The federal government has started describing what good artificial intelligence health guidance looks like, and a private consortium has started describing what a vendor has to disclose about the tools that deliver it. Both are lists of product requirements rather than rules, the apps that satisfy the federal list are now recommended to Medicare enrollees on a government website, and one of its three categories is weight and prediabetes coaching. If that is your work, the standard now exists in writing twice over and you are in neither document.
Signal 1
Medicare Is Now Recommending Apps That Coach Weight and Prediabetes
On October 9, KFF Health News published an investigation into how the Centers for Medicare and Medicaid Services, the federal agency that runs Medicare, built its health technology program. Reporters reviewed thousands of messages from a private Slack workspace, a closed group chat, that the agency has run since August 2025 and that now holds about 1,700 members, most of them technology companies and investors. Through that chat, agency staff invited a selected group of companies to a February listening session with the Food and Drug Administration on conversational AI for patients, which means chatbots that answer health questions. The meeting appeared on no public calendar and the public was not invited. A former FDA lawyer who reviewed the messages said the group resembles a federal advisory committee, which is a panel that by law has to meet in public and balance its membership. The same program runs the Medicare App Library, a directory on medicare.gov that now recommends twenty-four private apps to Medicare enrollees under three category labels, one of which is diabetes and obesity support. The published requirements for that category name personalized coaching built on a person's clinical record and covering medication, labs, nutrition and activity. The requirements for the chatbot category say an app must label AI-generated output, carry a disclaimer, and keep educational content separate from clinical guidance. Those reviews are performed by two private organizations rather than by the agency, which writes that the program is a movement rather than a mandate and a call to action rather than a regulation, and its chief product officer for health technology put the result plainly in a public talk last month: no regulation, no rulemaking. One note on language before the reading, because it changes what every one of these documents will look like. By executive order of September 29, the federal government renamed artificial intelligence Super Intelligence, abbreviated SI, and told agencies to use those words in place of AI. This Brief uses SI from here on, and quotes any source document in whatever words that document actually used.
Sources: KFF Health News, October 9, 2026 | Medicare App Library, medicare.gov | Published requirements for the Medicare App Library, cms.gov
What this means for you
Read this as the first written federal description of what adequate SI health guidance looks like, and then notice what kind of document it is. It is a product specification, not a rule. The agency did not regulate anyone. It wrote a list of requirements, had two private reviewers check them, and put the apps that passed in front of sixty-eight million people on a government page. That sets a standard faster than rulemaking does, because it needs no comment period, no public docket and no vote, and it leaves almost nothing for anybody to challenge. The consequence for a practitioner nobody is governing is that the comparison has changed. A client can now be sent by a government website to an app that will build a weight and prediabetes plan out of their own medical records, and the review that earned that app its place covered privacy, security and identity verification, not the quality of the guidance. You are doing that same work by hand with no listing, no seal and no page behind you, and also with no written requirement to label what came from a machine, because the requirements were written for software and you were never in scope.
Signal 2
A Private Consortium Wrote the Questionnaire Your Vendor Will Answer
On October 1 the Coalition for Health AI published a draft intake framework and opened it to pilot. The coalition is a group of health systems, technology companies and investors that writes voluntary standards for the use of SI in health care, and intake is the step where an organization decides whether to let a tool in at all. The framework carries fifty-seven controls across eleven domains, assembled by reading more than eight hundred questions out of roughly sixteen questionnaires already in use at health systems and reducing them to one common set. Each control is written as a plain-language yes or no statement with the evidence that would support it named beside it, and the coalition reports that forty percent of the controls can be satisfied by vendor attestation alone, which means the vendor states that the control is met and no document is examined. It also reports that its own Applied Model Card, the disclosure format it published earlier and still maintains, fully satisfies twelve of the controls and partially addresses twenty-nine more, which it puts at seventy-two percent coverage of the common set. The stated aim is that a vendor prepares one evidence package and many organizations accept it as their starting point, and in time that some trusted party verifies those attestations against the common requirements. The pilot is open to healthcare delivery organizations and to vendors.
