licenses and inspects health facilities, which is where an institution’s use of AI would be examined.

Three developments are moving, none of them yet law for hospitals:

• Emerging Technologies Bill. The Bill proposes an Emerging Technologies Agency with divisions for AI and other technologies, and harmonised rules on ethics and safety. A Responsible AI Office is separately proposed under the Ministry of Communication, Digital Technology and Innovations, as part of the National AI Strategy.
• Ministry of Health policy. The Ministry is developing a National AI Health Policy and Guidelines. Its stated aim is a lifecycle approach covering approval, procurement, validation, human oversight, monitoring and accountability.
• Data Protection Bill. The Bill would repeal the Data Protection Act, 2012 (Act 843) and bring AI and automated decision-making under formal oversight. Until then, Act 843 governs how patient data may be used to train or run these tools.

The Health Professions Regulatory Bodies Act, 2013 (Act 857) and the Public Health Act, 2012 (Act 851) were written around human professionals and conventional products. Two gaps follow.

• Opacity: When an AI model’s internal reasoning cannot be traced or explained (the “black box” problem), a court or regulator will struggle to establish legal fault or direct causation.
• Change after release: A traditional medical tool, such as a scalpel (an extremely sharp surgical knife), remains static after purchase. Conversely, a machine learning AI model can drift, evolve, or adapt to new inputs over time, straining product liability rules built for fixed products and rendering a one-time pre-market approval an unreliable form of long-term comfort.

Ghana is not writing on a blank page. Three reference points are worth watching.

• European Union. AI embedded in medical devices falls within the EU AI Act’s high-risk category for regulated products. The Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) moved those obligations to 2 August 2028. A Ministry of Health presentation on Ghana’s AI health policy work referred to alignment with WHO, OECD and EU standards, so EU rules are a likely benchmark for Ghanaian regulators and for vendors who sell into both markets.
• African Union. The Continental AI Strategy, adopted by the AU Executive Council in Accra in July 2024, guides member states and does not bind them. Its first phase, 2025 to 2026, centres on governance structures and national AI plans, so expect more national activity as that phase closes.
• United States and China. The U.S. FDA regulates clinical AI as Software as a Medical Device (SaMD) through rigid clearance pathways and post-market lifecycle monitoring. China’s NMPA requires strict local validation datasets and mandates that adaptive learning functions remain turned off during clinical use unless explicitly re-registered.

The common direction is clear: those who deploy AI are expected to oversee it and to prove they did.

Because statute and case law are still catching up, boards of healthcare institutions cannot rely on the law to mark the edge of their duty. The test will be whether the institution acted as a careful board would have.

The author is a technology and business transformation professional with over two decades of experience in transformation programmes, technology governance, and assurance. While he does not claim to be an AI expert, his experience serving on diverse governance and oversight committees, including at one of Ghana’s most digitally advanced healthcare institutions, informs his approach to AI governance.

The Metrica360 AI Governance Model has four themes: Direct, Frame, Control and Own. Each carries one question the board should be able to answer.

Direct: What have we committed to, and what must we obey?

• Set the board’s position in writing. AI supports clinicians and does not replace them, and the board states its risk appetite for each type of use.
• Map what applies today: the Data Protection Act, 2012 (Act 843) for patient data, FDA Ghana registration for software that works as a medical device, facility licensing requirements and the standards of the professional councils.
• Track what is coming: the Ministry of Health’s AI policy, the Data Protection Bill and the Emerging Technologies Bill.
• Tell patients when AI contributes to their care.

Frame: Which standard do we run, and can we show every AI use?

• Choose a recognised yardstick, such as ISO/IEC 42001 for an AI management system, ISO/IEC 23894 for AI risk and the NIST AI Risk Management Framework. None is law, but each gives the board a defensible benchmark while the law catches up. For healthcare, the closest best practice model is the Joint Commission and Coalition for Health AI guidance on the responsible use of AI, written for hospitals and health systems. Like the standards, it is voluntary and not Ghanaian law.
• Keep an AI register covering every use: tools you bought, AI built into vendor software and public tools staff already use. Set a clear policy on what is permitted.

Control: Was risk assessed before go-live, and when was it last tested?

• Require a documented risk assessment before any tool reaches a patient. It should include clinical validation on local data, a bias audit and accuracy stress tests, signed off by a named person. BS 30440, a British Standard on validating AI in healthcare, sets the evaluation criteria and lets organisations require certification in procurement.
• Rate each use by risk. Diagnosis, triage and treatment planning deserve the tightest controls.
• Confirm that human oversight is real. A clinician who approves every output without checking gives the institution little protection.
• Tighten vendor contracts: audit rights, advance notice of model updates, incident reporting, clear data ownership and location, and an indemnity that reflects the risk. Confirm FDA Ghana registration where the product works as a medical device.
• Retest on a schedule. Models can drift or change after release, so a one-time approval is not enough.

