The Legal and Regulatory Healthcare AI Landscape

Michelle Mello, JD, PhD, Professor of Law and Health Policy, Stanford University Schools of Medicine and Law, spoke at the August 2026 TDC Group Executive Advisory Board Meeting in Napa, California, which gathered top healthcare executives, academic researchers, and clinical leaders to discuss “Healthcare AI in 2026: Emerging Issues as the Field Matures.”

Healthcare AI has potential to improve access to care, reduce costs, and lessen burdensome work for clinicians. However, adopting AI also raises difficult questions about safety, accountability, and patient trust—and the legal and regulatory systems for AI technology in healthcare remain unsettled.

The current challenges surrounding rapid AI adoption are clear: Who’s responsible for patient harm, and how should we think about risk management in this emerging space?

The answers, at least for now, are complicated. Responsibility is being shaped less by comprehensive federal rules and instead by a combination of institutional governance, state law, contracts, litigation, and professional judgment. This mixture is a promising opportunity for common sense AI adoption, but it may also create patient safety and liability risks.

Framing the Federal Healthcare Regulatory Landscape

Federal momentum around healthcare AI safety regulation has slowed. Congress continues to show interest in addressing child safety risks, chatbot regulation, national security concerns, and ethical use of AI by health insurers, but we have yet to see any significant regulatory steps taken from a legislative standpoint.

There are key areas where federal agencies are involved in evaluating and regulating AI in patient care:

• The Federal Trade Commission (FTC) monitors for unfair or deceptive business practices, particularly companies making unsubstantiated claims about the capabilities of their AI technologies.
• The Food and Drug Administration (FDA) conducts premarketing reviews of a limited range of healthcare AI tools. The agency released new guidance in 2026 signaling its intention to further limit what it intends to review and a request for comment that indicates it is considering how best to tackle the challenge of regulating generative AI tools.
• The Department of Justice (DOJ) became involved in a challenge to a Colorado AI law in 2026. The state requires companies to publicly share an impact assessment of their healthcare AI product to minimize discrimination risk. The AI company filed a legal claim alleging that this requirement violates free speech protections, and the DOJ intervened in the matter, siding with the manufacturer.

The Focus of State Legislation

A major thrust of state legislative activity in the healthcare AI space has been requiring more transparency about use of healthcare AI, though disclosure-based regulation often has limited practical effects.

Some states are trying to ensure health insurers cannot use AI to deny claims or prior authorization requests without human review. Others are attempting to define the scope of practice for AI, such as prohibiting chatbots from delivering mental health therapy, and others are exploring whether algorithms should be certified before performing medical functions. Some states have also moved to establish liability rules, with the specific rules chosen varying dramatically from strict liability for developers to total immunity.

Despite the volume of bills, the laws actually passed have been fairly modest in scope. Current legislation is unlikely either to slow innovation or to meaningfully contribute to the ongoing conversation around safe AI use.

Healthcare AI Liability Risk Is Emerging

Healthcare leaders are understandably anxious about AI liability because of the potential scale of AI use. AI tools are often adopted with less evidence than other medical technologies, and few of these tools have been tested in randomized controlled trials. If an AI tool makes a mistake, it may replicate the error across many patients, creating substantial liability exposure. Media coverage of such incidents would entail reputational risk, and public distrust of AI in healthcare means that potential jurors may be sympathetic to narratives that AI harmed a patient. Sixty percent of surveyed Americans say, “I would be uncomfortable with the use of AI in my care,” and many patients distrust hospitals’ ability to oversee AI responsibly.

Because contracts dominate AI procurement, healthcare organizations must pay close attention to license terms. Developers frequently disclaim liability and warranties. Some healthcare-specific and general AI product terms of service warn users not to over-rely on output or use the tools in certain ways, even though it’s widely known that they will be used in those ways.

Plaintiffs are beginning to test those limits. For example, a Florida man brought a lawsuit after he allegedly relied on ChatGPT for health guidance, including when experiencing symptoms associated with pulmonary embolism. The bot had stated that he was “a man of faith who believed in the healing power of God” and allegedly counseled him not to seek care. Another case involved a veterinary practice suing the maker of an AI tool that allegedly misdiagnosed a dog’s tissue sample, which caused the veterinary practice reputational and business harm.

If you are a physician using an AI tool to aid in diagnosis or treatment, and if that tool makes a mistake, the developer is a potential co-defendant in a lawsuit. But if developers continue to disclaim liability, then the risk falls completely on healthcare practitioners.

Developing a Risk Management Framework

Courts are still learning how to handle software-related personal injury cases. Judges also have limited experience with these claims and may not effectively distinguish between rules-based software and AI.

