Governing neuro-AI

The emergence of neuro-AI infrastructures creates new possibilities for inference, prediction, classification and consequential downstream uses across medical, research, workplace, educational, security and consumer settings.

The policy challenge is not limited to individual devices or downstream applications. It concerns a whole infrastructure of data pipelines, model architectures, institutional incentives, market structures, dual-use trajectories and regulatory mechanisms through which neuro-AI systems are made possible. An infrastructural approach therefore calls for anticipatory and systemic forms of governance that address upstream questions concerning data governance, control and access regimes, interoperability standards, public oversight, institutional accountability and the societal purposes toward which neuro-AI infrastructures are directed. Such governance should be aligned with the protection of fundamental rights, democratic accountability and the public interest.

Neurodata should be understood not only as a technological resource but also as a political-economic one, creating value through model training, prediction and classification while raising concerns regarding market concentration, dependency and digital sovereignty.

Neuro-AI infrastructures also raise ethical and fundamental rights concerns that extend beyond individual privacy, informed consent and autonomy to collective profiling, group-level bias, institutional decision-making and the broader societal impacts of reusable models and inference systems.

Neuro-AI infrastructures require a systemic and anticipatory approach to governance. It cannot rely solely on the regulation of individual devices, applications or downstream harms, but should address the upstream conditions of data governance, model development, platform infrastructures and cross-contextual reuse.

Based on ethical analysis, the European Group on Ethics in Science and New Technologies recommends that EU policymakers should:

• Explicitly list neurodata and neurodata-derived inferences as a distinct category of sensitive data, with protection covering both raw brain data and inferences generated from it, and governance addressing secondary use of neurodata, collective profiling, predictive modelling, and commercial exploitation beyond consent alone.
• Establish specific governance requirements for Brain Foundation Models, Human (centric) Foundation Models, and neuro-AI infrastructures, including technical standards, audit mechanisms and accountability systems, documented neurodata provenance used for AI training, lawful processing basis and clear access and reuse conditions, and safeguards for downstream use, dual-use risks, and fair benefit sharing.
• Establish clear prohibitions where neuro-AI systems are used in consequential contexts, including uses involving manipulation, coercion, exploitation of vulnerabilities, and discriminatory profiling, while requiring human oversight, transparency about uncertainty, independent audits, and the ability to challenge decisions.
• Build European public-interest governance capacity for neuro-AI infrastructure through monitoring and foresight, certification systems, regulatory sandboxes, public dialogue, and clear accountability and coordination between EU and national authorities, while reducing risks of excessive market concentration and dependence on non-European technology platforms.
• Conduct a targeted review of existing regulatory frameworks to prevent loopholes and ensure neuro-AI develops responsibly.