Artificial Intelligence has moved from peripheral applications into core healthcare infrastructure, spanning clinical decision support, diagnostics and administrative workflows. Policy development at the federal level has not kept pace, leaving states to become the primary regulators of Artificial Intelligence deployment in healthcare. In 2025, more than 250 AI-related healthcare bills were introduced in state legislatures, with a consistent focus on patient disclosure and informed consent, prevention of biased or discriminatory effects, clinician accountability, limits on unlicensed service delivery and restrictions on insurer use of Artificial Intelligence in coverage determinations and utilization review.
The emerging patchwork of state rules, especially around bias and discrimination, is creating the risk of a fragmented regulatory environment that could constrain broader deployment. At the federal level, Congress has not passed any significant legislation directly affecting healthcare Artificial Intelligence, instead concentrating on oversight and policy development. The Trump Administration released a National Policy Framework for Artificial Intelligence on March 20, 2026, calling on Congress to establish a single federal approach with guardrails covering child safety, free speech, intellectual property, workforce impacts and national security. The framework also seeks to codify elements of President Donald Trump’s December 11, 2025, executive order, though executive orders do not carry the force needed to preempt state statutes.
Within the U.S. Department of Health and Human Services, activity remains incremental but meaningful. The FDA is relying on guidance, pilots and internal modernization to clarify how existing law applies to Artificial Intelligence-enabled technologies, particularly in clinical and diagnostic settings. Key priorities include clarifying the boundary between clinical decision support and regulated software, expanding lower-risk pathways, increasing expectations for transparency and validation, and moving toward life cycle oversight with post-deployment monitoring and change management. CMS is shaping adoption through payment models and pilots rather than direct regulation, including the Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) model and the Wasteful and Inappropriate Service Reduction (WISeR) model. The CDC has issued guidance on agentic research and an agency-wide vision for Artificial Intelligence in public health, while NIST is pursuing voluntary standards through its AI Standards Zero Drafts pilot project.
Across HHS, a common risk-based approach is emerging, centered on auditability, traceability, human oversight, interpretability and ongoing performance monitoring. The broader outlook points to continued divergence between state and federal action in the near term, lighter oversight for lower-risk consumer tools, tighter scrutiny for clinical decision-making uses and unresolved policy gaps for generative Artificial Intelligence. As regulatory expectations rise, healthcare organizations are increasingly focused on governance, documentation and compliance processes that can keep pace with a rapidly evolving legal landscape.
