1. Introduction
Artificial intelligence (AI) and data-driven technologies have rapidly transformed the field of digital health, enabling new forms of accessibility, personalization, and continuity of care (Reference Lattie, Stiles-Shields and GrahamLattie et al., 2022). Within this expanding domain, AI-driven mental health interventions have attracted increasing interest for their potential to support psychological well-being at scale. However, as these technologies become more autonomous and integrated into clinical practice, they also introduce complex ethical, legal, and procedural challenges related to privacy, accountability, and reliability (European Parliament & Council of the European Union, 2017a). This is especially critical for mental health interventions, because their purpose, functionality, and evidence requirements are often less clearly defined than in other areas of digital health, creating additional challenges for regulation and evaluation (Reference Hopkin, Branson, Campbell, Coole, Cooper, Edelmann and SalmonHopkin et al., 2024). While the present study focuses on AI-driven digital mental health interventions, the proposed regulatory mapping approach is intended to be applicable to other digital health domains facing similar regulatory and design complexities.
In the European Union (EU), these challenges are addressed through an extensive and evolving set of legislative frameworks. Major regulations such as the General Data Protection Regulation (GDPR), the Artificial Intelligence Act (AI Act), the European Health Data Space (EHDS), the Health Technology Assessment Regulation (HTA), and the Medical Devices Regulation (MDR) define the principles that govern safety, transparency, and ethical accountability in digital health technologies (European Parliament & Council of the European Union, 2016; 2017a; 2021a; 2024a; European Commission: Directorate-General for Health and Food Safety, 2024b). While these frameworks aim to ensure trust and public protection, their coexistence also creates complexity for designers and researchers working within regulated innovation contexts. Each regulation addresses overlapping dimensions of data use, clinical validation, and ethical design, often leading to interpretive uncertainty and procedural burden.
Designing digital mental health interventions within this regulatory landscape therefore requires more than technical or creative expertise; it demands an integrated understanding of how legal and ethical frameworks shape the design process itself (Reference Gray, Gairola, Boucaud, Hashmi, Chivukula, Menon and DuaneGray et al., 2024). Yet, despite growing recognition of this need, most existing design methodologies treat regulation as an external constraint rather than a generative resource for innovation. This separation limits the ability of designers to anticipate compliance issues and embed ethical and legal considerations early in the design process.
To address this gap, the present study proposes a regulatory mapping approach that interprets and visualizes how EU regulations influence the design of AI-driven digital mental health interventions. The aim of this study is to develop a structured and visual framework that supports designers in understanding and applying regulatory principles throughout the design process. To achieve this, the research questions are formulated as follows:
-
1. How can EU regulatory frameworks be mapped and represented to clarify their influence on the design of AI-driven digital mental health interventions?
-
2. How can this mapping approach support the integration of regulatory awareness into design practice?
By translating complex regulatory requirements into a structured design-oriented representation, this study seeks to advance understanding of how regulation can inform and guide design practice. The approach contributes conceptually by reframing regulation as a guiding framework for design, and methodologically by offering a process for integrating regulatory awareness into the development of responsible and trustworthy digital mental health technologies.
2. Related background: regulatory landscape and design challenges
2.1. EU regulatory landscape for digital mental health
The regulation of digital health technologies in the European Union (EU) is shaped by several interrelated legislative frameworks. Together, these frameworks define the principles that ensure safety, transparency, and accountability in the development and application of AI-driven interventions (European Parliament & Council of the European Union, 2017a; 2021a; 2024a). The General Data Protection Regulation (GDPR) establishes requirements for data privacy and user consent, forming the foundation for all data-related processes in digital mental health. The Artificial Intelligence Act (AI Act) introduces specific provisions for AI systems, focusing on risk categorization, human oversight, and algorithmic transparency (European Parliament & Council of the European Union, 2024a). Complementing these, the European Health Data Space (EHDS) aims to create a unified environment for data exchange and secondary use within the health domain (European Commission: Directorate-General for Health and Food Safety, 2024b).
