News
Healthcare AI regulation in 2026: FDA, CMS, and states create a patchwork that providers are struggling to navigate
A Dickinson Wright Health Law Blog analysis published August 2026 describes healthcare AI regulation as 'still complicated' — a patchwork of FDA device oversight, CMS reimbursement rules, HHS privacy guidance, and a growing layer of state AI laws that vary substantially by jurisdiction. Health systems and vendors operating nationally face compliance obligations that are simultaneously expanding and poorly harmonized.
- regulation
- FDA
- CMS
- state-law
- compliance
- patchwork
- health-law
The core regulatory complexity in 2026 is that three separate federal frameworks — FDA medical device law, HIPAA/privacy law, and CMS reimbursement rules — each apply to subsets of healthcare AI in ways that are not coordinated and sometimes in tension. A clinical decision support tool that is FDA-regulated as a device faces different obligations than one that falls under the Cures Act CDS exclusion, even if the two tools perform similar functions. Layer state privacy laws, state-specific AI legislation, and EU AI Act obligations for globally-marketed products, and the compliance picture is genuinely difficult.
The state layer is the fastest-moving and least predictable. As of August 2026, more than twenty states have enacted or proposed AI-specific legislation that touches healthcare — ranging from disclosure requirements when AI is used in clinical decisions to mandatory human-review requirements for AI-generated prior authorization denials. The obligations vary enough that a national health system or multi-state payer can’t write a single compliance policy that satisfies all jurisdictions.
The practical effect is compliance asymmetry. Large health systems with legal and compliance departments can navigate the patchwork, albeit expensively. Small and independent practices cannot — they rely on vendor certification and representations that may not fully reflect the regulatory complexity. That asymmetry creates compliance risk throughout the supply chain.
The most useful thing that could happen from a system perspective would be a federal framework that preempts at least some of the state variation. That has not emerged despite multiple Congressional proposals. The alternative — the EU’s approach of a single comprehensive framework — has the advantage of clarity but the disadvantage of prescription that may not age well with a rapidly evolving technology.
Primary source: Read the full original on Dickinson Wright Health Law Blog ↗