Own: Who is accountable, and what does the board see each quarter?

• Name one accountable executive for AI across the institution, reporting to the board every quarter. The Joint Commission guidance makes the same point, expecting regular board updates on AI use and outcomes.
• Train the people who approve and use high-risk tools, and build the board’s own literacy. Directors do not need to understand the models, but they need enough to challenge management’s answers.
• Keep the evidence: model performance, vendor updates, training records, incidents and board discussions. Ask your insurer whether professional indemnity cover responds to AI-related claims.

Take these to your next board or committee meeting. Each follows from one theme of the model.

• Direct. What have we committed to on AI, and which laws, regulators and professional standards apply to us today?
• Frame. Which standard do we run, and can management show us every AI use in our facilities, including vendor software and tools staff brought in themselves?
• Control. For each tool that touches a patient, was a risk assessment signed off before go-live, and when was it last tested?
• Own. Who is accountable for AI, what will the board see each quarter, and are the people approving high-risk uses trained for the decision?
• Together. If a patient were harmed tomorrow, could we show that we exercised active oversight?

Any AI risk that fits none of the themes above is a governance gap, and it belongs directly on the board’s agenda. If the board cannot answer these questions with confidence, the organisation must address the gap immediately, well ahead of formal statutory enforcement.

Credit: The AI governance themes build on the AI governance layers in Hari Kota’s “Full AI Governance Stack”.

British Standards Institution. (2023). Validation framework for the use of artificial intelligence (AI) within healthcare: Specification (BS 30440:2023). https://knowledge.bsigroup.com/products/validation-framework-for-the-use-of-artificial-intelligence-ai-within-healthcare-specification

Digital Policy Alert. (n.d.). Ghana: Ministry of Communication, Digital Technology and Innovations announced establishment of an Emerging Technologies Agency under Emerging Technologies Bill, 2025. https://digitalpolicyalert.org/event/34598-ministry-of-communication-digital-technology-and-innovations-announced-establishment-of-an-emerging-technologies-agency-under-emerging-technologies-bill-2025

Food and Drugs Authority. (2017). Guideline for registration of software as medical device (FDA/MCH/MDD/GL-RSAMD/2017/03). https://fdaghana.gov.gh/guideline-for-registration-of-software-as-medical-device

Ghana Chamber of Telecommunications. (n.d.). Ghana to regulate AI and deepfakes under new Data Protection Bill. https://www.telecomschamber.org/industry-news/ghana-to-regulate-ai-and-deepfakes-under-new-data-protection-bill/

Ghana News Agency. (2026, August). MoH developing AI Health Policy to strengthen healthcare delivery in Ghana. https://gna.org.gh/2026/08/moh-developing-ai-health-policy-to-strengthen-healthcare-delivery-in-ghana/

Hunton Andrews Kurth LLP. (2026, July 28). EU Digital Omnibus on AI enters into force. Privacy & Cybersecurity Law Blog. https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force

Joint Commission & Coalition for Health AI. (2025). Guidance on the responsible use of AI in healthcare (RUAIH). https://www.jointcommission.org/en-us/about-us/key-initiatives/ai-data-analytics-research

Mondaq. (2026). Ghana’s corporate commercial outlook 2026. https://www.mondaq.com/corporate-and-company-law/1818508/ghanas-corporate-commercial-outlook-2026

National Medical Products Administration. (2026). Draft guidelines on clinical evaluation of artificial intelligence-assisted medical devices and registration technical review key points. Government of China.

News Ghana. (2026, April 26). Ghana to teach AI and coding in basic schools by year end. https://newsghana.com.gh/ghana-to-teach-ai-and-coding-in-basic-schools-by-year-end/

Nwaokocha, A. (2024, August 11). African Union greenlights AI adoption across member states. Cointelegraph. https://cointelegraph.com/news/african-union-approves-ai-adoption

Onyekachi, N. (2024, August 9). Artificial intelligence: African Union council approves AI adoption in public and private sectors in Nigeria, others. Nairametrics. https://nairametrics.com/2024/08/09/artificial-intelligence-african-union-council-approves-ai-adoption-in-public-and-private-sectors-in-nigeria-others/

U.S. Food and Drug Administration. (2024). Predetermined change control plans for medical devices: Draft guidance for industry and FDA staff. Center for Devices and Radiological Health. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-medical-devices