AI in healthcare faces patchwork rules and liability maze

By mid-2026, the FDA had established a nuanced regulatory framework for AI-enabled diagnostic tools primarily classified as Software as a Medical Device (SaMD), distinguishing between traditional locked algorithms and adaptive models governed through predetermined change control plans (PCCPs). This approach allows adaptive AI to evolve safely post-approval within predefined boundaries, supported by rigorous device classification, clinical validation, risk assessments aligned with ISO 14971, and adherence to Quality Management System Regulation (QMSR). Early and structured engagement with the FDA via the Q-Submission Program is emphasized to clarify expectations and streamline development, reflecting the agency’s commitment to balancing innovation with patient safety through continuous post-market monitoring and change management protocols.

The FDA’s draft MDUFA VI commitment letter, released in August 2026, signals a forward-looking regulatory evolution emphasizing innovative oversight mechanisms such as pilots, sandboxes, and a new 'Focused Follow-Up' Pre-Submission program designed to accelerate feedback within 45 days. This framework aims to sustain timely reviews amid growing AI device complexity by bolstering internal expertise in generative and agentic AI and committing to enhanced staffing and resource capacity planning, with a Resource Capacity Planning and Management (RCPM) Implementation Plan slated for publication by March 2029. These measures underscore the FDA’s strategic intent to maintain regulatory agility while managing the expanding AI-enabled medical device landscape.

Regulatory pathways for AI-enabled SaMDs are shifting from De Novo classifications toward leveraging 510(k) clearances based on newly established predicates, reflecting maturation in the FDA’s approach to AI device equivalence. This transition coincides with a heightened focus on managing AI devices with greater autonomy and clinical influence, necessitating early Pre-Submission engagement to align on clinical risk, intended use, and robust dataset development. Moreover, the FDA and global regulators are modernizing frameworks to address adaptive algorithms, change control, and lifecycle management, acknowledging the evolving complexity of AI in clinical settings and the progression of AI tools from detection to treatment guidance, which demands rigorous clinical trials to demonstrate equivalence or superiority to physician-directed care.

In August 2026, the FDA advanced regulatory thinking on generative AI-enabled medical devices by releasing a discussion paper that invites public feedback on a risk-based framework calibrated by clinical significance and autonomy level. Recognizing the limitations of traditional exhaustive testing for non-deterministic generative AI, the agency is exploring a competency-based evaluation model inspired by physician training, combining non-clinical benchmarking with clinical confirmation to ensure safety and effectiveness. The FDA is also considering innovative tools like voluntary Foundation Model Device Master Files to confidentially assess AI architectures and update processes, while emphasizing that manufacturers remain responsible for device safety. This proactive, transparent approach reflects the FDA’s commitment to shaping adaptive, lifecycle-aware oversight that addresses unique challenges posed by cloud-based updates and complex AI system architectures.

The classification of AI tools such as AI scribes and imaging models as medical devices remains a contentious issue, exemplified by the UK regulator's ongoing debate over AI scribes. This uncertainty directly affects compliance demands and clinician adoption, as the decision will shape governance, approval processes, and trust in AI documentation tools within clinical practice and education. Such debates highlight broader regulatory challenges in applying existing medical device frameworks to novel AI technologies, potentially slowing innovation and uptake.

Regulatory landscapes diverge significantly across major markets, with the EU imposing stringent high-risk classifications under the MDR/IVDR and the EU AI Act, whose enforcement has been delayed to 2027-2028 to allow further stakeholder consultation. In contrast, the UK MHRA is leveraging these European delays by introducing an International Reliance Pathway to fast-track medtech approvals based on trusted global regulators like the US FDA, Health Canada, and Australia’s TGA. This risk-based, proportionate approach is echoed by regulators in Canada, Japan, China, Singapore, and Australia, reflecting a patchwork of evolving frameworks that complicate compliance and innovation for AI-enabled software as medical devices.

The UK’s nuanced regulatory stance on ambient voice technologies further illustrates the complexity of AI classification: tools used solely for administrative tasks such as transcription are exempt from medical device regulation, whereas those involved in diagnosis or treatment remain regulated, emphasizing clinician responsibility for verifying AI outputs. This risk-proportionate approach, supported by techUK in collaboration with MHRA and NHS England, aims to balance fostering innovation with safeguarding patient safety amid rapid AI integration into clinical workflows.

In the US, uncertainty persists around the classification of AI vision-language models in medical imaging, particularly when fine-tuned on institution-specific data, prompting Radiology Partners and Mosaic Clinical Technologies to petition the FDA for clearer guidance. This regulatory ambiguity raises critical concerns about bias, transparency, cybersecurity, and patient safety, underscoring the urgent need for explicit FDA frameworks to ensure consistent compliance, responsible innovation, and safe deployment of AI diagnostic tools across healthcare settings.

By mid-2026, the integration of AI in healthcare has significantly complicated traditional liability frameworks, extending potential responsibility beyond clinicians to include AI developers, vendors, and medical device manufacturers. This diffusion of accountability is exacerbated by the opacity of AI decision-making processes, which often lack explainability, making it challenging for clinicians to fully understand or justify AI-generated recommendations. Consequently, existing professional indemnity insurance and risk management policies are being reassessed by insurers and healthcare organizations, as they may inadequately cover emerging AI-related risks, highlighting a pressing need for updated coverage models that address these novel exposures.