Source: Coalition for Health AI, October 1, 2026
What this means for you
Read the seventy-two percent first, because it is the shape of the whole thing. The body that convened the working group is reporting that a format it already publishes answers most of the questions that working group decided to ask. That is not misconduct and it is not even surprising, but it is what capture looks like from the inside, where the questions end up drawn around an answer that already exists. Set the forty percent beside it and a framework that reads as diligence is, in large part, a vendor's own word measured against a template kept by the same group that convened the process. The consequence for somebody nobody is governing is that the document you would ask a vendor for is being standardized by a process you are not in. The pilot is open to health systems and to vendors, and you are neither, so you will receive whatever the package ends up holding, with no say over which questions it asks and no standing to ask for more. If two fifths of it can be met by the vendor agreeing that it is met, then the answer you get back about a tool you run alone, with nobody checking behind you, is partly just the vendor saying the tool is fine.
The Pattern
There is a pattern in how the rules that reach you arrive, and it is worth naming, because it explains why none of them ever seem addressed to you. They do not arrive as rules. They arrive as clearances that say what a tool may decide, as statutes that put duties on advertisers, developers and facilities, and now, in two documents at once, as a list of requirements a company has to satisfy before it is allowed to sell, written once by a federal program and once by a consortium of the companies themselves. Every time, the obligation lands on a business and the expectation lands on you. A client reads a disclaimer an app was required to show, and then expects the same clarity from the person sitting in front of them, who was never required to give it and may never have thought of it. It is worth knowing the posture of the department doing the recommending. On September 29 the health secretary told a summit audience that SI can give a patient a second opinion much better informed than any doctor in the country, and six medical societies including the American Medical Association answered the next day that claims of that kind diminish physician expertise and risk undermining trust (fiercehealthcare.com/ai-and-machine-learning/doctors-push-back-after-rfk-jr-turns-heat-debate-over-ais-role-medicine). Those six had somebody to write that letter for them. The practical effect is that the standard you will be measured against is being written continuously, by people describing software, in documents that do not use your job title, and nobody is going to send you the part that applies to you, because formally none of it does.
What To Watch
Executive Order 14434 of September 29 renamed artificial intelligence to Super Intelligence across the executive branch, and there is a deadline inside it. Within sixty days, so by November 28, the President's science and technology adviser has to hand the President proposed legislative language for a federal statutory definition of SI, including an assessment of whether it should modify, expand or supersede the definition already in the United States Code. Every disclosure rule, state copy and vendor requirement you have been tracking is written against that existing definition, so a new one can change what counts as covered without anybody amending a single rule. Source: https://www.federalregister.gov/documents/2026/10/02/2026-20321/inaugurating-the-era-of-super-intelligence.
Pennsylvania's Department of State filed suit against Character Technologies in Commonwealth Court on May 1 and announced it on May 5, seeking an injunction under the Medical Practice Act; the case is Commonwealth of Pennsylvania, Department of State, State Board of Medicine v. Character Technologies, No. 220 MD 2026, and as of early September no responsive pleading had been filed and no ruling has been reported. The statute it runs on is the part that reaches you. That Act defines unauthorized practice to include holding yourself out as authorized through a professional title, and a companion section lets the state obtain an injunction without proving that anybody was injured. The state has been explicit that its theory does not depend on whether the advice was accurate, only on the claim of licensure, so what is at issue is a title rather than a harm, and the question the court answers is whether a title alone with nobody hurt is enough to count as practicing, which is the question that decides where an unlicensed practice actually sits. Source: https://www.pa.gov/governor/newsroom/2026-press-releases/shapiro-administration-sues-character-ai-over-fake-medical-claim.
One Thing You Can Do This Week
Open medicare.gov/health-apps and read it the way a client would. It takes twenty minutes. Twenty-four apps are listed, each with its own description of what it does for a person, under three category labels the page itself uses: kill the clipboard, conversational AI assistants, and diabetes and obesity support. Find the category closest to your own work and read those descriptions word for word rather than the marketing around them. One app offers care for prediabetes, high blood pressure, high cholesterol and weight-related conditions from home. Another offers AI primary care with licensed physician oversight and a thirty-nine dollar visit. On one page, with today's date at the top, write the three things those descriptions promise that a client might reasonably assume you provide too, and the one thing you provide that none of them can. You are not competing with these apps and you do not need to be. You do need to know what your client read on a government website before they called you, because that is now part of what they arrive expecting, and none of it was written down anywhere you were asked to look.