1. Introduction

Data governance for genomic AI models is the legal, ethical, technical, and institutional framework that regulates how artificial intelligence systems collect, store, access, analyse, share, train on, and reuse human genetic and genomic data.

Genomic AI models can analyse DNA sequences, identify disease-associated variants, predict inherited disease risks, support cancer diagnosis, and assist in developing personalised treatments. However, genomic data presents distinctive legal challenges because it may reveal information about an individual’s health, biological relatives, ancestry, and future disease susceptibility.

The central legal question is:

Who has the authority to control genomic data used to train AI, for what purposes may it be used, and who is legally responsible when the model causes harm?

The US National Human Genome Research Institute recognises the need to balance scientific data sharing with the protection of research participants’ privacy. Genomic information can create risks even when researchers remove direct identifiers, particularly in small or identifiable populations.

Genome.gov+1

There is no single worldwide statute governing genomic AI. Applicable duties depend on the jurisdiction, the identity of the data controller, the purpose of processing, and whether the model is used for research, clinical care, insurance, employment, or commercial development.

2. Meaning and scope of genomic AI data governance

AI in Genomics: Machine Learning for Genetic Insights | by Boateng Abednego | Medium

A. Genomic data collection

Obtaining DNA sequences, genetic test results, tissue samples, clinical records, and associated phenotype information. Governance requires a lawful basis, appropriate consent where required, and clear research or clinical purposes.

Представлена Evo 2 от Nvidia и партнёров — ИИ-модель, обученная на 9,3 трлн нуклеотидов геномов более 128 тысяч видов

B. Dataset preparation and model training

Establishing data provenance, checking sample quality, managing permissions, documenting exclusions, and controlling how genomic datasets enter training pipelines.

Machine Learning for Biomedical Data

C. Model development and deployment

Testing model accuracy, population bias, privacy leakage, clinical validity, and the consequences of AI-generated predictions.

Future of healthcare security depends on privacy-preserving AI: Here's why | Technology

D. Post-deployment oversight

Monitoring security incidents, model updates, unauthorised reuse, discriminatory outcomes, retention, and deletion obligations.

Key distinction: data governance versus model governance

Data governance addresses the lawful acquisition, quality, access, permitted uses, sharing, security, and retention of genomic information.

Model governance addresses the design, validation, explainability, fairness, deployment, monitoring, and accountability of the AI system.

Genomic AI governance combines both, because a model can produce harmful results even when the underlying dataset was lawfully collected, and a technically accurate model can still be built using improperly obtained data.

3. Core legal principles governing genomic AI

A. Lawful collection and informed consent

Genomic AI developers should establish whether DNA samples and associated records were lawfully collected and whether the proposed AI use falls within the original consent, another lawful basis, or a valid research exception.

Consent for clinical diagnosis does not automatically authorise every subsequent use, such as:

Training a commercial foundation model.

Sharing genomic data with pharmaceutical companies.

Predicting behavioural or non-medical characteristics.

Transferring datasets to another country.

Reusing a dataset for a substantially different research purpose.

Consent must be assessed under the applicable legal regime. Some jurisdictions permit specified research processing without individual consent, subject to safeguards and legal conditions.

B. Purpose limitation and data minimisation

An organisation should collect and process only the information reasonably needed for its stated purpose. For example, an AI model designed to identify a particular hereditary cancer risk should not automatically receive an entire lifetime of unrelated medical records.

Data minimisation may involve removing unnecessary identifiers, separating clinical records from sequence data, restricting access to raw genomes, and using secure computation methods.

Importantly, de-identification is not the same as anonymisation. Genomic information can sometimes be linked back to a person or their relatives by combining it with other datasets.

C. Data quality, representativeness and fairness

Genomic AI trained predominantly on one ancestry group may perform less accurately for populations that are underrepresented in the training data.

Good governance therefore requires:

Documented dataset origins and collection methods.

