Smart infant monitors in a regulatory grey zone: Artificial intelligence governance, data privacy, and liability in consumer digital health

Objectives This study asks how AI-enabled smart infant monitors are classified under United States and European Union law, whether that classification determines the data-protection, cybersecurity, and product-liability obligations that follow, and what reforms would align regulatory obligation with device capability. These devices occupy an uncertain boundary between consumer wellness products and medical devices, generating alerts without clinical validation. Methods We conducted a doctrinal legal analysis and comparative case study of infant monitor regulation in the United States and the European Union between 1 September 2024 and 31 March 2026. Primary legal instruments and clinical validation literature were identified through EUR-Lex, the United States Code, the Code of Federal Regulations, FDA device and enforcement databases, Westlaw, HeinOnline, PubMed, and Scopus, and were mapped onto three governance domains: device classification, data protection, and product liability. Two paradigmatic cases, the Owlet Smart Sock and the Nanit Pro, were purposively selected against pre-specified criteria. PRISMA does not apply to this design, for the reasons set out in Section 2.1. Results Three systemic governance failures emerged. First, function-agnostic classification permits unvalidated alerts to reach consumers: independent validation of the Owlet Smart Sock 2 reported hypoxaemia sensitivity of 88.8% (95% CI 79.4–98.1) and specificity of 85.7% (95% CI 72.6–98.8), and bradycardia sensitivity of 0.0%, indicating both missed events and unnecessary alerts, yet the same device moved from FDA enforcement in 2021 to De Novo clearance in 2023. Second, fragmented data protection frameworks leave non-consenting infant biometric data exposed. Third, distributed AI accountability lacks lifecycle standards for over-the-air updates and cross-border transfer. Conclusions We propose a risk-based framework of five reforms: capability-based tiered classification independent of marketing claims; evidence standards proportionate to risk; mandatory AI model cards and update notifications; infant-specific Data Protection Impact Assessments; and regulatory sandboxes for evidence generation. Function-based regulation can reconcile innovation with protection of vulnerable populations.