AI Governance in Health Care
How federal agencies are regulating clinical and administrative AI: FDA device pathways, ONC transparency requirements, FTC enforcement and payer use of algorithms.
There is no single federal AI law for health care, and waiting for one misreads how this is being governed. Authority is already distributed across agencies that each reach a different part of the same system: FDA through device classification and clearance, ONC through certification and algorithm transparency, OCR through nondiscrimination, FTC through deception and unfairness, and CMS through coverage, payment and program integrity.
The practical question for a physician is rarely whether an AI tool is legal. It is who is accountable when the tool is wrong, and which of those agencies has said anything about that.
What this covers
FDA device classification, De Novo and 510(k) pathways for clinical decision support and notification software, and the special controls attached to them. ONC transparency requirements for predictive decision support interventions. Payer use of algorithms in utilization management and the coverage rules that constrain it. Federal procurement and agency use of AI. Enforcement theories developing at FTC and OCR. Consensus standards and assurance frameworks as they start to be referenced in rules.
Why it is hard to track
The governance arrives as classification orders, guidance documents, enforcement statements and certification criteria rather than as legislation, so it does not look like AI policy when it is published. A device classification order in the Federal Register can settle the regulatory status of a whole category of software without ever using the phrase artificial intelligence in its title.
In this area
22 briefs, newest first. Tag archives: AI Governance
- CMS coverage matching: savings are quantified; coverage errors are not (October 15, 2026)
- NIH proposes a new chief AI office inside the director’s coordination division (October 14, 2026)
- Federal agencies, regulation, Congress, and implementation deadlines (October 13, 2026)
- OCR makes records custody part of the HIPAA access test (October 12, 2026)
- ONC funds agentic-care guardrails and small-lab terminology repair (October 7, 2026)
- The CMS SNF and hospice notices deserve operational attention (September 30, 2026)
- HEALTH POLICY BRIEF — Friday, September 25 (September 25, 2026)
- CMS detailed two Rural Health Transformation Program packages (September 18, 2026)
- HEALTH POLICY BRIEF — Thursday, September 17 (September 17, 2026)
- The HL7 September ballot window is mostly closed, but not entirely (September 15, 2026)
- FDA codifies a Class II pathway for certain cardiovascular machine-learning notification software (September 11, 2026)
- Physician payment and cybersecurity share Tuesday’s House agenda (September 11, 2026)
- OpenAI’s current HIPAA matrix says ChatGPT for Healthcare (September 8, 2026)
- HEALTH POLICY BRIEF — Friday, September 4 (September 4, 2026)
- The CMS final rule is the principal federal development (August 12, 2026)
- Senate HELP will hold a June 17 business meeting at 10 (June 12, 2026)
- HIPAA final-rule watch: Keep this in the near-term release queue (June 1, 2026)
- OMB government-wide financial assistance proposal (June 1, 2026)
- CMS PRA notice: CMS opened a 30-day OMB review comment period (May 29, 2026)
- Health Policy Signal Federal Register Surface Alerts (May 29, 2026)
- POLICY BRIEF — Thursday, May 28 (May 28, 2026)
- Health Policy Signal Federal Register Surface Alerts (May 27, 2026)
Dates that bind
Open comment windows and effective dates are on the regulatory tracker, which regenerates every weekday. Compliance dates are on the compliance page. Verify any date you intend to rely on against the primary document linked in the brief; see disclosures for how these briefs are produced.