In this landscape, clinicians must be proactive in establishing a risk management framework for their organization. The useful question is not whether to be an “AI-enabled practice,” but how to assess the risk of each tool in its specific workflow and how to use it safely. Performance data from the developer matters, but it is only the start.

When evaluating tools in for use in practice, healthcare organizations should consider:

• The likelihood that the tool will err.
• Whether humans have realistic opportunities to catch AI errors, which may depend on:
• How tightly the AI tool is coupled with clinical decisions that affect patients (i.e., is the output merely advisory or does it cause something to happen?).
• Whether there is time for a human in the loop to review the AI output.
• Whether there is “situational opportunity” to intervene when the AI makes mistakes (i.e., even if there’s enough time to catch errors, are humans likely to do so? Or might they become too complacent with the AI?).

• The severity of the potential harm if it does reach the patient. This depends on the tool, the patient population, and the clinical context.
• The ease with which plaintiffs could obtain redress in the legal system. Is the injury severe enough to attract a plaintiff’s attorney? How difficult will it be to prove that the AI was defective and that defect caused the harm?
• Whether the healthcare organization would bear the full responsibility for the harm. AI tools developed in house offer greater control but that means there’s no external developer with which to share responsibility.

Vetting and governance matter a great deal. Organizations should ask hard questions before adoption, not simply rely on vendor pitches or choose a tool because it integrates best into the EHR. Available frameworks can help buyers examine potential tools, such as the Coalition for Health AI, Stanford’s ethics assessment work, and the Health AI Partnership.

Practical Steps When Considering an AI Vendor

Ultimately, most advice for choosing an AI tool is inherently practical:

• Bargain for monitoring support in the licensing agreement.
• Ensure your organization has access to information in the developer’s control that can help you confirm the product is working as intended.
• Resist disclaimers of liability and warranty, indemnification provisions, and liability limits in licensing agreements.
• Confirm the vendor has adequate insurance.

Organizations should document the version of the AI tool and output settings their clinicians use for decision-making. As part of your risk management protocols, preserve enough information in your records to reconstruct what happened during a patient encounter when using the AI tool. For example, if a clinician rejected an AI recommendation, why?

User training is vital. Training should go beyond how to navigate the interface and explain the primary failure modes of the AI. For example, clinicians must be aware of factors that negatively impact a scribe tool’s performance, such as accented voices or use in mental health therapy.

Finally, organizations must decide what to tell patients about use of AI. Legal requirements around wiretapping, consent, AI disclosure, and privacy vary by state, but ethical questions may be more important than the legal floor. Patients may not need to know every technical detail, but they deserve honesty when a tool creates more than negligible physical risk and the information would help them protect their interests.

A Private Responsibility for Healthcare Organizations

For the moment, much of healthcare AI governance remains private. On the positive side, this provides room for professional judgment and best-practice development instead of regulators imposing broad rules that may not fit the technology or clinical workflow. However, it also creates responsibility. Healthcare organizations, clinicians, insurers, and legal professionals must take affirmative steps to use AI safely and wisely rather than waiting for courts and legislatures to catch up.

Healthcare AI does not need to be avoided, but adoption should be paced according to the organization’s ability to govern the technology. The tools are evolving faster than formal oversight, and the consequences of mistakes could be serious. Responsible use will require a combination of careful scoping, rigorous vetting, ongoing monitoring, human oversight that realistically considers people’s working conditions, carefully constructed contracts, and patient transparency. Clinicians must be willing to ask whether an AI system is not just merely impressive but also safe enough to work within their practice.

Michelle Mello, JD, PhD, is a Professor of Law at Stanford Law School and Professor of Health Policy at Stanford University Schools of Medicine and Law. Dr. Mello conducts empirical research into issues at the intersection of law, ethics, and health policy. She is the author of nearly 300 articles on artificial intelligence (AI), medical liability and patient safety, ethical and legal issues arising in biomedical research, and other topics. Dr. Mello is Co-Director of the Healthcare Ethical Assessment Lab for Artificial Intelligence (HEAL-AI) at Stanford University, which conducts ethical assessments of AI tools proposed for deployment at Stanford Health Care facilities.

The recipient of a number of awards for her research, Dr. Mello was elected to the National Academy of Medicine at the age of 40. From 2000 to 2014, she was a professor at the Harvard School of Public Health, where she directed the School’s Program in Law and Public Health.

Dr. Mello holds a juris doctor (JD) degree from the Yale Law School, a doctor of philosophy (PhD) degree in health policy and administration from the University of North Carolina at Chapel Hill, a master of philosophy in liberal arts (MPhil) degree from Oxford University, where she was a Marshall Scholar, and a bachelor of arts (BA) degree from Stanford University.

The opinions expressed here do not necessarily reflect the views of The Doctors Company. We provide a platform for diverse perspectives and healthcare information, and the opinions expressed are solely those of the author.