Artificial Intelligence in Health: The Regulatory Landscape in 2026

Regulatory activity around artificial intelligence in health has accelerated substantially since 2023, and the pace has not slowed entering 2026. The FDA has moved from publishing conceptual frameworks to issuing enforceable guidance. CMS has begun attaching specific billing codes to AI-assisted procedures. ONC's information-blocking and interoperability rules are now intersecting with how AI outputs get surfaced in EHRs. And internationally, the EU AI Act's healthcare provisions entered their first enforcement phase in early 2026.

What follows is a structured record of the major formal actions across these bodies, organized by issuing authority. Each entry documents what changed, what it affects, and where to find the primary source. This is not a policy opinion piece — it is a reference document for professionals who need to track what has actually been decided.

FDA: Software as a Medical Device and AI/ML Guidance

FDA's Center for Devices and Radiological Health (CDRH) remains the primary US regulatory body for AI-enabled medical devices. The agency's position has evolved from the 2019 discussion paper on AI/ML-based SaMD to a set of binding guidance documents that now govern pre-market submissions, post-market monitoring obligations, and the conditions under which a cleared device may be modified without a new submission.

Predetermined Change Control Plans (PCCP)

The final guidance on Predetermined Change Control Plans for AI/ML-enabled devices, finalized in late 2024, established the formal mechanism by which manufacturers can describe anticipated post-market modifications to their AI algorithms without triggering a new 510(k) or De Novo submission for each change. A PCCP must specify the types of modifications permitted, the performance criteria that must be maintained, and the methodology for verifying those criteria before deployment.

The guidance defines three categories of modifications that a PCCP may cover: performance improvements using the same algorithm architecture, expansions in intended use population within the cleared indication, and changes to input data types where the clinical task remains identical. Modifications that change the fundamental algorithm architecture or expand the intended use to a new clinical indication are not eligible for PCCP coverage and require a new submission.

Transparency and Labeling Requirements

FDA finalized its guidance on transparency in AI/ML-based SaMD in 2025, establishing what information manufacturers must disclose in device labeling and in the summary of safety and effectiveness data (SSED) for De Novo and PMA submissions. The guidance requires disclosure of the training dataset's demographic composition, the external validation dataset(s) used, and any known performance differentials across subgroups.

This is a meaningful change from earlier practice, where demographic breakdown of training data was often absent from public-facing submission documents. The guidance does not require manufacturers to achieve performance parity across subgroups — it requires them to disclose what disparities exist. That distinction matters for how clinicians and procurement staff interpret the disclosed data.

Post-Market Surveillance Obligations

The 2025 final rule updating post-market surveillance requirements for AI/ML devices extended mandatory real-world performance monitoring to a broader set of Class II AI devices. Previously, post-market study orders under 21 CFR 822 were reserved primarily for high-risk devices. The updated rule creates a pathway for CDRH to require real-world performance data collection from manufacturers of cleared AI tools in high-volume clinical settings — particularly in radiology and pathology, where deployment scale is large enough to generate statistically meaningful post-market data.

Generative AI and Large Language Models: Current FDA Position

As of Q2 2026, FDA has not authorized any large language model or generative AI system as a medical device for diagnostic or treatment decision support. The agency published a discussion paper in 2025 outlining the regulatory challenges posed by foundation models and multimodal AI — specifically the difficulty of defining intended use boundaries for systems that generate open-ended outputs — but this has not advanced to a draft guidance.

Several manufacturers have submitted 510(k) applications for LLM-assisted tools in administrative contexts (prior authorization, coding, documentation summarization), and some of these have received clearance. However, no generative AI tool has been cleared for a clinical diagnostic task as of this date. Any deployment of LLMs in clinical diagnostic workflows currently operates outside the cleared-device framework.

CMS: Reimbursement Decisions Affecting AI

Coverage and reimbursement decisions from the Centers for Medicare & Medicaid Services have become a second major regulatory lever for AI in health. A device that is FDA-cleared but not reimbursable under Medicare faces a significant adoption barrier in most health system contexts. CMS has moved incrementally on this front, with a pattern that is worth tracking explicitly.

Transitional Coverage for Emerging Technologies (TCET)

CMS finalized the Transitional Coverage for Emerging Technologies pathway in 2024, creating a structured mechanism for FDA-cleared devices — including AI/ML SaMD — to receive temporary Medicare coverage while real-world evidence is generated. Under TCET, manufacturers apply for a four-year coverage window during which the device is reimbursed and post-market data collection requirements are attached. At the end of the TCET period, CMS makes a permanent coverage determination based on the accumulated evidence.

Several AI radiology tools entered the TCET pipeline in 2024 and 2025. As of Q2 2026, none have completed the full four-year cycle, so no TCET-to-permanent-coverage transitions have occurred yet for AI devices. The first transitions are expected in 2027–2028.

Category III CPT Codes and AI-Specific Billing

The American Medical Association's CPT Editorial Panel has established Category III (temporary tracking) codes for several AI-assisted procedures, and CMS has assigned relative value units to some of these under the Medicare Physician Fee Schedule. The current coding landscape for AI is fragmented: some AI tools are billed under existing Category I codes as part of the underlying procedure, some have dedicated Category III codes, and others have no established billing pathway.