The medico-legal landscape remains unsettled as stakeholders debate who should set the rules, verify AI accuracy, and bear liability when AI systems fail. Experts like Michelle Mello emphasize these unresolved questions, while regulatory bodies such as the FDA have begun exploring frameworks to assess generative AI-enabled medical devices comparably to physicians. However, critical issues around liability for AI errors and reimbursement for AI-provided care remain largely unaddressed, underscoring a regulatory lag behind rapid technological advancements.

Professional organizations, notably the AMA, assert that despite AI's growing diagnostic and cognitive capabilities, physicians must remain central to patient care, maintaining responsibilities such as human connection, clinical judgment, and stewardship of technology use. This stance reflects broader concerns about AI-induced physician deskilling and the evolving nature of medical practice, with calls from thought leaders like Zeke Emanuel for urgent development of comprehensive frameworks addressing workflow, liability, regulation, reimbursement, and medical education to safeguard professional oversight in AI-augmented care.

Looking ahead to 2030, experts predict that traditional product liability frameworks will prove inadequate for AI-related medical errors, as these frameworks focus on manufacturing defects rather than AI performance issues. While AI and robotics are expected to gradually augment or assume certain medical tasks—such as the FDA-approved robot for blood draws—physicians will continue performing most procedures, with liability and accountability frameworks evolving to reflect this hybrid model. High-profile legal cases like Scott Winters v. OpenAI exemplify the emerging complexities in assigning responsibility among clinicians, AI developers, and manufacturers, highlighting the urgent need for clear legal and insurance structures in this rapidly changing landscape.

The proposed HTI-5 rule marks a significant retreat in federal transparency mandates for clinical AI, eliminating critical requirements such as model-card disclosures and intervention risk management provisions that previously enabled healthcare institutions to audit and govern AI tools effectively. This rollback shifts the onus of due diligence squarely onto healthcare buyers, compelling hospitals and clinics to develop bespoke oversight processes for each AI algorithm without the benefit of a standardized disclosure baseline. Compounding this challenge, the FDA’s existing regulatory framework remains ill-equipped to monitor AI devices’ post-market performance, a gap that the now-removed source-attribute disclosure regime had partially filled by mandating validation and update schedules from developers.

A growing regulatory blind spot looms as much clinical AI—especially generative AI tools, internally developed models, and non-device clinical decision support systems—falls outside FDA jurisdiction. Previously, the Decision Support Interventions criterion provided a transparency umbrella for these rapidly expanding technologies, but its elimination leaves institutions navigating governance without clear federal guardrails. This regulatory void intensifies institutional challenges in maintaining trust and safety, as healthcare providers must now rely on internal governance mechanisms amid a landscape where the fastest-growing category of clinical AI operates largely unregulated.

In Europe, while the delayed compliance deadlines for high-risk medical devices under the EU AI Act temporarily ease immediate regulatory pressures, healthcare institutions face mounting demands for robust governance and transparency as enforcement actions begin to take shape. The European AI Board and national supervisory bodies have initiated formal inquiries and penalties, catalyzing a surge in demand for third-party auditing, ISO/IEC 42001 certification, and specialized compliance advisory services. These developments underscore the institutional imperative for continuous oversight mechanisms capable of navigating the dual complexities of the AI Act and Medical Device Regulation frameworks.

The deployment of ambient voice technology (AVT) in healthcare settings exemplifies the nuanced governance challenges institutions face amid regulatory gaps. NHS entities, guided by MHRA and NHS England, must ensure comprehensive governance, training, and oversight to maintain trust and safety, especially since clinicians retain ultimate responsibility for verifying AI-generated content before clinical use. However, the regulatory rollback exempts AVT products used solely for administrative tasks—such as transcription and summarization—from medical device regulations, complicating institutional oversight and highlighting the persistent tension between innovation and accountability in clinical AI applications.

By mid-2026, experts widely agreed that human oversight remains indispensable in clinical AI deployment, especially given generative AI's propensity to hallucinate or produce erroneous outputs. As one commentator noted, 'there's always a human in the loop because we provide support to clinicians and we don't replace them,' underscoring a layered oversight approach where 'agents watching agents' are supplemented by final human judgment to safeguard patient safety and trust.

The integration of AI into medicine is reshaping the physician's role, emphasizing augmentation over replacement. In cancer care, for instance, AI tools that assist in polyp detection or provide AI-augmented second opinions promise personalized treatment improvements, yet raise fundamental questions about evolving professional responsibilities. The AMA is actively engaging with these challenges, focusing on establishing clear regulatory, liability, and payment frameworks to ensure AI's safe and ethical use within clinical workflows.

A profound ethical debate persists regarding AI's autonomy in practicing medicine. While Dr. Zeke Emanuel highlights AI's superior performance in certain trials—such as a Stanford RCT where AI-managed insulin therapy outperformed physicians—AMA CEO Dr. John Whyte counters that medicine transcends task execution, hinging on trust and the human 'art of medicine.' This tension spotlights concerns about physician de-skilling and the necessity of maintaining empathy and human judgment, especially in sensitive contexts like cancer diagnosis.

Balancing innovation with patient safety remains a paramount challenge as AI systems evolve, particularly regarding liability and regulatory guardrails. Stakeholders emphasize the need for robust frameworks that define the extent of AI autonomy, including licensing and deployment protocols, to prevent harm from incorrect AI outputs. This is especially critical in underserved areas like mental health, where AI chatbots may fill gaps but also raise ethical and practical questions about appropriate roles and oversight.