Skip to main content

AI in Healthcare Is Regulated Six Different Ways

One AI diagnostic tool can fall under FDA, HIPAA, EU MDR, EU AI Act, CMS, and state laws simultaneously. The complete regulatory map for healthcare AI.

Investigative reporters found major Medicare Advantage insurers using AI to deny claims at scale. Overriding treating physicians over 90% of the time. CMS responded: AI can inform a coverage decision, but a doctor's clinical judgment is the final word. That's one agency. One rule. There are six more. The FDA calls the same tool a medical device. HHS says it's a health IT module. The EU says it's both a medical device under MDR and a high risk AI under the AI Act. California wants patient disclosure. HIPAA has opinions about the training data. Seven frameworks. Zero coordination. The FDA Isn't Regulating "AI." It's Regulating Software. The FDA doesn't have an "AI regulation." It has medical device regulation that increasingly applies to software. If your AI makes or informs a clinical decision (diagnosis, treatment recommendation, risk prediction), it's likely Software as a Medical Device (SaMD) under existing 510(k), De Novo, or PMA pathways. The "AI" label doesn't change the regulatory category. It changes the difficulty of demonstrating safety and effectiveness. The genuinely new part is the Predetermined Change Control Plan (PCCP).