In addition, frameworks such as the Health Technology Assessment Regulation (HTA), Medical Devices Regulation (MDR), and In-Vitro Diagnostic Devices Regulation (IVDR) govern the safety, performance, and clinical validation of health-related products (European Parliament & Council of the European Union, 2017a; 2017b; 2021a). Together, these frameworks define the compliance environment for AI-based digital mental health solutions, balancing the protection of individuals with the encouragement of innovation. However, their overlapping requirements often generate ambiguity. For example, both the GDPR and the AI Act include transparency obligations but differ in their interpretation. The GDPR focuses on the rights of data subjects, while the AI Act emphasizes explainability in automated decision-making. Such overlaps can lead to redundancy in compliance activities and uncertainty for designers attempting to operationalize these principles in practice.
While previous research has examined regulatory implications for healthcare technology at a policy level, little attention has been given to how such frameworks can be interpreted within the context of design practice (Reference Lattie, Stiles-Shields and GrahamLattie et al., 2022; Reference Gray, Gairola, Boucaud, Hashmi, Chivukula, Menon and DuaneGray et al., 2024). Understanding this relationship is critical, as it determines how designers and developers navigate complex requirements and translate them into meaningful design decisions.
2.2. Challenges and approaches to integrating regulations in design
Research in human–computer interaction (HCI) and digital health has highlighted the potential of AI-driven interventions but also the challenges of incorporating regulatory requirements into design practice. The dynamic nature of regulation poses a significant barrier; as new technologies emerge, laws are frequently updated or expanded to address unforeseen risks (Reference Vincent, Niezen, O’Kane and StawarzVincent et al., 2015). For example, amendments to the AI Act that introduce stricter transparency obligations for AI tools may require designers to modify user interfaces, retrain models, or redesign consent management processes. This constant evolution makes it difficult for design teams to remain compliant and up to date with the latest interpretations (Reference Gray, Gairola, Boucaud, Hashmi, Chivukula, Menon and DuaneGray et al., 2024).
Another major challenge lies in the overlap of regulatory frameworks (Reference Robb, Deane and CandyRobb et al., 2022). Regulations that target similar ethical or procedural issues often use different terminologies, thresholds, and evaluation methods. In the context of digital mental health, the GDPR and the AI Act both emphasize transparency, yet they diverge in scope. The GDPR focuses on privacy and consent, whereas the AI Act prioritizes human oversight and accountability. Designers must therefore reconcile multiple, and sometimes conflicting, regulatory logics when conceptualizing and evaluating new interventions.
Various approaches have been proposed to address these challenges. From a design perspective, scholars emphasize the need to embed regulatory awareness directly into the design workflow (Reference PriftiPrifti, 2024). Co-design research also points to the value of interdisciplinary collaboration, where expertise from law, ethics, and digital health can inform the design process (Reference Zicari, Ahmed, Amann, Braun, Brodersen, Bruneault and WurthZicari et al., 2021). From a policy standpoint, regulatory sandboxes have been introduced as controlled environments for testing innovations under supervision (Reference Allen and SandboxesAllen, 2019). These spaces allow designers and regulators to experiment together, reducing compliance risks while maintaining flexibility (Datasphere Initiative, 2022). Nevertheless, regulation is still often perceived as a constraint that limits creative exploration (Reference MoraesMoraes, 2024). Excessive focus on compliance may inadvertently stifle innovation, leading to rigid processes and reduced adaptability.
Collectively, existing literature reveals a persistent tension between innovation and compliance. Yet, few studies address how these regulatory frameworks can be systematically represented or visualized to guide design practice. This study seeks to address that gap by proposing a regulatory mapping approach that structures and interprets regulatory principles within the design process, offering a tool for designers to navigate complexity and translate policy into actionable design knowledge.
3. Methodology: developing the regulatory mapping approach
This study develops a regulatory mapping approach to systematically examine how European Union (EU) regulations influence the design and evaluation of AI-driven digital mental health interventions. The approach was designed to structure regulatory complexity and to visualize how design processes can integrate compliance considerations without constraining innovation. Rather than validating a finished model, the study focused on the conceptual and procedural development of the framework through iterative desk research, mapping, and assisted analysis.
An overview of the methodological process adopted in this study is presented in Table 1, which summarizes the two main phases: Insight Generation and Mapping Creation, together with their corresponding activities, data sources, and analytical methods.
The first phase (P1 in Table 1), Insight Generation, involved a comprehensive review of relevant EU regulations (L1) and literature on e-mental health interventions (L2). This phase aimed to develop a foundational understanding of key regulatory requirements and their implications for digital mental health design. Six major EU frameworks were analyzed: the General Data Protection Regulation (GDPR), the Artificial Intelligence Act (AI Act), the European Health Data Space (EHDS), the Health Technology Assessment Regulation (HTA), the Medical Devices Regulation (MDR), and the In-Vitro Diagnostic Devices Regulation (IVDR).