Evaluation of ancestry and population representation.

Independent validation on appropriate datasets.

Assessment of false positives and false negatives across populations.

Version control and records of data corrections.

Monitoring for discriminatory or clinically unsafe predictions.

For high-risk AI systems within its scope, the EU AI Act expressly addresses dataset governance, collection, preparation, suitability, and bias mitigation.

EUR-Lex+1

D. Security, access and retention

Appropriate safeguards can include encryption, pseudonymisation, access logging, role-based permissions, secure research environments, penetration testing, and documented breach-response procedures.

Genomic data should not be retained indefinitely merely because future AI research might be possible. Retention and deletion must follow the applicable legal rules, research commitments, and legitimate archival requirements.

E. Accountability and auditability

Every major stage of the AI lifecycle should have an identifiable responsible party. Governance records should show:

Who authorised access to the dataset.

Which consent terms or legal basis applied.

Which datasets were used for training and validation.

What changes were made to the model.

Whether third-party providers received genomic information.

How complaints, errors, security incidents, and harmful outcomes were addressed.

4. Applicable legal frameworks

The following frameworks illustrate how genomic AI governance is regulated across jurisdictions.

India

Digital Personal Data Protection Act, 2023 (DPDP Act)

The Act provides a framework for processing digital personal data, including identifiable genomic information. Relevant concepts include lawful processing, consent, specified legitimate uses, security safeguards, individual rights, and accountability.

The Act does not create a separate comprehensive statutory category for genomic data equivalent to the EU's special-category regime. Its commencement is staggered: as of November 2026, the core processing provisions are scheduled to commence 18 months after the November 2025 notification, in May 2027. The applicable commencement notification must therefore be checked before determining which obligations are enforceable at a particular time.

India Code+2

European Union

GDPR and EU AI Act

GDPR Article 4(13) defines genetic data, while Article 9 generally prohibits processing genetic data unless an applicable exception or condition permits it. Other relevant requirements include purpose limitation, security, data protection impact assessments where required, and controls on international transfers.

The AI Act adds data-governance and risk-management requirements for AI systems classified as high-risk and within the Act's scope. Not every genomic AI model automatically qualifies as high-risk; classification depends on its intended use and the applicable provisions.

EUR-Lex+1

United States

HIPAA, GINA, the Common Rule and FTC enforcement

HIPAA protects identifiable genetic information when it qualifies as protected health information held by a covered entity or business associate. It does not automatically cover every direct-to-consumer genetics company or every dataset.

The Genetic Information Nondiscrimination Act (GINA) restricts specified uses of genetic information in employment and health insurance. It does not provide a universal prohibition on genetic discrimination in every insurance market or commercial context.

The Common Rule governs covered human-subjects research, while the Federal Trade Commission can address deceptive or unfair privacy and security practices.

HHS.gov+3

5. Important case laws and regulatory precedents

These decisions and enforcement matters help establish principles relevant to genomic AI governance. Some directly concern genetic privacy, while others concern foundational privacy rights, genetic information, or related data-protection duties. They should not be mistaken for judgments specifically regulating modern genomic foundation models.

Case 1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts and legal issue: The Supreme Court considered whether privacy is constitutionally protected under the Indian Constitution in proceedings concerning the Aadhaar identification system.

Decision: The nine-judge Bench recognised privacy as a fundamental right protected by Article 21 and other freedoms in Part III of the Constitution.

Relevance to genomic AI:

Genetic information can reveal intimate details about health, family relationships and biological identity.

State use of genomic databases may raise questions of legality, legitimate purpose, necessity and proportionality.

Compulsory genetic collection or excessive state access may require constitutional scrutiny.

Privacy safeguards should apply throughout collection, inference, sharing and retention.

Legal principle: Intrusive processing of personal information by the State must be assessed against constitutional privacy protections and the applicable legal framework.

