In January, with very little fanfare, the FDA redrew the boundary around clinical artificial intelligence.
The revised guidance on clinical decision support software superseded the 2022 version and clarified which functions fall outside device regulation entirely. The stated goal was to cut red tape and speed useful tools to market. The practical effect is that a substantial category of software now sitting between you and a clinical decision is, in regulatory terms, not a medical device at all.
This is not obviously wrong. Regulating every piece of software that offers a suggestion would be unworkable, and the statute the FDA is interpreting was written by Congress in 2016, not invented by the agency last winter.
But it does relocate a responsibility. If the federal government is not the one checking, somebody is. This Sunday, we look at who that turns out to be.
The short answer is that the check moved closer to you. Considerably closer than most clinicians realize.
Let's get into it.
— Troy, Ray, and Ibrahim
The FDA just decided most clinical AI is not a medical device
On January 6, 2026, the FDA published revised guidance on clinical decision support software, superseding its 2022 guidance and clarifying which CDS functions are regulated as devices and which are exempt under Section 3060 of the 21st Century Cures Act.
The revision confirms that certain functions, including software that surfaces a single clinically appropriate recommendation for a provider to review, drawing on the medical record and clinical guidelines, may sit outside FDA oversight if they meet every statutory criterion. Software that analyzes medical images to produce a diagnostic recommendation remains firmly regulated.
Why it matters: This is the line that determines whether a tool must show the FDA evidence before it reaches your workflow. A generative assistant that reads the chart and proposes a differential can, depending on how it is designed and marketed, fall on the unregulated side. An algorithm reading the same patient's chest film cannot. From the bedside, those two tools feel like the same category of thing. Legally they are not remotely the same.
The catch: The guidance is largely silent on consumer-facing tools: symptom checkers, health chatbots, patient-facing decision support. Those sit outside the clarified framework while being used by millions of people who cannot evaluate the output. The FDA says it will prioritize enforcement where AI guides care without adequate human oversight, but priority is not a review gate, and the phrase clinically appropriate recommendation for provider review assumes a provider with time to review it.
Bottom line: Federal pre-market review is no longer the thing standing between an unvalidated model and your patient, for a large and growing class of tools. The check that remains is your health system's governance committee, and whatever skepticism you personally bring to the screen. Find out whether your institution has the first one. You already have the second.
Read the full report from American College of Radiology →
Where do you land on this one? Hit reply and tell us. We read every response, and the best ones shape the next issue.
From the Field
This week we are asking about governance as it actually exists, not as the org chart describes it. Does your hospital have a real process for approving clinical AI, and have you ever seen its output? Were you consulted before a tool appeared in your workflow, or did it simply show up one Monday with a tip sheet? If you sit on one of these committees, we especially want to hear what the work is really like. We protect your anonymity and your patients' privacy, always.
The Profile: Brian Anderson, MD
President and Chief Executive Officer, Coalition for Health AI
Brian Anderson runs the organization trying to build the evaluation layer that federal regulation is stepping back from. The Coalition for Health AI is a national coalition of academic and industry partners working on technical standards and best practices for testing, evaluation, and monitoring of health AI.
Before CHAI he was Chief Digital Health Physician at MITRE, working across government and private sector digital health initiatives. His central proposition is that independent assurance has to become routine infrastructure rather than an act of academic volunteerism.
- Leads CHAI's development of technical standards for governance, testing, evaluation, and monitoring in health AI assurance labs
- Driving a national network of certified assurance labs to independently test health AI products for safety and effectiveness
- Championed model cards, effectively nutrition labels for clinical AI, so buyers can see what a model was trained and validated on
- Co-authored the guidance released with the Joint Commission in September 2025 that underpins its 2026 certification program
Quick Hits
Texas now requires you to tell patients
Texas House Bill 149, effective January 1, 2026, mandates explicit patient disclosure when artificial intelligence is involved in healthcare services. It is part of a widening state patchwork layering AI-specific consent and disclosure rules on top of existing privacy frameworks, and a preview of the compliance map systems will be managing state by state. LEARN MORE
The Joint Commission will now certify you for this
The Responsible Use of AI in Healthcare certification launched in June 2026, recognizing organizations with governance, safeguards, monitoring processes, and education in place. Any healthcare organization may apply, including those the Joint Commission does not accredit. Voluntary, but it establishes a reference standard where none existed. LEARN MORE
Chief AI Officer becomes a real job
Health systems are increasingly creating Chief AI Officer roles, concentrating strategy and governance coordination in one executive rather than distributing it across committees that meet monthly. Reporting through 2026 describes CIOs shifting focus from deployment to governance, which is roughly the order those two things should have happened in. LEARN MORE
Lawyers read the guidance more carefully than the press releases did
Multiple firm analyses of the January revision converge on the same point: the FDA did not deregulate clinical AI, it clarified statutory boundaries Congress drew in 2016, and the exemptions come with conditions that many products will not actually satisfy. Worth reading before assuming a vendor's unregulated claim is accurate. LEARN MORE
Off the Clock: the meaning of for provider review
The entire regulatory architecture now rests on four words: for the provider's review.
If software merely offers a recommendation that a licensed professional independently evaluates, it is not practicing medicine. You are. The tool is a reference, like a textbook or a colleague's opinion, and nobody asks the FDA to approve a textbook.
That logic is sound. It also depends entirely on a factual claim about your working conditions: that you have the time, the information, and the cognitive room to actually perform the review the statute assumes.
Anyone who has worked a full clinic knows how that claim holds up around hour nine. The chart is open, the suggestion is reasonable, the next patient is waiting, and the effort required to independently reconstruct the reasoning is exactly the effort the tool was purchased to eliminate. Not reviewing it is the entire value proposition. That is not a character flaw in clinicians. It is the design intent of the product.
So the law imagines a physician reading a suggestion with fresh, skeptical attention, and the economics imagine a physician moving faster because they did not have to. Both cannot be true at scale, and only one of them has a budget behind it.
None of this makes the guidance wrong. The alternative, routing every clinical suggestion through device review, would have frozen a field that is genuinely helping people. But we should be honest about where the burden landed when the federal government stepped back. It did not vanish. It moved onto a governance committee that may or may not exist at your institution, and onto the last human in the chain.
That human is you, at hour nine, with the door open.
If we are going to build the system on your judgment, the least we can do is protect the conditions that make judgment possible.
Until next Sunday.
For the people keeping medicine human.