For the regulations review (L1), regulatory documents were first read in full to build a general understanding of their scope and intent. During this reading, the researcher manually highlighted and annotated regulatory passages that appeared particularly relevant to digital mental health interventions (e.g., passages referring to transparency, human oversight, data protection, or risk management). In addition, online summaries and explanatory sources were browsed to better understand relationships and distinctions between major regulations (e.g., differences in scope between the GDPR and the AI Act). To complement this, academic and grey literature on digital mental health was reviewed to identify how these regulatory frameworks are interpreted and applied in practice (L2). This review helped situate the regulatory analysis within real-world digital mental health practices and informed the interpretation of regulatory domains (e.g., data governance, safety and efficacy, ethical oversight) that were later structured in the mapping framework.
The second phase (P2 in Table 1), Mapping Creation, focused on translating these insights into a structured representation of how EU regulations interact with the design process. The overall structure of the regulatory map (L3) was developed by identifying and grouping key regulatory themes from each framework. First, the researcher conducted open coding on the highlighted excerpts from P1, distilling them into descriptive keywords and themes for each regulation (e.g., data processing for GDPR, risk management for the AI Act). In parallel, the Medical Research Council’s (MRC) framework for developing and evaluating complex interventions (Reference Skivington, Matthews, Simpson, Craig, Baird, Blazeby and MooreSkivington et al., 2024) was adopted to define the stage-based structure of the map, consisting of four design stages: development, feasibility, evaluation, and implementation. This framework was selected because it offers a well-established, stage-based structure for complex health interventions, enabling regulatory considerations to be systematically mapped to different phases of the design process.
Research process and methodology for regulatory mapping
Next, the structural framework was populated with detailed regulatory content (L4) specifically tailored to AI-driven digital mental health chatbots. Regulatory documents, the themes identified in L3, and the MRC framework were provided to a chat-based large language model (LLM) to generate an initial stage-based alignment. The researcher used iterative prompting to refine this alignment; for example: ‘Based on the provided EU regulations and the MRC framework, align key regulatory considerations with each stage of the framework for an AI-driven mental health chatbot. Refer to the provided keywords while identifying any additional requirements from the documents.’ These LLM-generated outputs were synthesized into a structured summary table, which was then used by the researcher to cross-check the AI’s suggestions against the original regulatory themes. All LLM-generated outputs were reviewed and refined by the researcher before being consolidated into a final table, which served as the conceptual blueprint for the visual mapping presented in Figure 1.
4. Pilot mapping results
The pilot regulatory mapping (Figure 1) illustrates how European Union (EU) regulations influence the development of AI-based mental health chatbots. The mapping was structured according to the Medical Research Council’s framework for developing and evaluating complex interventions (Reference Skivington, Matthews, Simpson, Craig, Baird, Blazeby and MooreSkivington et al., 2024), which consists of four iterative phases: development or identification of intervention, feasibility, evaluation, and implementation. Alongside core contextual considerations, these phases are designed to inform each other throughout the design process. By situating regulatory requirements within these stages, the mapping visualizes where and how EU frameworks intersect with the design of AI-driven mental health technologies.
Mapping of key EU regulations across the development and evaluation process of an AI-driven mental health chatbot (adapted from Reference Skivington, Matthews, Simpson, Craig, Baird, Blazeby and MooreSkivington et al., 2024)
In the development or identification phase, the GDPR establishes principles of data minimization, informed consent, and anonymization, while the AI Act introduces transparency and traceability obligations in algorithmic decision-making (European Parliament & Council of the European Union, 2017a; 2021a). The EHDS promotes data accessibility within healthcare systems, and the HTA emphasizes behavioral and societal assessments for early-stage interventions. The MDR and IVDR ensure that AI-based tools meet clinical safety and validation standards prior to deployment.
During the feasibility phase, the GDPR enforces privacy and security safeguards during data collection and pilot testing. The AI Act requires risk assessment and bias mitigation to ensure fairness and equitable performance. The EHDS enables secure data exchange between clinical and digital systems, while the HTA calls for comparative studies to assess intervention effectiveness. The MDR and IVDR guide safety classification and risk documentation processes throughout pilot evaluations (European Parliament & Council of the European Union, 2017a; 2017b).
