Consent is a Step
Every standard that governs what an AI system does has a slot for the person as a subject. None has a slot for consent as a step.
1. The first half, and the half nobody wrote
The AI standards each carry one half of the person. The half they carry is thorough: who is affected, what the risk to them is, and what happened to them, recorded. The half they defer is the one that matters first: whether they were asked.
ISO/IEC 42005, AI system impact assessment, calls for the assessment to identify affected individuals, groups and stakeholders — the people the system touches, including people who never chose to interact with it — and it does not require that anyone seek their consent. Stakeholder engagement is recommended where appropriate, never a requirement. The standard that exists to assess impact on people asks them nothing.
ISO/IEC 23894, guidance on AI risk management, lists privacy among its objectives in an annex, and leaves legal obligations to the organisation's context. Consent enters as a matter the organisation is expected to have handled under other law, not as a step in the risk process it governs.
ISO/IEC 24970, AI system logging, defines what a record of an AI system's events must contain. It records user identifiers "where privacy permits" — the log deliberately steps around the person — and it has human oversight interventions as a trigger, but no event type for consent given, refused or withdrawn. A system that never asked produces a complete, compliant log.
ISO/IEC 42001, the AI management system standard, and ISO/IEC 27701, the privacy information management standard, carry the closest thing the family has: privacy as a control to manage, and consent as a data-protection input under privacy law. Even there, consent is an input to a control, not a step a process must take before its next one.
The committees are named because the people who write these documents should be able to find this page: ISO/IEC JTC 1/SC 42 writes the AI standards, SC 27 writes the privacy ones, and TC 215 writes health informatics. Consent does not sit in any one of them, and that is the point. It is a step, and none of their documents has a slot for steps.
2. What the law already says
The law has the consent half, and states it as a precondition. In New Zealand, Right 7(1) of the Code of Health and Disability Services Consumers' Rights provides:
"Services may be provided to a consumer only if that consumer makes an informed choice and gives informed consent, except where any enactment, or the common law, or any other provision of this Code provides otherwise."
The Privacy Act 2020 governs how personal information is collected, and its newest principle, IPP 3A, in force from 1 May 2026, is a notification duty for indirect collection — a notice after the fact, not consent before it. The Health Information Privacy Code applies the same structure to health information.
So the two halves exist in different places. The standards carry the first half — identify, assess, log. The law carries the consent half — a precondition to providing the service. Nothing carries the order between them. A precondition written in law is not a step enforced anywhere. That is the gap.
The same step, worldwide
New Zealand is the anchor on this page because it is the jurisdiction where the full record is public: the requirement, the promise, the measured shortfall and the empty record. The step itself is written into the law of every major jurisdiction. The details differ — which lawful bases exist, opt-in versus opt-out, the exceptions, the penalties. The step does not.
| Jurisdiction | Where the step is written | What it requires |
|---|---|---|
| European Union | GDPR, Article 6(1)(a) with Article 7; health data as a special category under Article 9 | Consent must be freely given, specific, informed and unambiguous, and withdrawal must be as easy as giving it. Fines reach 4% of worldwide turnover. |
| Australia | Privacy Act 1988, APP 3.3: sensitive information, which includes health information, may be collected only with the individual's consent unless an exception applies; the My Health Records Act 2012 adds its own unauthorised-access offences | The regulator's guidance sets five elements of valid consent: voluntary, informed, current, specific, and given by someone with capacity. |
| United States | Sectoral, and the strongest sector is health: HIPAA permits use of health information for treatment, payment and operations, and requires the individual's written authorization for the rest, with civil and criminal penalties; state laws add opt-in consent for sensitive data, and the FTC enforces deception | The authorization must state what will be disclosed, to whom, and for what purpose, and the individual may revoke it in writing. |
| Canada, Brazil, China, Singapore, India, Japan | PIPEDA's meaningful-consent principle, LGPD Article 7, PIPL Article 13, the PDPA's consent obligation, the DPDP Act, APPI — each makes consent a precondition, with its own lawful bases and exceptions | Same shape, six spellings. |
| Before the web | OECD Privacy Guidelines (collection limitation, 1980) and the Council of Europe's Convention 108 (1981) | The order rule was world law before the technology it now governs. |
In every one of these, consent is a precondition with force of law. In none of them does anything record, at the step, whether it happened. The regimes differ in their exceptions; they are identical in their silence.
3. The live case: scribes in every emergency department
Health New Zealand | Te Whatu Ora is rolling out the AI scribe Heidi nationally: 1,000 clinician licences plus 100 for mental health crisis teams, in every emergency department in the country by April 2026, with the stated goal of use in every hospital by the end of 2026.
The regulator requires the step. The Medical Council of New Zealand's guidance of 10 March 2026, Guidance on using artificial intelligence (AI) in patient care, covers AI scribing tools and requires informed consent when an AI scribe or transcription tool records a consultation. It also requires that the consent, and the patient's decision when they decline, be documented. The step, and the record of the step, are both required by the profession's own regulator.
The agency promised the step. When Health NZ endorsed Heidi and iMedX on 20 July 2025, the chair of its National AI and Algorithm Expert Advisory Group stated: "Patients will be asked for consent when clinicians are using AI during their consultations."
The measured practice falls short. A peer-reviewed survey of New Zealand AI-scribe users found only about 60% sought the patient's consent. An earlier GP survey put it under two-thirds. The requirement is stated twice over, and roughly two patients in five are never asked.
