Health AI now needs evidence, not pilots

Health AI is leaving the demo room and entering the evidence room. That is the practical signal in the Commission’s June 2026 survey on artificial intelligence in healthcare and pharmaceuticals.

The survey opened on 2 June and closes on 26 June 2026 at 17:00 CEST. It asks about benefits, barriers and adoption conditions in two sectors where AI promises efficiency but punishes weak documentation. For SMEs building or buying health AI, the deadline is less important than the shape of the question: what proof will the workflow leave behind?

The pilot is no longer the unit

Health AI projects used to be sold as pilots. A model read scans, summarised notes, matched patients to trials, checked claims or searched clinical literature. The buyer asked whether the tool worked well enough to test.

That question is now too small. In healthcare and pharma, the useful unit is the evidenced workflow: where the data comes from, who uses the output, who can override it, what is logged, and how a mistake is detected before it becomes clinical, legal or reputational damage.

For SMEs, this matters because the first health AI customer is rarely buying a model alone. They are buying an answer to an operational problem: triage backlog, administrative coding, pharmacovigilance screening, appointment routing, patient communication, document review or internal knowledge search. Each case needs a different evidence trail.

Use case	Evidence the buyer will ask for
Clinical document summary	Source notes, reviewer, changed fields and unresolved uncertainty.
Patient routing	Intake data, escalation rule, queue decision and human override.
Pharma literature scan	Query, included sources, rejected sources and reviewer sign-off.
Claims or coding support	Rule version, input record, suggested code and final human decision.
Internal knowledge search	Document version, answer source, confidence limits and feedback loop.

Source: European Commission health AI survey and AI in Health policy pages. Last verified 2026-06-25.

The table is not governance theatre. It is the minimum file that lets a small supplier explain what its system did after the fact.

EHDS changes the data conversation

Regulation (EU) 2025/327, the European Health Data Space, is not an instant data tap. The Commission’s EHDS page makes the timeline clear: publication in March 2025 began a transition phase, with implementing work needed before the framework becomes operational in practice.

Still, EHDS changes procurement language now. It tells health buyers to think about access, reuse, interoperability and secondary use of electronic health data as regulated infrastructure, not as a favour granted by whoever controls the database.

That is good news for serious SMEs and bad news for vague ones. A small AI vendor that can explain its data needs, its access assumptions, its pseudonymisation or anonymisation boundary, and its audit trail will sound more credible. A vendor that only says “we connect to your data” will sound late.

The operational question is simple: if the data access route improves, is the product ready to use it responsibly? If the answer is no, better access will only create a larger mess.

AI Act risk does not disappear in health

The AI Act page keeps the main application date at 2 August 2026, with exceptions and staged obligations. In health, the important point is not the calendar alone. It is that medical, safety and fundamental-rights-adjacent uses can move quickly from productivity tooling into high-risk territory.

An SME does not need to over-classify every internal helper. A meeting summariser for a back office is not the same as a tool influencing care access. But the company does need a boundary test before the pilot becomes embedded.

The boundary test can stay short:

• Does the output influence diagnosis, treatment, prioritisation, eligibility or safety?
• Is a healthcare professional expected to rely on it under time pressure?
• Does the system process special-category health data?
• Can the user see the source and uncertainty?
• Is there a human who owns the final decision?

If the answer is unclear, the pilot is not ready to scale. That is not a legal essay. It is a stop sign.

The SME advantage is proximity

Large health systems often struggle because responsibility is distributed across clinical governance, IT, legal, procurement, data protection and operations. SMEs have a different problem: fewer specialists, but shorter paths between the person who knows the workflow and the person changing the tool.

That proximity is useful if it is captured. A nurse, pharmacist, lab manager, claims specialist or practice administrator can usually name the real failure modes faster than a committee can. The SME’s job is to turn that knowledge into test cases.

A five-row test set can be enough for the first decision. One routine case. One missing-data case. One ambiguous case. One high-risk escalation. One case the tool must refuse. If the system cannot handle those five honestly, a larger pilot will only make the failure harder to read.

This is also where AI literacy becomes practical. Staff do not need an abstract seminar before every experiment. They need to know the task, the allowed inputs, the warning signs, the escalation rule and the record left behind. Training follows the workflow.

The next bid will ask for proof

The Commission’s survey will not solve health AI adoption by itself. It is a listening exercise before policy and support work. But it shows where the centre of gravity is moving: barriers, enabling conditions, scale-up and responsible deployment.

For SMEs, the commercial implication is direct. The next serious health AI buyer will ask for proof that the tool can sit inside a controlled workflow. A slide saying “human in the loop” will not be enough. The buyer will want to know which human, at which step, seeing which source, with which override and which log.

The smallest useful preparation is an evidence file:

• the exact use case;
• the data categories and access route;
• the expected user and affected person;
• the risk boundary;
• the review step;
• the retained record;
• the stop rule.

That file is less glamorous than another pilot deck. It is also more likely to survive procurement, legal review and the first operational incident.

Health AI does not need SMEs to sound larger than they are. It needs them to be clearer than the market around them. Start with the evidence file, then decide whether the model deserves a pilot.