JMIR Publications

ABSTRACT

As public health surveillance becomes AI-native — able to ingest, reconcile, and render fluent outputs on its own — the decisive design question shifts from how well a system detects to where it is held back from acting on what it detects. This Viewpoint argues that the trustworthiness of such a system belongs neither to its model nor to its data but to its design, and that it must be located there as an architectural invariant: a form that any context-adapted implementation must take, rather than a property of components that changes whenever a model or data source is swapped. The invariant has two conditions, both conditions of restraint. First, the system must stop at an action-candidacy boundary, taking a signal only as far as a candidate for action and leaving the selection of a candidate into action outside itself. Second, what the system cannot yet warrant must be made visible rather than smoothed away — because a system fluent enough to fill any gap will, by default, conceal the gap rather than expose it, a concealment that no analyst intends and none can be held to account for. Making the gap visible is not only a safeguard: it is what allows the system's intent and the data's constraints to revise each other over time, a co-evolution in which neither architecture alone can reveal what the other is missing. The paper distinguishes a shortage of evidence, which a system should route toward strengthening the data, from an absence in principle, which it should route back to the one who asked rather than resolve into a false forecast. The argument is offered not as an implementation but as a conformance specification for trust — the conditions any trustworthy AI-native surveillance system must satisfy, by whatever means its context affords. A system disciplined in this way is not weakened but made trustworthy, and it is trustworthiness, not speed, that lets AI strengthen surveillance rather than quietly hollow it.