The record is empty. Health NZ's official disclosure on Heidi, an OIA release published 28 April 2026, covers governance, risk management, privacy safeguards and early evaluation findings — as a 13-megabyte scan with no searchable text. The independent privacy impact assessment records that audio is not retained, New Zealand patient data is not used for model training, the provider is ISO 27001 certified, and processing runs in Sydney with New Zealand storage planned. The HRC-funded Roadmap for AI Scribes in Aotearoa, run by the University of Auckland with Health New Zealand, still lists patient consent among the unresolved risk areas being studied. And a clinical lead at Whakarongorau has said a complaint to the Health and Disability Commissioner over scribe use without informed consent is "only a matter of time".
The step is required by the regulator, promised by the agency, delivered by three clinicians in five, and recorded by no one. A patient cannot be asked a question that leaves no record of the answer, and no record means no one can show the law was followed — and no one can show it was broken, either. The survey is the best evidence that exists, and the best evidence that exists is a self-reported guess. Both claims die in the same silence, and the only party that silence serves is the one that never has to answer. The unknowability is the finding. Right 7 has not been repealed. It has been left outside the sequence.
4. Consent as a step
The industry already has the word. It calls its central problem alignment. The word's literal sense is into line. A declared sequence is a line: the steps, in the order the law and the promise set out. A step that runs out of order is out of line, out of alignment in the measurable sense, whatever the model wanted internally. Consent skipped is the line broken, and the incidents the industry reports are the same shape: actions out of line with what was declared, found later because nothing recorded the line. Alignment, measured, is sequence.
Consent belongs in the sequence a process declares in advance: intake, then consent, then record, then proceed. Consent is the step that must precede the recording of the person. Its absence stops the process at that point, before anything else runs. Its refusal is itself the record: signed, and held by a party that is not the operator, so a process that skipped consent shows as a gap rather than as a completed run. Then the number is not believed — it is known. Every consent is a signed step, every refusal a signed refusal, every missing step a visible gap in a chain a third party holds. The instrument that makes the question answerable is the record.
No new law is needed, and nothing needs to wait on a committee. The step already exists in law, and AI processes must follow the law they already operate under. That is the way in: the sequence declares the step the law already requires, and the gate holds the order, today.
This is what sequence verification does: each step is checked against an order declared in advance, before it runs, and the decision is signed and held by a party that is not the operator. An order failure is the name for what happens when the step runs anyway.
Consent belongs in every one of the standards above, because consent is not a clause. It is a step that every process touching a person must take before its next one. Risk management needs it: the risk is to a person who never agreed to be in the process. Impact assessment needs it: the impact lands on someone who was never asked. Logging needs it: the one entry that matters most is whether they said yes, and none of their information models has a field for it.
The committees can keep their first halves. They are good. The consent half needs a slot, and the slot is the declared sequence.
- The standard texts themselves are paywalled. This page states their publicly described provisions, with the source of each description linked below. It is updated as primary documents are read.
- No claim is made that any standard requires consent as a step. The claim is that none provides one, while the law requires consent as a precondition.
- No claim is made about any health provider's individual practices beyond what is cited.
- A sequence enforcement gate governs the steps a deployment sends through it. It does not stop activity on systems outside that deployment.
- This page is not legal advice.
Questions
Do the AI standards require consent?
None of them requires consent as a step. ISO/IEC 42005 calls for affected individuals to be identified, including people who never chose to interact with the system, and does not require that anyone ask them. ISO/IEC 23894 lists privacy as one objective and leaves legal obligations to the organisation's context. ISO/IEC 24970 has no event type for consent given or refused.
Is consent required by law in New Zealand health?
Yes, as a precondition, and the profession's regulator requires the step. Right 7(1) of the Code of Health and Disability Services Consumers' Rights provides that services may be provided to a consumer only if that consumer makes an informed choice and gives informed consent, except where an enactment, the common law or another provision of the Code provides otherwise. The Medical Council's guidance of 10 March 2026 requires informed consent when an AI scribe records a consultation, and requires the consent and any decline to be documented. The Privacy Act 2020 and the Health Information Privacy Code govern the collection and handling of health information.
Is consent required worldwide?
The step is written into every major jurisdiction — GDPR, the Australian Privacy Principles, HIPAA, PIPEDA, LGPD, PIPL, the PDPA, the DPDP Act — each with its own lawful bases and exceptions, and none with a record of the step. The international instruments predate the web. The regimes differ in their exceptions; they are identical in their silence.
What would consent as a step look like?
Consent is declared in the sequence a process must follow: intake, then consent, then record, then proceed. The next step is refused until consent is recorded. A refusal is signed and held by a party that is not the operator, so a process that skipped consent shows as a gap rather than as a completed run. No new law is needed: the step already exists in law, and sequence verification is how a deployment holds the order the law already requires.
5. Updates
26 October 2026: first published.
26 October 2026, later: section 3 adds the Medical Council's guidance of 10 March 2026 requiring informed consent for AI scribes and its documentation, Health NZ's stated position of 20 July 2025, the measured consent rates from the peer-reviewed survey, and Health NZ's OIA release of 28 April 2026.
26 October 2026, later still: sections 3 and 4 add the point the record makes in both directions: with no record, no one can show the law was followed, and no one can show it was broken — the unknowability is the finding, and the instrument that makes the question answerable is the record.
26 October 2026, last: section 4 adds the literal sense of alignment — into line — and the declared sequence as the measurable version of it: consent skipped is the line broken.
26 October 2026, later again: section 2 gains the worldwide table — the same step in the GDPR, the Australian Privacy Principles, HIPAA, PIPEDA, LGPD, PIPL, the PDPA and the DPDP Act, and in the instruments that predate the web — and the page gains the questions section to match its structured data.