Governing Generative AI in Healthcare: A Normative Conceptual Framework for Epistemic Authority, Trust, and the...

Large language models (LLMs) such as ChatGPT are rapidly being integrated into healthcare for tasks ranging from clinical documentation to diagnostic support. Current ethical discussions focus predominantly on bias, privacy, and accuracy, leaving three critical governance questions unresolved: What kind of knowledge does an LLM output represent in clinical reasoning? When is a clinician's or patient's trust in that output justified? Who bears responsibility when an AI-informed decision leads to patient harm? This study proposes the Epistemic Authority-Trust-Responsibility (ETR) Architecture, a normative conceptual framework that addresses these three questions as an integrated governance challenge.

The framework was developed through normative conceptual analysis-a method that constructs governance proposals by synthesising philosophical principles, ethical theories, and empirical evidence. The literature was identified through structured searches of PubMed, PhilPapers, and EUR-Lex (January 2020-March 2026), drawing on the philosophy of medical knowledge, the ethics of trust and testimony, and the moral philosophy of responsibility.

The ETR Architecture produces four outputs: (i) a four-tier classification system that distinguishes LLM outputs-from administrative drafts to clinical evidence claims-and matches each tier to appropriate verification requirements; (ii) the concept of the 'epistemic placebo', formally defined as a governance measure that creates a documented appearance of compliance while lacking at least one operative element of genuine oversight; (iii) a model specifying four conditions under which trust in healthcare AI is justified; (iv) four testable hypotheses with associated research designs connecting governance design to trust calibration and patient safety.

The 2025-2027 regulatory transition period offers a critical window for shaping how healthcare institutions govern AI. We argue that deploying LLMs without explicitly classifying their outputs and building appropriate oversight risks allows governance norms to be set by technology vendors rather than by evidence-informed, patient-centred policy.