Federal oversight of clinical AI is fragmenting. The FDA's primary approval pathway was built for static devices, not systems that drift post-deployment. HHS is pushing AI adoption while regulatory infrastructure lags. The practitioner who cannot document their AI governance process is the one who will be exposed first when audits begin.
Signal 1
Penn Medicine Faculty Call Out "Holes" in FDA's AI Device Oversight
Penn Medicine researchers published findings that the FDA's current approval pathways were built for traditional medical devices and don't map well to AI. The 510(k) pathway (which approves roughly 98% of AI-enabled devices) requires less rigorous evidence than newer processes. More concerning: after deployment, AI systems experience "drift," where performance degrades over time and varies between clinical sites. There is no infrastructure to catch this once a tool is in use.
What this means for you
If you are using any AI-enabled clinical tool, the regulatory body that cleared it may not be monitoring whether it still works the way it did on approval day. That is your governance gap to fill, not the FDA's.
Signal 2
HHS Requests Public Input on AI to "Deflate Health Care Costs"
The U.S. Department of Health and Human Services published a formal Request for Information (RFI) seeking input on how HHS can accelerate AI adoption in clinical care. The framing is cost reduction. The administration is actively looking for use cases and is signaling that it wants fewer barriers to AI deployment, not more.
What this means for you
Federal policy is moving toward encouraging AI adoption, not restricting it. That means the compliance burden is shifting to practitioners. You will be expected to have your own governance process before regulators come asking.
Signal 3
States Are Writing the AI Rules the Federal Government Won't
With no comprehensive federal AI legislation, states are filling the gap fast. Texas now requires written patient disclosure before any AI-assisted treatment (effective January 2026). California's AB 489 prohibits AI systems from implying they hold a healthcare license. Georgia's SB 444 bans insurance coverage decisions based solely on AI. Alabama has SB 63 targeting AI in health plan coverage determinations.
What this means for you
If you practice across state lines, or your clients do, the rules are already different depending on where you are. A disclosure process that works in one state may not satisfy another. This is where most practitioners will get caught.
Signal 4
Joint Commission and CHAI Preparing Voluntary AI Certification Program
The Joint Commission, in partnership with the Coalition for Health AI (CHAI), is developing a voluntary AI certification program expected to launch in 2026. They have already released governance playbooks covering seven core areas: executive oversight, regulatory compliance, ethical alignment, IT infrastructure, cybersecurity, safety protocols, and clinical department integration.
What this means for you
"Voluntary" today becomes "expected" within 18 months. If you build your governance framework now using these seven areas as a scaffold, you will not be scrambling when certification becomes the standard your referral partners and payers expect.
The Pattern
The federal government is pushing AI adoption while pulling back on oversight. States are writing their own rules. Accrediting bodies are building certification programs. The message is consistent even if the approach is fragmented: the practitioner who is using AI without a documented governance process is the one who will be exposed first. Not because AI is dangerous. Because the question "what is your process?" is about to become mandatory, and most practices do not have an answer.
One Thing You Can Do This Week
Open a blank document. Write down every AI tool you use in your practice — client-facing or not. For each one, answer three questions: (1) What data does it touch? (2) Who approved its use? (3) What happens if it gives a wrong answer? If you cannot answer all three for every tool, that is your starting point. That document is the beginning of your AI governance framework.