Rethinking broad consent in the age of genomic AI: the Hungarian case

Broad consent is an ethical framework that enables patients to authorize the use of their biosamples and health data for multiple, unspecified future medical studies. This approach underpins modern precision medicine, which relies on large and diverse datasets to tailor disease treatments, diagnostics, and prevention strategies to individual genetic profiles and lifestyles. This issue is particularly significant in genomic research, where a sample may subsequently be sequenced, linked with longitudinal health records, utilized in algorithm development, and reanalyzed as scientific knowledge and computational methods advance. Such subsequent uses may yield clinically relevant information that could not have been anticipated at the time consent was obtained, including new evidence regarding disease risk, variant significance, or treatment response. Hungary's 2025 reform highlights this challenge by permitting broad consent for current and future medical research deemed "national strategic significance." However, this framework does not provide a mechanism for returning individual research findings or re-identifying coded material for the benefit of participants. This combination grants research institutions considerable future flexibility while fixing the participant's informational position at the time of consent. The present article refers to the distance between the material initially contributed and the inferences subsequently derived from it as the sample-data-inference gap. It proposes a model of bounded, reciprocal broad consent, supported by ongoing transparency, review triggered by material changes, and a limited pathway for independently validated, clinically actionable findings.Act XXII of 2025 introduced the new framework through amendments to the Hungarian Health Act (1). Broad consent now covers biological samples and associated data used in authorized and subsequently authorized medical research of "national strategic significance." The statutory category includes research aimed at improving population health, supporting early detection, examining major causes of mortality, and increasing treatment effectiveness. Consent must be voluntary and may be withdrawn. Samples and data are stored in coded form, and each later project remains subject to authorization and ethical review (2).The treatment of individual findings creates the central difficulty. Participants must be told before consenting that they will receive no information about research results. The implementing decree also excludes re-identification of coded samples or data for the benefit of the participant or a close relative (3). Read together, these provisions leave no express route within the research framework for communicating a finding that later becomes serious, independently confirmed, and clinically actionable. Confidentiality, the separation of research from clinical care, and the risks of communicating uncertain findings provide legitimate reasons for caution. A complete closure of the feedback pathway requires a separate justification.Empirical research also cautions against treating a signed form as acceptance of every condition within the consent package. In a large German study, a better understanding of broad consent was associated with both a greater willingness to participate and a stronger opposition to a strict non-reporting policy. Many patients, therefore, supported research despite disagreeing with the withholding of potentially relevant findings (4). A systematic review from the USA similarly found that support for broad consent was often higher when it was the only available option, and fell when participants were offered more granular alternatives or when commercial access was contemplated (5). An initial signature cannot, by itself, establish that participants have accepted every future informational consequence of research.European data protection law allows for broad consent within defined parameters. GDPR Recital 33 acknowledges that certain scientific objectives may not be fully specified at the time of data collection (6). The European Data Protection Board (EDPB) regards this flexibility as a limited exception to the general requirement of specificity. The research domain must remain clearly defined, transparency must be maintained, and the right to withdraw must remain effective (7). The EDPB further distinguishes between consent to participate in research and the legal basis for processing personal data. Consequently, analysis should differentiate between the participant's authorization for research and the controller's legal basis under Articles 6 and 9 of the GDPR.Article 15 of the GDPR addresses access to personal data that the controller has already processed. It does not impose a general obligation to establish clinical services, validate all research outputs, or convert algorithmic scores into clinical diagnoses. An inference that is retained may still constitute personal data if it remains associated with an identifiable participant. Therefore, its data protection status and its suitability for clinical reporting require distinct analyses. European bioethics instruments introduce an autonomy-based dimension. Article 10 of the Oviedo Convention safeguards individuals' interests in accessing health-related information and in choosing to remain uninformed. Recommendation CM/Rec(2016)6 emphasizes the need for transparent feedback policies, ongoing information provision, and oversight mechanisms that can adapt to evolving risks and scientific developments. Collectively, these standards reinforce participant autonomy when research findings attain clinical relevance (8). The European Health Data Space Regulation (EHDS) provides a practical institutional framework. The Regulation prohibits health data users from re-identifying individuals and establishes a distinct process for communicating significant findings. The health data access body may transmit information through the data holder or the treating professional, in accordance with national law. Individuals maintain the right to refuse this information. This mediated approach maintains a clear distinction between research and clinical care, while allowing a limited pathway for findings of substantial health relevance (9). Article 52 of the Charter supplies the proportionality framework when the Hungarian scheme operates within