ONC: Interoperability, Certification, and AI in EHRs

The Office of the National Coordinator for Health Information Technology has taken a different approach to AI governance than FDA or CMS — one focused on how AI outputs are communicated through certified EHR technology and what transparency obligations attach to clinical decision support delivered via EHR.

The 21st Century Cures Act Final Rule and Predictive DST

ONC's HTI-1 final rule, published in 2024, established new requirements for what ONC terms "predictive decision support interventions" (predictive DST) — a category that encompasses most AI-based clinical alerts and risk scores delivered through certified EHR technology. Under HTI-1, EHR vendors and developers of predictive DST must disclose the source attributes of their algorithms: the funding source, the development methodology, the training data characteristics, and the performance metrics used for validation.

The rule also requires that predictive DST delivered through certified EHRs allow clinicians to access the source attributes without leaving the clinical workflow. This is a practical interoperability requirement, not just a documentation mandate — the information must be retrievable at the point of care.

Information Blocking and AI Output Sharing

ONC's information blocking regulations, now in full enforcement, have created an indirect constraint on how AI outputs can be handled within health systems. If an AI tool generates a risk score or clinical alert that is incorporated into a patient's electronic health information, restricting access to that information — including to the patient themselves via USCDI-compliant APIs — may constitute information blocking. Several health systems have sought informal ONC guidance on how this applies to AI-generated content that is flagged as preliminary or unvalidated.

EU AI Act: Healthcare Provisions in Effect

The EU AI Act entered its phased enforcement timeline following publication in the Official Journal of the European Union in mid-2024. The Act classifies AI systems used in healthcare as high-risk, placing them in Annex III. This classification triggers a set of mandatory requirements before market placement: conformity assessment, registration in the EU AI database, technical documentation, risk management systems, and post-market monitoring plans.

Enforcement Timeline as of Q2 2026

The practical implication for manufacturers of AI medical devices placed on the EU market: the August 2026 deadline for Annex III high-risk system compliance is approximately three months away from this writing. Manufacturers who have not begun conformity assessment procedures are at risk of non-compliance at the enforcement date. The EU AI Act's requirements layer on top of — and do not replace — existing CE marking obligations under the EU MDR.

Interaction with EU MDR

The European Commission published a guidance document in late 2025 addressing the overlap between the EU AI Act and the EU Medical Device Regulation for AI-enabled medical devices. The guidance confirms that an AI medical device must comply with both frameworks simultaneously. The MDR governs safety and performance of the device as a medical product; the AI Act governs the AI system's transparency, risk management, and human oversight requirements. A conformity assessment under MDR does not satisfy AI Act requirements, and vice versa.

Cross-Cutting Issues: Algorithmic Accountability and Equity

Several formal actions across these bodies have addressed algorithmic bias and health equity in AI, though none has yet established enforceable performance parity requirements. The current regulatory posture is disclosure-based: require manufacturers to report what disparities exist, and require that this information be accessible to clinicians and procurement staff.

• FDA transparency guidance (2025): Requires disclosure of subgroup performance differentials in device labeling for cleared AI devices. Does not set minimum performance thresholds across subgroups.
• ONC HTI-1 (2024): Requires predictive DST source attribute disclosure to include information about the populations on which the algorithm was trained and validated.
• EU AI Act Annex III (effective August 2026): Requires high-risk AI systems to be designed to minimize discriminatory outputs and to include testing for bias across relevant demographic groups as part of the conformity assessment.
• HHS Office for Civil Rights: Published a final rule in 2024 under Section 1557 of the ACA prohibiting discrimination in health programs that use clinical algorithms. The rule requires covered entities to conduct bias testing of algorithms used in clinical decision-making and to document the results.

The HHS Section 1557 rule is worth particular attention because it applies to covered entities — hospitals, health systems, and insurers — not just device manufacturers. A health system that deploys a third-party AI tool in a clinical workflow may bear independent compliance obligations under Section 1557 even if the tool itself is FDA-cleared and the manufacturer has disclosed its bias testing results.

Summary Reference: Key Formal Actions by Issuing Body

What Is Not Yet Resolved

Several significant regulatory questions remain open as of Q2 2026. These are not gaps in this tracker — they are genuine gaps in the regulatory framework that affect how AI can be deployed, billed, and evaluated.

• No FDA pathway for generative AI diagnostic tools. The agency's 2025 discussion paper has not advanced to a draft guidance. LLM-based diagnostic support tools operate in a regulatory gray zone.
• No permanent Medicare coverage for most AI radiology tools. TCET provides a temporary pathway, but permanent coverage determinations for AI-specific applications remain largely unresolved.
• No ONC guidance on AI outputs and information blocking. Health systems face legal uncertainty about whether AI-generated risk scores embedded in patient records are subject to information blocking rules.
• No harmonized international framework. FDA, EU AI Act, MHRA (UK), and Health Canada each operate separate regulatory frameworks for AI medical devices with different classification criteria, evidence requirements, and post-market obligations. Manufacturers operating across jurisdictions must track and satisfy each independently.