The case does not establish an absolute right to control all genetic data or decide the legality of commercial genomic AI training. Its significance lies in the constitutional framework it provides.

Case 2. Bearder v. State of Minnesota (2011)

Supreme Court of Minnesota · 788 N.W.2d 144

Facts: Minnesota retained blood samples collected from newborns and permitted their use in research beyond the original screening programme. Families challenged the collection, retention and secondary use under the state's Genetic Privacy Act.

Decision: The court held that the samples and associated test results were subject to the Act's restrictions, and that the newborn-screening statutes did not authorise the additional uses without the consent required by the genetic-privacy legislation.

Justia Law

Application to genomic AI:

A sample collected for one medical purpose should not automatically be treated as available for unrelated research.

Statutory exceptions should be interpreted according to their actual scope.

AI developers receiving archived biological samples should examine the original collection authority and applicable consent terms.

Public-health objectives do not, by themselves, resolve every question about secondary data use.

Legal principle: The legality of secondary genomic use depends on the governing statute and the authority under which the sample was collected.

Case 3. Association for Molecular Pathology v. Myriad Genetics, Inc. (2013)

Supreme Court of the United States · 569 U.S. 576

Facts: The dispute concerned patents over isolated DNA sequences associated with the BRCA1 and BRCA2 genes and methods of analysing them.

Decision: The Court held that naturally occurring DNA is not patent-eligible merely because it has been isolated, while synthetically created complementary DNA may be patent-eligible in circumstances described by the judgment.

Application to genomic AI:

Ownership of a physical sample, control over a database, patent rights, and rights in an AI model are legally distinct.

Access to a genomic sequence does not automatically confer exclusive intellectual-property rights over the underlying naturally occurring sequence.

Commercial rights in a dataset or analytical method do not eliminate privacy, confidentiality, consent, or contractual obligations.

Legal principle: Intellectual-property protection over genomic technology must be distinguished from legal control of the personal information used by that technology.

Limitation: Myriad is a patent-law decision, not a general ruling on consent, genomic database ownership, or AI training.

Case 4. S and Marper v. United Kingdom (2008)

European Court of Human Rights · Applications Nos. 30562/04 and 30566/04

Facts: The applicants challenged the indefinite retention of fingerprints, cellular samples and DNA profiles after criminal proceedings had ended without conviction.

Decision: The Grand Chamber found a violation of Article 8 of the European Convention on Human Rights, concerning respect for private life.

Application to genomic AI:

The judgment supports close scrutiny of broad, indiscriminate retention of genetic material and identifiers. A public authority using DNA information to develop or operate AI systems should consider the legal basis, purpose, retention period, necessity and safeguards for affected individuals.

Legal principle: Genetic material and DNA profiles are highly sensitive, and blanket retention without sufficient justification can interfere disproportionately with privacy.

The case concerns public-sector forensic retention rather than commercial model training, so its application to AI is by analogy.

Case 5. Justice K.S. Puttaswamy and Bearder: comparative significance

Read together, the Indian constitutional privacy judgment and the Minnesota genetic-privacy decision illustrate two different but complementary approaches:

Constitutional privacy constrains unjustified state interference with personal information.

Genetic-privacy legislation may impose more specific restrictions on the collection, retention and secondary use of biological samples.

For genomic AI, an organisation must therefore examine both general privacy protections and any more specific rules governing samples, research or genetic information.

Case 6. M/S United India Insurance Co. Ltd. v. Jai Parkash Tayal (2018)

Delhi High Court · genetic discrimination and health insurance

Facts and issue: The dispute concerned the use of genetic testing and genetic-risk information in insurance-related decision-making.

Significance: The Delhi High Court considered the legality of genetic discrimination in the insurance context. However, the Supreme Court stayed the operative judgment, so the High Court's conclusions should not be presented as an unqualified, generally binding prohibition on genetic discrimination throughout India.

npj Genomic Medicine

Application to genomic AI:

AI-generated disease-risk scores could potentially be used to classify applicants or policyholders.