the scope of EU law (10). The restrictions serve legitimate purposes by reducing the risk of re-identification, limiting the communication of uncertain results, and maintaining the distinction between research and clinical care. While these measures are suitable for these objectives, establishing their necessity is more challenging. Alternative approaches, such as employing a trusted intermediary, independent clinical review, confirmatory testing, a high threshold for seriousness and actionability, and documented participant preferences, could protect the same interests while imposing less restriction on informational autonomy. Therefore, the evaluation should distinguish between the broad-consent framework and the complete closure of the feedback pathway. Broad consent may remain justified if appropriate safeguards are implemented. However, the categorical exclusion of any return mechanism demands a more robust justification.The German Medical Informatics Initiative -although a national standard rather than legislation -, already combines project-level review, public transparency, separate recontact options, and exceptional feedback without giving researchers direct access to identities (11). Norwegian guidance likewise confines broad consent to defined research fields and requires continuing information, with renewed consent only when later use falls outside the original scope (12). These comparators are not exact analogs of the Hungarian legislation, but they weaken the claim that categorical non-return is the least restrictive means available.Genomic AI increases the gap between sample collection, data analysis, and inference, as identical sequences may be reanalyzed multiple times due to expanding reference databases, evolving variant classifications, and ongoing model retraining or recalibration. Automated systems can generate candidate findings at scale long after initial data collection. Consequently, governance frameworks must address not only the management of samples and records but also the inferences derived from stored data. AI-generated outputs require careful interpretation before they can inform clinical care. Their reliability depends on the model version, the training and reference datasets, the decision threshold, and the validation populations. Expert assessment, independent confirmation, and evidence of clinical validity and actionability remain essential (13). An exploratory inference may later acquire sufficient evidential support for clinical use. The regulatory framework should allow a fresh assessment when that threshold is reached. AI alters both the scale and timing of genomic reanalysis. Automated systems can repeatedly review large datasets and generate new candidate findings as models and reference data are updated. Documentation of any candidate finding should include the model version, validation population, and decision threshold. The EHDS explicitly encompasses inferred, derived, and automatically generated health data, and permits secondary use for training, testing, and evaluating algorithms and AI systems. Transitioning from research use to clinical decision support should prompt a new ethical and regulatory review. The same requirement applies when the intended purpose of a model undergoes significant change. Reviews should also assess performance across relevant populations, as under-representation in genomic databases and training datasets may reduce accuracy and perpetuate existing inequalities (14).Hungary does not require project-specific reconsent for every new analysis. Requiring this would create a heavy burden, leave out participants who cannot be reached, and could lead to selection bias. A better approach is to use bounded and reciprocal broad consent. 'Bounded' means that future research stays within clear limits. Consent materials should list the relevant research fields, data types, ways data may be linked, commercial involvement, cross-border transfers, and expected AI uses, such as model training and automated reanalysis. Major changes, like moving into a new research area, using a new data source, changing the main purpose of a model, or starting clinical use, should lead to a new review and, if needed, give participants more choices. 'Reciprocal' means that while research can be flexible, there are ongoing responsibilities. Approved projects should be listed in a public register before using any data, with clear information about their goals, data types, partners, funding, and AI functions. Participants should have the option to review and update their preferences, including if they want to be contacted about important findings. Recent studies show that transparency, control, timing, and how accurately consent is recorded are just as important as the wording of the consent form (15,16). The process for returning findings should be limited. Researchers should avoid re-identifying participants or sharing raw model results. An independent team from different fields should decide whether a finding is serious, confirmed by analysis, clinically valid, actionable, and consistent with the participant's preferences. If needed, recontact should happen through a trusted intermediary or the participant's doctor, and genetic counseling should be offered when appropriate. This approach means there is a responsibility to handle important findings carefully, but not to keep searching for every possible result.Hungary's reform addresses the need for stable and efficient access to biological samples and health data for long-term public-interest research. The broad-consent framework is designed to facilitate this objective. Currently, the framework establishes the participant's informational position prior to the full understanding of the future significance of genomic data. The emergence of genomic AI challenges the sustainability of this rigid framework. As analytical models, reference datasets, and scientific knowledge advance, stored data may yield new clinically relevant inferences. Hungarian law should maintain a presumption against returning unvalidated research results and establish a distinct, mediated process for communicating findings that satisfy predefined criteria for seriousness, independent confirmation, clinical validity, and actionability. A broader initial authorization should correspond to heightened ongoing obligations regarding transparency, oversight, participant autonomy, and reciprocity.