In the evaluation phase, the GDPR maintains requirements for transparency and user control, including rights to explanation and data withdrawal. The AI Act emphasizes human oversight to prevent errors in automated systems, and the EHDS supports data traceability for clinical evaluation. The HTA focuses on cost-effectiveness and societal benefit assessments, while both the MDR and IVDR extend compliance to post-market safety monitoring and interoperability with diagnostic systems.
Finally, the implementation phase concentrates on regulatory adherence during deployment and long-term maintenance. The GDPR guarantees users’ rights to data deletion and the right to be forgotten, while the AI Act mandates post-market monitoring to ensure algorithmic reliability. The EHDS manages secondary data use and interoperability standards, the HTA supports policy alignment across national healthcare systems, and the MDR and IVDR sustain oversight through clinical follow-up and reporting requirements.
The pilot mapping (Figure 1) reveals the cumulative and interdependent nature of these regulatory influences across all stages of the design process. Instead of functioning as isolated checkpoints, the regulations operate as an interconnected network that continuously shapes design decisions, ethical reviews, and validation requirements throughout the lifecycle of digital mental health interventions. This visual mapping therefore offers an initial structured representation of how compliance considerations evolve across the design process, establishing a foundation for the discussion of emerging tensions and opportunities in the next chapter.
5. Discussion and conclusion
This study developed a regulatory mapping approach to examine how six key EU regulations influence the design of AI-driven digital mental health interventions. Using a two-phase process, the study first generated foundational insights through a review of regulatory and e-mental health literature, and then constructed a draft Process–Regulation Map through thematic grouping and researcher-guided iterative content mapping. By aligning the mapped regulatory requirements with the Medical Research Council’s framework for developing and evaluating complex interventions (Reference Skivington, Matthews, Simpson, Craig, Baird, Blazeby and MooreSkivington et al., 2024), the pilot results demonstrate how regulations shape different stages of the design process, using an AI-based mental health chatbot as an illustrative example. Overall, this work shows how structured regulatory mapping can support more reflective, responsible, and compliance-aware digital mental health innovation.
Building on these findings, the following discussion synthesizes the key insights, highlighting the tensions and opportunities that inform the development of regulatory-aware design methodologies. In addition, this section outlines the study’s contributions and implications for design practice, as well as key limitations and directions for future research.
5.1. Tensions between regulations and digital mental health design
The mapping results emphasize several tensions that emerge when regulatory requirements are integrated into the design processes of AI-based mental health interventions.
5.1.1. Innovation versus compliance
While regulations uphold safety, transparency, and accountability, balancing innovation with compliance remains a persistent challenge (Reference Smith, Graham, Morgan and MacLachlanSmith et al., 2023; Reference Tartaro, Panai and CocchiaroTartaro et al., 2024). Agile development cycles often conflict with the rigidity of regulatory processes. Startups and smaller organizations face disproportionate compliance burdens, whereas larger institutions, despite having greater resources, struggle to maintain design flexibility (Reference Lim and AndersonLim & Anderson, 2016).
5.1.2. User accessibility versus regulatory timelines
Digital mental health tools have the potential to expand access to care for underserved populations (Reference Lattie, Stiles-Shields and GrahamLattie et al., 2022; Reference BalcombeBalcombe, 2023). However, lengthy approval and reimbursement procedures, particularly under the HTA and MDR, delay deployment and undermine early-intervention benefits (Reference Desmet, Brijs, Vanderdonck, Tops, Simoens and HuysDesmet et al., 2024; MHM Group, 2024). Regulatory timelines often fail to match the pace and adaptability required in digital mental health design.
5.1.3. User-centered flexibility versus regulatory standardization
Although standardization ensures reliability and user protection, it can restrict personalization and cultural adaptability. Digital interventions frequently require contextual tailoring, yet existing regulations tend to favor uniform criteria (Reference Van Daele, Karekla, Kassianos, Compare, Haddouk, Salgado and De WitteVan Daele et al., 2020; Reference Rassi-Cruz, Valente and CanizaRassi-Cruz et al., 2022). This creates tension between ensuring safety and enabling context-sensitive innovation.
5.2. Opportunities for design through regulation
Despite these challenges, the regulatory mapping also reveals opportunities to use regulation as a design-enabling tool rather than merely a constraint. Regulations have often been perceived as mechanisms that control or restrict technological innovation (Reference MosesMoses, 2013), making compliance appear burdensome for emerging digital solutions. However, this study suggests that regulations can be reframed as structural guides that support reflection and informed decision-making in design.
