AI in healthcare is ruled by a patchwork of federal and state rules, not one national law. The FDA reviews AI used as a medical device. About 1,450 AI-enabled devices have been authorized so far. Federal civil rights rules cover bias in clinical decision tools. States such as California, Texas and Illinois now add their own rules, and Colorado will from 2027. These state rules deal with telling patients about AI use, doctor review of coverage calls and limits on AI in therapy.
For hospitals, insurers and health tech firms, the hard part is knowing which rules apply to which tool. Here is a plain guide to the main ones as of late 2026.
The FDA and AI Medical Devices
When AI is used to find, treat or prevent disease, it most often counts as a medical device. The FDA keeps a public list of the AI-enabled devices it has authorized. A Congressional Research Service report put the total at about 1,450 devices as of mid-2026. Most are used in radiology, cardiology and neurology. Radiology is by far the largest group. The same report noted that no generative AI device had yet been authorized.
The FDA is still writing the rulebook. In January 2025, it put out draft guidance on how AI-enabled device software should be built, tested and watched over its life. That guidance was still in draft form at last check. The agency also uses predetermined change control plans. These let makers say in advance how a model will be updated. That way, each change does not need a new review.
Not all of it is getting stricter. In January 2026, the FDA revised its guidance on general wellness products and clinical decision support software. The change loosened oversight of many wearables and some decision tools. In August 2026, it put out a discussion paper on generative AI devices. It is not formal guidance. Public comments are due October 19, 2026.
Civil Rights Rules for Clinical Tools
Federal anti-bias law reaches AI too. One rule puts Section 1557 of the Affordable Care Act into practice. Under it, health programs that get federal funds must make reasonable efforts to identify and reduce the risk of discrimination from patient care decision support tools. Those rules took effect in May 2025.
Federal health IT rules have also asked more of certified health record software. It has had to share more facts about the AI-driven decision support it offers. In December 2025, federal health IT officials proposed dropping some of those rules. The move was part of a wider push to cut red tape.
AI in Coverage and Prior Authorization
Using code to approve or deny care has drawn the most scrutiny. Federal guidance for Medicare Advantage plans says they may use AI. But each medical necessity decision must rest on the patient’s own case, not on an algorithm alone.
At the same time, Medicare is testing AI itself. A Centers for Medicare & Medicaid Services program called WISeR began on January 1, 2026. It uses AI-driven prior authorization for some services in six states, such as New Jersey, Ohio and Texas. A human clinician must review any denial before it becomes final.
California went further. Its SB 1120 law has been in effect since January 2025. It says only a licensed physician or qualified provider can deny, delay or change care based on medical necessity.
State Laws on Disclosure and Use
States have moved fastest on telling patients when AI is used.
- California. Since January 2025, AB 3030 has called for a notice when generative AI writes clinical messages to patients. The rule does not apply if a licensed provider read the message first. The notice must also tell patients how to reach a human.
- Texas. The Texas Responsible AI Governance Act has been in effect since January 1, 2026. Under it, providers must tell patients when AI is used in their treatment. A separate law makes doctors review AI-made medical records.
- Colorado. In May 2026, Colorado repealed and replaced its first-in-the-nation AI law before it took effect. The new version starts January 1, 2027. It drops impact assessments, exempts FDA-regulated devices and calls for a general notice to patients.
- Illinois. A 2025 law bans AI from making therapeutic decisions in mental health care. Fines can reach $10,000 per violation. Office and admin uses are still allowed.
Federal policy may change this map. A December 2025 executive order told the Justice Department to challenge state AI laws seen as a burden. It also asked the Commerce Department to name them. How that plays out in court will matter for each health system that works in more than one state.
Privacy Still Applies
HIPAA applies to AI tools the same way it applies to any other tech that touches patient data. Federal officials have flagged three key risks. They are data leaks, poisoned training data and missing business associate agreements. Patient trust is also at stake. Buyers are wary of how firms use their data, a theme covered in our look at when data-driven personalization backfires.
What Health Groups Should Do Now
- Keep a list of each AI tool in use, who owns it and what choices it shapes.
- Check whether each tool is an FDA-regulated device or a decision support tool.
- Test clinical tools for bias across patient groups and write down the results.
- Build patient notices into daily work in states that require them.
- Keep a human clinician in the loop for coverage and care decisions.
- Sign business associate agreements with AI vendors that handle patient data.
Legal advisers are now central to this work. Business Insiders has profiled a corporate attorney who explains how AI is changing healthcare regulation. He is part of a growing field where health law and tech meet. More coverage is in the law and healthcare sections.
Frequently Asked Questions
Does the FDA regulate AI in healthcare?
The FDA rules on AI that counts as a medical device, such as software that helps find disease. About 1,450 AI-enabled devices have been authorized. Most of them are in radiology.
Do doctors have to tell patients when they use AI?
It depends on the state. Texas requires notice when AI is used in treatment. California requires notices on AI-written patient messages unless a provider read them first.
Can insurers use AI to deny care?
Insurers can use AI tools, but more rules now call for human review. California requires a physician or qualified provider to make medical necessity denials. Medicare’s AI pilot requires a clinician to review each denial.
The Bottom Line
AI in healthcare is moving faster than the rules that govern it. For now, groups face a mix of FDA oversight, federal civil rights rules and fast-changing state laws. The safest path is simple. Know what tools you use and test them for bias. Tell patients when the law requires it. And keep clinicians in charge of the choices that matter most.
