On 30 September 2026 the European Medicines Agency (EMA) announced the outcome of the multi-stakeholder workshop on women’s health held in Amsterdam on 28 and 29 September: participants identified ten priority actions, which will feed into a regulatory roadmap and a report to be published by the end of 2026 (EMA). The actions include greater enrolment of women in clinical trials with high-quality sex-disaggregated data, a sustainable infrastructure for real-world data and training of the regulatory network on sex- and gender-sensitive assessment; as early as 2 July the Agency had attributed the situation also to gaps in understanding sex-based differences in disease and in treatment effects (EMA). Trials and real-world data are also the raw material of artificial intelligence systems in healthcare, and recital 67 of Regulation (EU) 2024/1689, the AI Act, warns that biases inherent in data sets may “perpetuate and amplify existing discrimination” (EUR-Lex). We examine where the rules require the representativeness of data by sex to be measured and where they leave it to interpretation.
Clinical research: the rules that name the sex of subjects
Regulation (EU) No 536/2014 on clinical trials on medicinal products states the principle of representativeness in recital 14: unless otherwise justified in the protocol, the subjects “should represent the population groups, for example gender and age groups, that are likely to use the medicinal product investigated in the clinical trial”. The binding rule lies in the annexes: the protocol includes “a justification for the gender and age allocation of subjects” and explains the reasons for any exclusion or under-representation of a group (Annex I, point 17(y)); the summary of results reports the “age group breakdown, gender breakdown” and includes gender among the required baseline characteristics (Annex IV) (EUR-Lex).
For medical devices, Regulation (EU) 2017/745 requires the application for a clinical investigation to indicate “the number and gender of subjects” and the clinical investigation plan to describe the “representativeness of investigation population in relation to target population” (Annex XV, Chapter II, Sections 1.11 and 3.6.3) (EUR-Lex). In Italy, Law No 3 of 11 January 2018 delegated to the Government the reform of clinical trials, providing among the criteria “that clinical trials of medicinal products be conducted with adequate gender representativeness” (our translation) (Article 1(2)(h), point 3) and, in Article 3, a plan to spread practices which “in research, prevention, diagnosis and treatment take account of the differences deriving from gender” (Official Gazette (Gazzetta Ufficiale)).
Of the rules examined, only those on clinical research expressly name the sex of subjects. This has a sequel in the European Health Data Space: Article 51(1)(m) of Regulation (EU) 2025/327, the EHDS, includes among the categories for secondary use data from clinical trials and clinical investigations, applicable from 26 March 2031 (Article 105) (EUR-Lex).
The EHDS: the quality label and the minimum metadata of datasets
We have illustrated the EHDS’s distinction between primary use, secondary use and prohibited uses; what matters here is Article 78, whose link with the AI Act for the training of systems we have also examined in health data and AI training. The data quality and utility label, mandatory for datasets collected with the support of Union or national public funding, covers, where applicable, data quality management processes, “including review and audit processes, and bias examination”, and the assessment of coverage: “the period, population coverage and, where applicable, representativity of the population sampled”. The Commission may amend the elements of the label by delegated acts and must set out, by 26 March 2027, by means of implementing acts, its visual characteristics and technical specifications, taking into account the requirements of Article 10 of the AI Act (EUR-Lex). At the time of writing, a search of EUR-Lex returns no implementing acts on the label. None of the elements listed in Article 78 names sex; in the Italian text of the Regulation the word “sesso” (sex) never occurs and “genere” (gender) appears only once, in the adverbial phrase “in genere” (generally), while the English text contains neither “sex” nor “gender”.
Commission Implementing Regulation (EU) 2026/2098 of 18 September 2026, published on 21 September and applicable from 26 March 2029, lays down the minimum metadata that holders must provide to describe datasets: among others, the estimated number of unique individuals, geographic and temporal coverage and a structured description of the variables with name, definition and data type. No element concerns the composition of the dataset by sex; Article 1(3) allows holders to provide additional metadata on a voluntary basis (EUR-Lex). In our view, the catalogue will show whether a dataset records sex, not how people are distributed within it: the composition by sex of a health dataset is not a mandatory metadata element. The natural place for this information is the label element on the representativity of the population sampled. Since recital 54 recognises the tension between exhaustive and representative datasets and the right to opt out of secondary use (Article 71), we consider that the label should also account for the effect of opt-outs on the composition of the dataset.
