Building an open-source AI-powered platform to make health governance research accessible to the countries that need it most
The Scale of the Problem
There is a question that health policy researchers and regulators have been wrestling with for years: how well do countries’ laws actually protect people’s health data?
Digital health is transforming healthcare systems across every region of the world: telemedicine in rural India, electronic health records in Brazil, health data exchanges across the EU, AI-driven diagnostics in Singapore. Each country has assembled its own patchwork of rules: data protection laws, cybersecurity statutes, health acts, digital health policies, and international instruments. Mapping that landscape systematically means reading hundreds of documents, thousands of pages, and millions of words across dozens of jurisdictions simultaneously.
The traditional approach, manual review, highlighting, cross-referencing, spreadsheets, means a single country assessment can consume weeks of dedicated work. But the burden falls most heavily on the countries least equipped to bear it. In many Low- and Middle-Income Countries (LMICs), the policy research infrastructure needed to conduct rigorous digital health governance assessments simply doesn’t exist at scale. Regulatory gaps go unmapped. Opportunities to align with global best practices go unrecognized. And the people whose health data is at stake, often in contexts with the least robust legal protections, are the ones who pay the price.
This is the problem the project sets out to address. The UNU Campus Computing Centre, in collaboration with the International Institute for Global Health (UNU-IIGH), is integrating AI and large language models into the research workflow so that what was once an impossibly manual process of reviewing digital health policies becomes tractable at scale. The solution is still under development, but the vision is clear: an open-source, living, AI-augmented platform designed to make comprehensive health governance analysis accessible to anyone, anywhere with a deliberate focus on the jurisdictions that global health equity demands we pay most attention to.
More Than a Document Library
At its core, the project is building a centralized, open-source repository of legal, policy, and strategy documents on Artificial Intelligence for Health, Health Data, and Digital Health. But calling it a document library would be like calling the internet a filing cabinet.
The platform is designed as a genuine one-stop resource where policymakers, researchers, and decision-makers can access official documents from governments, regional bodies, and multilateral organizations and do something analytically meaningful with them. It will support cross-country and cross-regional comparisons that would previously have required entire research teams and months of effort, and it is being built as a living platform, continuously updated as new laws are enacted and existing frameworks revised.
As the project matures, it may evolve toward a more open, collaborative model, inviting voluntary contributions from experts and non-experts worldwide, in multiple languages, with all entries curated and validated before inclusion. The governance gaps that matter most often exist in jurisdictions where relevant documents aren’t in English, aren’t widely indexed, and aren’t easily discovered by the global research community. Making those documents visible is itself an act of equity.
But visibility is only the first step. What will transform this repository from an archive into an analytical instrument is the AI layer being built on top of it.
A Framework Worth Mapping Against
The Health Data Governance (HDG) Principles offer a comprehensive, human rights-centered framework for evaluating how well any country’s regulatory environment governs health data. Developed through a consultative process involving over 200 contributors from more than 130 organizations, and endorsed by over 150 organizations since their launch on World Health Day 2022, the Principles are structured around three interconnected objectives: protecting people and communities, promoting health value through responsible data sharing, and prioritizing equity.
The framework contains 50 core elements across 8 principles. For each jurisdiction, that means answering 50 nuanced questions across six regulatory domains: Data Protection, Cybercrime, General Health, Digital Health, International Instruments, and Emerging Technologies with textual evidence cited for every finding. Multiply that across dozens of countries and the scale of the analytical challenge becomes immediately apparent. This is precisely where large language models change what is possible.
What LLMs Actually Do Here
It is tempting to describe an LLM-powered regulatory analyzer as a sophisticated search engine. But that framing undersells what is actually happening.
A keyword search can find the word “consent” in a document. What it cannot do is reason about whether a given provision meaningfully addresses the HDG Principle on informed consent. It cannot evaluate whether the language is permissive or mandatory, weigh it against provisions elsewhere in the same law, or produce a structured, evidence-grounded finding across hundreds of documents simultaneously, all within seconds.
That is what large language models bring to this problem. The system asks the LLM to do what skilled human analysts do: read regulatory text with a specific analytical lens, identify relevant provisions, assess their alignment with a principle, and explain the reasoning. The difference is speed and scale. What might take a human analyst weeks per jurisdiction can be completed in hours.
For LMICs in particular, this matters enormously. A Ministry of Health official in a resource-constrained setting cannot commission a six-month regulatory benchmarking study. But they can, with this platform, access a structured, evidence-cited analysis of how their country’s existing laws compare against global best practices, and use that to make the case for reform, attract technical assistance, or engage in regional policy dialogue from an informed position.
The system was not designed to replace human judgment. The output is structured, verifiable, and evidence-cited so that researchers can audit, challenge, and build upon every finding. The LLM acts as an intelligent first-pass analyst; the human researcher and UNU-IIGH’s curation process remain the final authority.
The Engineering That Makes It Trustworthy
Analytical ambition requires engineering discipline. The most important technical decisions in this system are the ones invisible to a casual user, until they are absent.
Crash-proof by design. When making thousands of API calls across multi-hundred-page documents, failures are not edge cases. They are certainties. The system addresses this with two-layer idempotency: deterministic output filenames that prevent duplicate analyses, and task-level state tracking at the finest granularity. Each unique combination of document, principle, and element is tracked individually. An interrupted job resumes exactly where it left off, with no data lost.
