Health Care AI Policy: From Policymaking to Implementation and What's Next
Why It Matters
In Q3 2026, most legislative sessions came to end, but health AI oversight didn’t. Federal agencies proposed payment and regulatory pathways and launched ADOCATE, California enacted significant legislation – in particular regarding chatbots used by minors seek mental health support and independent oversight gained ground in California and Utah.
Our latest breaks down what changed and what providers, payors and developers should watch next.
Key Themes
- States are leading the charge. With limited federal action, states are setting the rules for how AI is used in health care. Congress has not advanced comprehensive legislation, the Administration emphasizes self-regulation and agency activity centers on proposed payment and regulatory pathways and innovative models to test more agentic and autonomous AI.
- Federal agencies are maturing AI-related programs focused on AI in clinical care. The Advanced Research Projects Agency for Health (ARPA-H) for its ADVOCATE program, which aims to produce an Food and Drug Administration (FDA)-authorized agentic AI system for cardiovascular care and the Centers for Medicare and Medicaid Services (CMS) launched the first cohort of the Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) model in July before four new tracks beginning in April 2027.
- Federal agencies are additionally seeking input on how AI in clinical care should be paid for and regulated. CMS's ) and proposed rules include a new Medicare payment category for algorithmic software (Software as a Medical Service, or SaMS) and several Requests for Information (RFIs) on how Medicare should pay for technology and AI-enabled care. FDA a discussion paper and request for feedback on the regulation of generative AI-enabled medical devices, proposing a two-axis risk framework and pre- and post-market monitoring approach.
- Independent verification is gaining ground. California's emerging framework for Independent Verification Organizations and the launch of third-party evaluators within Utah’s Regulatory Relief Program, together with APRA-H’s use of them in the ADOVOCATE program indicate a trend toward supervised deployment and independent review rather than purely prescriptive rules.
- Early litigation is shaping patient access to AI-generated data. A Washington trial court denied a patient's request for an injunction to obtain the ambient AI recording of her telehealth visit, finding it that such data fell under an exception for information compiled for administrative purposes and not part of the medical record. The ruling offers an early signal of how courts may treat data captured by AI scribes.
Overview of Key State Activity
Agency | Activity |
California | Activity in California drove nearly all of the quarter’s meaningful state legislation. Enacted laws enhance child-safety provisions for companion chatbots (), amends health chatbot privacy and clinician judgment (), address bias in clinical decision support ( However, not all the laws introduced to limit AI were enacted -the governor vetoed two bills that would have restricted use of AI in clinical settings (, ). |
Hawaii | Enacted chatbot protections for mental health and minor users (). |
Illinois | Became the second state this year to regulate payer downcoding (). |
Utah | Utah’s Office of AI Policy evidentiary expectations for its AI sandbox, signed three new mitigation agreements with digital health companies and two health system master agreements and added six third-party evaluators to perform independent verification of sandbox applicants pre- and post-deployment. |
Overview of Key Federal Activity
Agency | Activity |
CMS | Proposed a new Medicare payment category for algorithmic software (SaMS) and several RFIs on paying for AI. It also announced four new ACCESS model tracks starting April 2027. |
FDA | Released a discussion paper proposing a two-axis risk framework for generative AI-enabled devices and named its first Deputy Commissioner for Technology and AI. |
ARPA-H | Awarded up to $62.7 million for ADVOCATE, which aims to produce the first FDA-authorized agentic AI system for cardiovascular care. |
Looking Forward: Six Key Developments to Watch
The key question for 2027 will not be whether health care AI adoption continues, but whether policy, payment and accountability frameworks can keep pace as AI moves from assisting clinicians and administrative teams to performing more sophisticated functions and, in some cases, acting with greater autonomy. We are watching six developments:
- From pilots to durable payment pathways. CMS has begun creating pathways for technology-enabled care through ACCESS, the proposed SaMS payment category and the RFI related to reimaging and modernizing primary care payments. The next question is whether these initiatives result in improvements in clinical outcomes and save money and support a movement to more tech-enabled, value based care, rather than simply adding another reimbursable layer to the system.
- FDA’s approach to increasingly autonomous clinical AI. FDA’s generative AI discussion paper, the TEMPO program, and ARPA-H’s ADVOCATE program indicate that federal policy is beginning to contemplate how to test innovative models in the current federal regulatory environment, and in particular, evaluate AI that does more than provide recommendations. We will watch how FDA calibrates its oversight system to gather and evaluate evidence, perform pre- and post-deployment testing and monitoring, human oversight and incident or safety event reporting requirements. We also would not be surprised if FDA launched a new TEMPO-like sandbox available to technologies not serving ACCESS Model members.
- Liability and the emerging standard of care. Existing liability doctrines may not clearly allocate responsibility among developers, health care organizations and clinicians when AI contributes to patient harm, particularly when no clinician reviews each decision. As evidence and adoption increase, the standard of care may shift such that question becomes whether failing to use AI creates liability.
- States as the primary regulators of AI use. States will continue to regulate how AI is used in health care, with particular attention to chatbots, minors, clinical decision support, payer practices, privacy, bias and professional licensure. California’s 2026 laws are likely to influence bills introduced in other states in 2027.
- Sandboxes and independent verification as alternative oversight models. Utah’s expanded sandbox with independent evaluators and California’s IVO framework reflect growing interest in supervised deployment, generating real-world evidence and independent evaluation rather than relying exclusively on prescriptive regulation and relying on the AI tools own data and verification. We will watch whether these models produce scalable pathways to broader deployment and whether other states or federal agencies adopt similar approaches.
- Governance moving from best practice to expectation. Most health care organizations have basic AI governance in place. As the list of AI use cases grows and organizations become more facile with AI use, they will advance towards risk-based governance models that reduce friction for low risk use cases and increase the rigor applied to higher-risk use cases, such as more autonomous AI. Organizations will also invest much more in post-deployment monitoring and incorporate oversight of in-production models into their governance processes.
Read the full Q3 Health AI Tracker .
Talk to Manatt. For help on your organization’s AI journey, contact or .
