Artificial Intelligence in Clinical Decision-Making: Human Rights Obligations and the EU Regulatory Framework under the AI Act

The growing use of artificial intelligence in clinical decision-making raises questions that civil liability law and the right to health, in their traditional form, are not fully equipped to handle. This dissertation starts from two specific questions: when an AI system takes part in a patient's care and that care results in harm, who is accountable? What guarantees can the patient actually rely on before any harm occurs? The argument developed here is that risk classification alone, however refined, is not enough. What is needed is a properly rights-based approach, in which informed consent, the intelligibility of the algorithmic decision, the real possibility for the patient of contesting it, and the identification of accountable actors remain central to the analysis. The first chapter reconstructs the constitutional and international foundations of the right to health and patient dignity, before turning to informed consent and self-determination in digital healthcare, including through the Cappato case, read in light of the Oviedo Convention. The chapter also addresses gender bias in AI-driven diagnosis and sets two competing paradigms against each other, risk-benefit balancing and a rights-based approach, in shaping the Fundamental Rights Impact Assessment (FRIA) framework. The second chapter maps the EU regulatory framework, from the historical development of AI in medicine to the AI Act. It examines the risk classification system, the obligations imposed on high-risk healthcare AI systems, the intersection between the AI Act and the Medical Device Regulation (MDR), and the accountability gap that opens up when responsibility for algorithmic harm has to be reconstructed across several actors. The third chapter tests the entire framework against a concrete case: the Epic Sepsis Model, a sepsis-prediction algorithm deployed at scale across US hospitals. By applying the EU regulatory framework retrospectively to a case that was never actually subject to it, the chapter examines how the system would be qualified under the AI Act, how its relationship with the MDR would be articulated, what obligations would fall on the deployer, what an ex ante FRIA would have required, how informed consent should have been structured, and how liability would be distributed among provider, deployer, and clinician. The case shows the limits of human oversight once eroded by alert fatigue, and the still-wide gap between regulation and the operational reality of AI systems in healthcare.