Reproducibility as a research prerequisite. Each unique configuration of LLM provider, model, and document set generates a predictable, deterministic output file, making it straightforward to compare results across different models, audit how findings shift when a different LLM is used, and re-run any prior analysis under identical conditions. For each analysis, the system provides cited evidence drawn directly from the policy documents, indicating whether a country’s regulatory framework meets the requirements of a given domain. That said, it is worth being clear-eyed about what reproducibility means in an LLM context. Even identical configurations will produce probabilistic outputs. Two runs may surface different evidence, phrase findings differently, or occasionally reach different conclusions on ambiguous provisions. What the architecture ensures is that the analytical process is consistent, transparent, and auditable, and that any variation across runs is visible and examinable rather than hidden. Where findings are stable across multiple runs and providers, confidence is well-founded. Where instability appears, it is a signal worth investigating.
Multi-provider flexibility. The system supports OpenAI, Anthropic Claude, Google Gemini, Azure OpenAI, DeepSeek, and Ollama, all switchable through a simple configuration change. The flexibility goes deeper than swapping providers. For reasoning models, analytical effort can be tuned across low, medium, and high settings. This allows the same analysis to run at different depths depending on the complexity of the provision being assessed or the resources available.
Not every regulatory provision requires the same level of scrutiny. A provision that explicitly states “personal health data shall not be shared without written consent” is straightforward to assess. But many provisions are not. Legislation is often drafted in broad, ambiguous language; rights and obligations may be implied rather than stated; protections may be scattered across multiple statutes that need to be read together. These are the cases where higher reasoning effort earns its cost, where the model needs to weigh competing interpretations, follow chains of legal logic, and make a reasoned judgment about what a provision actually means in the context of a specific governance principle.
This tunability, combined with multi-provider support, enables something particularly valuable for research credibility: the ability to run identical analyses across different LLMs and compare results. Where findings converge across providers and effort levels, confidence in the output increases. Where they diverge, the divergence itself becomes analytically meaningful. It can flag provisions that are ambiguous, poorly drafted, or genuinely open to interpretation. Rather than treating any single model’s output as authoritative, the architecture encourages triangulation. It turns the diversity of available AI systems into a built-in quality assurance mechanism. It also offers practical cost flexibility. Lighter configurations handle routine scans, while higher effort reasoning is reserved for provisions that warrant deeper analysis.
What This Means for Global Health Governance
As countries enact new digital health legislation at an accelerating pace, the platform’s living repository design means the analysis will stay current. Researchers will be able to track how a regulatory framework evolves year over year, and identify gaps with specificity, pointing not just to what a jurisdiction lacks, but to exactly which provisions fall short of which HDG Principles, with evidence.
This matters because health data governance is not abstract policy. It determines how a patient’s medical records are protected when they cross a border, whether a government can legally share disease surveillance data with international partners during an outbreak, and who has the right to profit from data generated by communities that may have had little say in how it is used.
For LMICs, the stakes are especially high. These are jurisdictions where governance frameworks are often still being built, where the window for getting foundational decisions right is still open, and where well-resourced external actors can exert significant influence over domestic policy. A platform that provides independent, evidence-based analysis of a country’s own regulatory landscape, grounded in globally recognized equity frameworks, is a contribution to informed self-determination in digital health.
The Honest Caveats
LLMs cannot substitute for legal expertise when a provision requires nuanced jurisdictional interpretation. They can misread legislative intent, particularly in translated documents or those using archaic statutory conventions, and produce confident-sounding analysis that is subtly wrong. This is precisely why the platform pairs AI-generated findings with expert curation and validation and why outputs are designed to be audited and challenged, not accepted wholesale.
Document quality is also a real constraint. Scanned PDFs with poor OCR, inconsistent formatting, and unofficial translations all introduce analytical noise. These are not fatal flaws. They are reasons to be clear-eyed about what the tool is: a powerful accelerant for human analysis, not a replacement for it.
A Built-In Safety Net
The platform now includes an automatic quality check. For every finding, the system assigns a confidence score, essentially telling you how sure it is about its own conclusion.
When the AI is uncertain, perhaps because a law is vague, or the connection to a principle is indirect, the finding is automatically flagged for human attention, along with a short explanation of why. This means analysts don’t have to review everything. They can focus their expertise where it’s actually needed, while trusting the clearer findings.
A New Kind of Policy Infrastructure
What is being built here is, in a meaningful sense, infrastructure, the kind of foundational capability that could enable research that would not otherwise be possible.
The vision is to combine a curated living document repository, LLM-powered analytical capacity, robust engineering for resilience and reproducibility, and grounding in globally recognized governance principles into something genuinely new: a scalable, auditable, equitably oriented system for understanding where the world stands on digital health data governance and where the gaps remain.
As digital health continues its rapid expansion, the stakes of getting governance right will only grow. This project is an early demonstration of what AI applied carefully and engineered responsibly can offer: not the automation of human judgment, but the capacity to bring that judgment to bear at the scale the problem actually demands, especially for the communities who have waited longest for it.