‘8%’ is not just any number. When WHO Regional Director for Europe Hans Kluge delivered it in Lisbon on 15 July, he immediately clarified that this is the share of countries in the European region with a national artificial intelligence strategy for health. The figure captures a structural fragility: twenty-seven out of thirty nations have yet to define a governance framework for the use of LLMs, decision-support systems, and predictive tools in patient care.

The number alone does not tell the whole story. But when crossed with the acceleration of clinical AI applications – from automatically generated clinical notes to AI-assisted radiology and sepsis prediction models – the gap becomes alarming. Without a public strategy, the real risk is that hospitals and healthcare organizations will move by inertia toward off-the-shelf cloud solutions, often supplied by large non-European platforms. A choice that can appear fast and low-cost initially, but progressively erodes sovereignty over the most sensitive data of all: health records.

The healthcare cloud trap

This is not just about GDPR compliance, which already imposes strict rules. The issue runs deeper: who owns and runs the inference workloads? Where do the models physically reside? And who can update the weights of a neural network that assigns triage priorities? Without a national strategy, the answers risk being written elsewhere, by providers operating under different privacy regimes.

The alternative – gaining ground precisely in those few countries that do have a strategy – is on-premise, self-hosted deployment. Hosting models on local infrastructure means keeping control over data, avoiding critical network latency in the operating room, and building a predictable Total Cost of Ownership (TCO) trajectory over time. Those evaluating on-premise deployments today know the trade-offs are real, especially around in-house skills and hardware refresh, but they gain the certainty that no data ever leaves the organizational perimeter.

Kluge’s 8%, then, is not merely a marker of political delay: it signals a gap that risks becoming irreversible. Because once data flows and clinical pipelines become entrenched in external cloud platforms, bringing them back to local architectures becomes an expensive and complex exercise, both technically and contractually. And the more major vendors refine their vertical healthcare ecosystems – training models on millions of anonymized records, but only in their own data centers – the narrower the window for genuine autonomy.

Perhaps the time to define a strategy is not when AI is already ubiquitous, but when it is still in selective adoption. And it is right now that European countries should ask themselves whether they prefer to be informed commissioners of an intelligent health infrastructure or mere consumers of someone else’s services.