Healthcare AI 2025

AUSTRIA Law and Practice Contributed by: Harald Strahberger and Florian Sesztak, Kinstellar

es harm due to design flaws, manufacturing errors, or inadequate user instructions. Healthcare providers and institutions, on the other hand, remain liable under traditional medical neg - ligence rules as outlined in the Austrian Civil Code ( Allgemeines Bürgerliches Gesetzbuch – “ABGB”). If a provider misuses an AI system or fails to exercise proper oversight, they may be held liable, even if the tool itself functions correctly. 4.2 Patient Harm and Malpractice Harm caused to patients through the use of AI in medical care is addressed under Austria’s medical malpractice laws, which are grounded in Sections 1299 seq. ABGB and Section 49 ÄrzteG. If a health - care provider uses an AI system in a way that devi - ates from accepted medical practice and the patient suffers harm as a result, the provider may be liable for negligence. Courts assess whether the standard of care – what a competent physician would have done under the same circumstances – was met. This includes evaluat - ing whether the provider: • properly understood and interpreted the AI output; • used the tool in accordance with its certified pur - pose according to MDR and MPG; and • exercised professional judgment rather than blindly following AI recommendations. In AI-related malpractice cases, causation will be a key issue. Austrian courts will examine whether the AI tool materially influenced the clinical decision and whether the provider could have reasonably foreseen its error. Expert testimony is typically used to establish this. However, the “black box” nature of many AI tools, ie, the fact that it is not possible to understand how the AI system arrived at its findings, makes it very dif - ficult to assess causality. 4.3 Risk Management Requirements Healthcare AI systems are subject to extensive risk management obligations under both national law (eg, MPG) and EU law (eg, MDR, GDPR, and AI Act). For AI classified as a medical device, manufacturers must implement a risk management system as part of the

conformity assessment procedure required for CE marking. This includes ongoing risk evaluation, miti - gation strategies, and post-market surveillance. The MPG enforces these EU obligations in Austria and assigns enforcement authority to the BASG. Health - care institutions that deploy AI systems also carry risk management responsibilities, including proper documentation, clinician training, and ensuring human oversight. Additionally, when AI processes personal health data, the GDPR and the DSG require Data Protection Impact Assessments under Article 35 of the GDPR. This applies to most AI deployments in clinical set - tings due to the high risk to individual rights and free - doms. Finally, the AI Act requires the establishment and maintenance of a quality and risk management sys - tem for all high-risk AI systems (see 2. Legal Frame- work for Healthcare AI for more information). Although there is no legal requirement in Austria for specific insurance products for AI, institutions typi - cally maintain professional liability insurance and may increasingly obtain cyber or AI-specific cover - age. Such coverage is particularly relevant where AI tools are integrated into clinical decision-making pro - cesses. 4.4 Defences and Limitations In Austria, developers and users of healthcare AI sys - tems may rely on several legal defences and liabil - ity limitations. For manufacturers, compliance with MDR and MPG, including CE certification and proper documentation, can serve as a regulatory compliance defence. This may help demonstrate that the product met applicable safety standards, potentially mitigating liability under the PHG. For healthcare providers, one of the main defences is demonstrating adherence to established medical practice, including proper training on AI tools and criti - cal assessment of AI outputs. If the provider used the system as intended and documented their decision- making process, liability may be reduced or avoided.

CHAMBERS.COM