Article 10 of the AI Act: representativeness of data sets and groups of persons
Article 10 of the AI Act subjects the training, validation and testing data sets of high-risk systems to governance practices which include “examination in view of possible biases that are likely to affect the health and safety of persons”, measures to “detect, prevent and mitigate” such biases and “the identification of relevant data gaps or shortcomings” (paragraph 2, points (f), (g) and (h)). Data sets must be “sufficiently representative” and have “the appropriate statistical properties, including, where applicable, as regards the persons or groups of persons” in relation to whom the system is intended to be used (paragraph 3). The instructions for use indicate, when appropriate, the system’s “performance regarding specific persons or groups of persons” on which it is intended to be used (Article 13(3)(b), point (v)) (EUR-Lex).
Sex is not named in these provisions: recital 67 cites racial or ethnic groups as an example, and sex appears only in connection with biometric systems (for example in recital 16). The criterion in Article 10 is relative to the intended purpose, not to a closed list of characteristics. For a diagnostic system intended for women and men, however, sex is among the first groups in respect of which statistical properties should be verified: in our view, a bias examination that does not disaggregate results by sex can hardly demonstrate the required representativeness. Performance broken down by sex is also the information that, through the instructions for use, enables the healthcare facility acting as deployer to assess the system.
Regulation (EU) 2026/1744, the Digital Omnibus on AI, deleted paragraph 5 of Article 10 and moved its content to the new Article 4a: providers may exceptionally process special categories of personal data to detect and correct biases, only where this cannot be achieved “by processing other data, including synthetic or anonymised data”; paragraph 2 extends the possibility to other providers and to deployers, specifying that it “does not create any obligation to conduct such bias detection and correction” (EUR-Lex). As Nicola Fabiano observes (NicFab), the possibility, placed in Chapter I, operates from the entry into force of the amending Regulation, on 27 July 2026, before the Article 10 obligation it serves; the necessity of the processing must be justified in the records of processing activities (paragraph 1, point (f)). Whether synthetic data are truly anonymous is a question we examined with regard to patients’ digital twins. The same Regulation sets the application of the rules on high-risk systems at 2 December 2027 for Annex III and at 2 August 2028 for Annex I, which in Section A includes the Regulations on medical devices and on in vitro diagnostic medical devices subject to third-party conformity assessment (Article 6(1)).
Critical aspects: the text of the rules, medical devices, the timetable and terminology
The first aspect is textual. Neither Article 10 of the AI Act, nor Article 78 of the EHDS, nor Regulation 2026/2098 names sex: its relevance derives from the interpretation of the criterion of “groups of persons” and, for the label, from implementing acts not yet adopted.
The second concerns medical devices. The new Article 2(13) of the AI Act allows the obligations in, among others, Articles 9 to 15 to be limited for systems under Article 6(1) where the harmonisation legislation in Section A of Annex I ensures an equivalent or higher level of protection, and requires the Commission to adopt the relevant delegated acts by 2 August 2027 (EUR-Lex). Regulation 2017/745 governs the representativeness of the population of a clinical investigation, not that of training data sets: in our view, equivalence with Article 10 cannot disregard the representativeness of the data by sex.
The third is the timetable: obligations for Annex I systems from 2 August 2028; quality label and minimum metadata from 26 March 2029, the date from which Chapter IV of the EHDS on secondary use applies (Article 105; see NicFab); clinical trial data from 26 March 2031. The rules on clinical research, by contrast, already apply.
The fourth is terminological. In its Italian version, Regulation 536/2014 speaks of groups “per sesso” (by sex) in recital 14 and of “genere” (gender) in the annexes, whereas the English version uses “gender” in both places, as does the English version of Regulation 2017/745 where the Italian text reads “sesso”; Law No 3 of 2018 speaks of “gender representativeness”; the Istituto Superiore di Sanità (ISS), Italy’s National Institute of Health, recalls the WHO definition, which distinguishes biological differences “(defined by sex)” from socio-economic and cultural ones “(defined by gender)” (ISS). Data documentation that does not specify which of the two variables it records does not allow its representativeness to be verified.
Conclusions
The rules on clinical research already require the composition of subjects by sex to be justified and documented; the EHDS and the AI Act require representativeness and bias examination without naming sex. Sponsors remain bound by the obligations of Regulation 536/2014, holders of publicly funded datasets by the label under Article 78 and providers of high-risk systems by data governance and the instructions for use; the implementing acts on the label, the delegated acts on limitations for Annex I products and the EMA roadmap are still missing. Data holders and providers would be well advised to record sex and gender as distinct variables, to describe the distribution by sex among the voluntary metadata and in the dataset documentation, and to report performance metrics disaggregated by sex in the technical documentation and in the instructions for use.
Author: Valentina Grazia Sapuppo
