Large language models and prostate MRI reporting: a stringent testbed for safe deployment under evolving AI, health-data, and cybersecurity regulation

Prostate magnetic resonance imaging (MRI) reporting is a high-impact communication task because small differences in lesion laterality, sector localization, lesion size, Prostate Imaging-Reporting and Data System (PI-RADS) categorization, or staging language can change biopsy targeting, surveillance, counseling, and treatment planning. At the same time, widespread patient-portal access means that many patients encounter radiology reports before clinical discussion and may seek explanations from public large language models (LLMs). LLMs can restructure radiology text, extract discrete variables, draft supervised summaries, and generate patient-facing explanations; however, fluency does not establish factual correctness. Hallucinated measurements, omitted qualifiers, flipped negations, wrong laterality, and overconfident statements about cancer likelihood create patient-safety, privacy, cybersecurity, and accountability risks, particularly when reports are copied into systems outside clinical governance. International regulation is also evolving rather than settled. In the European Union (EU), the Artificial Intelligence Act establishes a risk-based framework, but ongoing implementation activity-including the Digital Omnibus and related AI Act amendment proposals, draft guidance for high-risk AI systems, and the European Health Data Space (EHDS) Regulation-shows that practical rules for health-data access, cybersecurity, incident reporting, human oversight, logging, and liability still require local operationalization. In the United States (U.S.), Food and Drug Administration (FDA) clinical decision support (CDS) guidance clarifies boundaries relevant to radiology language-model workflows and emphasizes that health care professionals must be able to independently review the basis for recommendations. Against this backdrop, this Perspective uses prostate MRI as a stringent testbed and proposes a conservative roadmap that prioritizes bounded, auditable tasks-structured extraction, completeness checks, quality-assurance support, and source-linked patient addenda-over autonomous classification or unsupervised counseling. Safe adoption will depend on "no new facts" generation, provenance, human sign-off, local validation, access controls, incident-response planning, and continuous post-deployment monitoring.