Artificial intelligence has demonstrated the capacity to summarize documents, identify inconsistencies, organize schedules, detect patterns, and support complex analyses. In the field of occupational health, these capabilities can reduce repetitive workloads and improve information availability. However, significant risks arise when sensitive data is transmitted to uncontrolled tools or when algorithmic recommendations are mistakenly treated as definitive medical decisions. The strategic focus for organizations should not be on whether to use AI, but rather on defining its specific purpose, the data involved, the responsible parties, and the mechanisms for review. As the impact on worker health, fitness, employment, and rights increases, the necessity for rigorous governance grows proportionally.
A pivotal development occurred on February 27, 2026, when the Federal Council of Medicine (CFM) published Resolution No. 2.454/2026. This regulation establishes norms for the research, development, governance, auditing, monitoring, training, and responsible use of AI in medicine. Although published, the resolution is currently in a transition period and will officially enter into force 180 days after publication, placing its effective date in July 2026. The norm permits AI as a support tool for clinical decision-making and health management but explicitly maintains the final authority with the physician. Key requirements include clear patient information regarding AI involvement, recording of AI usage as decision support, risk classification, human supervision, and data protection.
While the General Data Protection Law (LGPD) and applicable sanitary rules are already in force, the specific CFM resolution is not yet mandatory until its transition period concludes. Nevertheless, organizations are advised to prepare for these standards immediately. AI can generate value across several areas: administrative routines such as document classification and scheduling; information quality by detecting duplicates or missing data; aggregated analysis of trends in exams and absenteeism without exposing individual records; medical support through reference retrieval and hypothesis generation; and communication by adapting preventive materials for different audiences. However, these benefits are not automatic. Summaries may omit critical details, models can reproduce biases, and correlations might be misinterpreted as causality. Speed gains only translate to quality improvements when accompanied by validation, defined limits, and accountability.
Three specific zones require maximum caution in AI deployment. First, health data such as medical records, reports, and diagnoses must not be copied into open tools lacking appropriate contracts, security, and governance. Second, automated scores should never independently decide a worker's fitness, restrictions, or readiness to return to work. Third, profiling workers to infer mental health status, risk of absence, productivity, or reliability for selection or disciplinary purposes can violate rights and amplify discrimination. The LGPD classifies health data as sensitive personal information, guaranteeing rights against decisions based solely on automated processing that affect the individual's interests. The National Data Protection Authority (ANPD) recommends conducting a Personal Data Protection Impact Report in high-risk contexts, including large-scale processing of sensitive data or exclusively automated decisions.
Furthermore, not all software used in health sectors qualifies as a medical device. However, if a solution's declared purpose and functionality classify it as Software as a Medical Device, it becomes subject to sanitary requirements from Anvisa, including RDC No. 657/2022. This classification must be verified before contracting or implementation, not assumed based on the presence of the term "artificial intelligence." Procurement diligence must extend beyond commercial demonstrations to include validation methods, target populations, performance metrics, limitations, regulatory updates, data storage locations, and failure investigation protocols.
A proposed governance model relies on eight controls: maintaining an inventory of tools and data; classifying risks based on clinical impact and rights; validating performance in real contexts before scaling; defining human authority to accept or reject recommendations; implementing strict data protection measures; ensuring transparency regarding usage and limitations; monitoring for errors, biases, and incidents; and establishing contingency plans with objective criteria for suspension. Safe pilot projects should begin small, using controlled data with restricted purposes and reversible impacts, such as checking record completeness or producing aggregated indicators, always compared against current processes with human review. Expansion of scope should only occur after demonstrating quality and safety.
Corpmed, an organization operating in occupational health and safety since 2006, notes that AI must expand the technical capacity of teams without obscuring who is responsible for decisions. Their approach involves supporting companies in selecting use cases, integrating data, reviewing workflows, and establishing governance tailored to existing systems and risk profiles. The technical responsibility for Corpmed lies with Giselle Galdino da Rocha Almeida (CRM/SP 115.157 - RQE 43.521).
Sources: G1.