A predicted genetic predisposition should not automatically be treated as proof that a disease is present.

Insurers and model developers must assess applicable insurance law, privacy requirements and anti-discrimination rules.

Automated risk classification may raise questions about fairness, the evidentiary reliability of predictions and the lawfulness of the underlying data processing.

Legal principle: Genetic-risk predictions can create discrimination concerns even when no disease has manifested. The precise legal remedy depends on the applicable law and the status of the relevant judicial decision.

Case 7. In the Matter of 1Health.io Inc. (Vitagene)

US Federal Trade Commission · 2023 enforcement order

Facts: The FTC alleged that a genetic-testing company failed to protect sensitive genetic and health information adequately, misled consumers about deletion practices and retroactively changed its privacy policy without sufficient notice and consent.

Outcome: The FTC finalised an order addressing the alleged privacy and security failures. The agency's case record also describes subsequent consumer refunds.

Federal Trade Commission

Application to genomic AI:

A company must not make misleading promises about data deletion or security.

A privacy policy should not be treated as permission to make unrestricted future uses of genetic information.

Material changes to data use require careful assessment of notice, consent and other applicable legal obligations.

AI developers and their commercial partners should establish enforceable rules for data access, reuse and deletion.

Legal principle: Genetic-data governance can be enforced through consumer-protection law, even when the dispute does not concern a specific AI algorithm.

This is an administrative enforcement matter, not a conventional court judgment on genomic AI.

Case 8. Reyna v. 23andMe, Inc. (2026)

US District Court, Northern District of California · No. 26-cv-00464-EMC · 21 January 2026

Issue: Plaintiffs sought emergency relief in litigation alleging that their genomic information was exposed or at risk following the October 2023 23andMe data breach.

Procedural outcome: The court denied the plaintiffs' motion for a temporary restraining order. This procedural ruling should not be interpreted as a final determination of every underlying privacy or liability claim.

vLex United States

Application to genomic AI:

Breach-response procedures must address the sensitivity and possible long-term consequences of genomic exposure.

Organisations should examine whether compromised data can be linked to identities or relatives.

Contractual and technical safeguards should extend to vendors and downstream recipients.

Litigation outcomes depend on the specific claims, evidence, procedural posture and applicable legal standards.

Legal principle: A cybersecurity incident involving genomic information can raise questions of security, privacy, causation and remedies; denial of emergency relief does not itself establish that the underlying conduct was lawful.

6. The principal legal risks in genomic AI governance

1. Re-identification and privacy leakage

Removing names does not necessarily eliminate genomic privacy risks. An AI model may memorise training examples or reveal sensitive information through its outputs. Appropriate testing should assess membership inference, model inversion and extraction risks where relevant.

2. Familial privacy

A person's genome can reveal information about biological relatives who never directly consented to the research. This creates difficult questions about confidentiality, family notification and competing interests.

3. Discrimination and unfair profiling

Genetic-risk predictions could influence employment, insurance, healthcare access or social treatment. Legal restrictions vary by jurisdiction, and protections in one sector may not apply in another.

4. Unauthorised secondary use

Data collected for diagnosis may later be used to train a commercial model. The organisation must assess the original purpose, legal basis, consent terms, research exceptions and contractual restrictions.

5. Cross-border transfers

Genomic data may pass between hospitals, cloud providers, universities and pharmaceutical companies in different countries. Transfer mechanisms, local restrictions, recipient access and government demands must be assessed.

6. Clinical error and product liability

An inaccurate prediction could cause unnecessary testing, delayed treatment or inappropriate clinical decisions. Responsibility may involve the developer, clinical institution, medical practitioner or other supplier, depending on the facts and governing law.

7. Who is legally responsible?

Responsibility should be allocated according to each party's role, actual conduct, contractual commitments and applicable law.