5.2.1. Regulations as structured design checkpoints
Regulatory frameworks can function as structured checkpoints throughout the design process, guiding ethical reflection and verification at each stage of development. For example, the GDPR’s emphasis on data minimization and consent can encourage designers to integrate privacy features early during prototyping. Similarly, the AI Act’s requirements for human oversight can inform iterative testing procedures and user interface design.
5.2.2. Regulation as methodological scaffolds
Compliance frameworks can be reinterpreted as methodological supports that structure co-design processes. The MDR and IVDR emphasize validation and safety assessment, encouraging collaboration with clinical and ethical experts throughout development. The AI Act’s monitoring provisions promote continuous feedback and re-evaluation, reinforcing iterative design thinking within regulated environments.
By reframing regulatory compliance as a guiding design tool, designers can use regulatory insights to foster innovation and informed decision-making across the design process. Regulations can thus serve not as external constraints but as design guides that shape reflection and creativity. Translating regulatory principles such as transparency, validation, and human oversight into design checkpoints enables designers to embed compliance within creative workflows, supporting innovation through structure and trust.
5.3. Contributions and design implications
This study provides a structured overview of how EU regulatory frameworks influence the design and evaluation of AI-driven digital mental health interventions. By aligning regulatory requirements with the Medical Research Council’s framework for complex interventions (Reference Skivington, Matthews, Simpson, Craig, Baird, Blazeby and MooreSkivington et al., 2024), the mapping approach strengthens the applicability of compliance-aware methodologies within design research. More broadly, it contributes to the discourse on how design mediates between technological innovation, ethical accountability, and regulatory governance.
The mapping framework has three key implications for design practice. First, structuring complexity: the framework helps designers translate fragmented legal requirements into coherent, visual insights, clarifying when and where compliance considerations arise. Second, embedding compliance: incorporating regulatory checkpoints into early design workflows allows ethical and legal considerations to evolve in parallel with innovation, rather than as reactive steps. Third, fostering collaboration: the mapping serves as a boundary object among designers, engineers, and regulatory experts, strengthening communication and supporting co-creative decision-making across disciplines.
Through these contributions, the study reframes regulatory awareness as a design opportunity rather than a limitation. It encourages a more reflective, responsible, and collaborative approach to digital mental health innovation. These implications position the framework as a practical guide for anticipating regulatory considerations and informing decision-making throughout the design and evaluation of AI-driven digital mental health interventions. Specifically, the framework functions as a proactive filter that helps design teams manage regulatory complexity by prioritizing stage-relevant information. For example, during the feasibility and development stages of an AI-driven mental health chatbot, designers can use the framework to focus on immediate priorities such as data protection and consent requirements under GDPR or transparency obligations under the AI Act. At the same time, later-stage requirements such as post-market surveillance or certification procedures can be deprioritized. This supports a more manageable and structured engagement with regulatory considerations, preventing cognitive overload and allowing compliance to evolve in parallel with the design process.
5.4. Limitations and future study
While this study provides valuable insights into the relationship between regulation and design, several limitations should be acknowledged. First, the framework remains a conceptual exploration rather than an empirically validated methodology. Its interpretation of EU regulations may evolve as amendments emerge in data protection, AI governance, and health technology assessment frameworks. Second, the analysis is limited to an EU-wide perspective and does not account for national differences in interpretation and enforcement. Third, empirical validation through real-world case studies or expert workshops is necessary to assess the framework’s practical usability and relevance.
Future research should prioritize refining and validating the regulatory mapping approach through co-creation with experts in data governance, AI ethics, and healthcare regulation. Engaging multiple stakeholders will help ensure that the framework remains adaptable to dynamic policy environments. Additionally, grouping regulatory principles under cross-cutting themes such as transparency, safety and efficacy, privacy and data protection, and interoperability could help designers translate complex legal requirements into actionable design criteria. Continued iteration will support the evolution of regulatory-aware design methodologies that balance innovation with ethical and societal responsibility.
Acknowledgement
AI tools were used in this study to assist in analyzing regulatory frameworks and generating structured mappings. All AI-generated content was reviewed and refined by researchers to ensure accuracy, relevance, and compliance with the study’s objectives.
Open access