A contract can allocate responsibilities between parties, but it cannot automatically eliminate statutory obligations or the rights of affected individuals.

8. Practical compliance framework for genomic AI developers

The following is a recommended governance framework, not a substitute for jurisdiction-specific legal advice.

Governance audit checklist

0/10 complete

Inventory genomic datasets, biospecimens and associated clinical records.

Document data provenance, collection authority and applicable consent terms.

Identify the legal basis for model training, fine-tuning and downstream reuse.

Complete a privacy and ethical risk assessment before high-impact processing.

Review population representation, data quality and model performance.

Implement access controls, encryption, audit logs and incident-response procedures.

Document third-party contracts, cross-border transfers and onward disclosure.

Define retention, deletion, model-update and data-subject request procedures.

Establish human oversight, clinical validation and complaint-handling mechanisms.

Review compliance periodically and after material changes to the model or its use.

Reset checklist

Special considerations for foundation models

Genomic foundation models may be trained on extremely large datasets and subsequently adapted to many applications. Governance must therefore extend beyond the original training event.

Important controls include:

Dataset-level restrictions on permitted uses.

Documentation of whether a model was trained on identifiable or pseudonymised genomic data.

Assessment of whether sensitive information can be extracted from model outputs.

Procedures for handling withdrawal requests where legally required and technically feasible.

Controls over model weights, fine-tuning datasets and third-party access.

Review of whether retraining, unlearning or other mitigation is necessary after a legal or security incident.

Deleting a source dataset does not necessarily erase information already encoded in model parameters. Conversely, retaining a model does not automatically constitute unlawful processing: that depends on the information retained, the model's capabilities, the applicable law and the surrounding circumstances.

9. Important legal and ethical distinctions

Three distinctions are especially important in litigation and regulatory analysis.

First, scientific usefulness is not an independent legal basis. A project may offer substantial medical benefits while still requiring lawful processing, ethical review and appropriate safeguards.

Second, accuracy is not equivalent to fairness. A model may predict disease risk accurately for a majority population while producing systematically unreliable results for underrepresented groups.

Third, anonymisation does not resolve every governance question. Even where information no longer qualifies as personal data under a particular law, research commitments, confidentiality rules, contractual restrictions or ethical requirements may continue to apply.

10. Conclusion

Data governance for genomic AI models requires a lifecycle-based approach integrating privacy law, research ethics, cybersecurity, intellectual-property law, clinical safety and anti-discrimination principles.

The leading authorities provide complementary foundations:

Puttaswamy establishes the constitutional importance of privacy in India.

Bearder illustrates restrictions on secondary use of genetic samples under specific legislation.

S and Marper demonstrates the privacy concerns associated with disproportionate retention of DNA information.

Myriad Genetics distinguishes patent eligibility from other forms of control over genomic information.

Jai Parkash Tayal illustrates the unresolved complexities of genetic discrimination in Indian insurance law.

The FTC's 1Health.io matter demonstrates that deficient genetic-data security and misleading privacy practices can attract enforcement.

The EU AI Act provides a more explicit data-governance framework for AI systems falling within its high-risk provisions.

The governing principle is that genomic AI innovation must be supported by demonstrable lawful data access, purpose-specific governance, proportionate security, reliable model validation and accountability for foreseeable harm. No single case establishes a universal rule for every genomic AI system; the outcome depends on the relevant jurisdiction, the intended use and the facts.

Selected legal sources

Justice K.S. Puttaswamy v. Union of India — (2017) 10 SCC 1.

Bearder v. State of Minnesota — 788 N.W.2d 144.

Association for Molecular Pathology v. Myriad Genetics, Inc. — 569 U.S. 576.

S and Marper v. United Kingdom — Applications Nos. 30562/04 and 30566/04.

Digital Personal Data Protection Act, 2023 — Official India Code text.

EU Artificial Intelligence Act — Official EU legislation.

1Health.io / Vitagene FTC matter — FTC case record.