Clinical AI Already Has Rules. Most Deployments Sit Outside Them.

The floor is uneven, not absent

The dominant framing this year has been that clinical AI operates in a regulatory vacuum. It’s more accurate, and more useful, to say the vacuum is selective. Policy researchers have documented real fragmentation, authority split across agencies built for a pre-adaptive-AI era bioengineer.org, with a 2025 paper proposing a hybrid of centralized oversight and local hospital governance rather than one federal rule RAPS. Australia has stood up an advisory body inside existing digital health governance rather than waiting on legislation Health Services Daily, while the US federal government declined to back international AI coordination even as states and the UK push ahead with their own regimes Faegre Drinker. That’s the correct diagnosis for new, AI-specific rulemaking. It’s the wrong frame for a compliance officer deciding what to do this quarter, because several existing accredited and certified regimes already attach to large parts of clinical AI today, whether or not anyone calls them “AI governance.”

Where an existing floor already bites

Clinical laboratories don’t wait for AI-specific rules to validate new tools. CLIA and CAP already require analytical and clinical validation before a diagnostic method, AI-assisted or not, goes live Lab Manager. NeoGenomics is scaling AI digital pathology infrastructure with Indica Labs inside that structure Clinical Lab Products, not alongside it. EHR-embedded decision support faces a parallel bar. ONC’s certification program keeps evolving its standards, including newly approved 2026 SVAP updates and HITAC’s own priorities around data exchange and innovation healthit.gov healthit.gov. And when Penn Medicine routed epilepsy patients’ texted questions to implanted brain monitors through an AI moderation layer with daily human review, that wasn’t a governance innovation invented from scratch. It was HIPAA’s existing privacy and security framework setting the floor, with the AI Governance Committee’s review process as the control that satisfies it Medical Economics.

Where nothing attaches at all

Revenue cycle and prior authorization AI has no equivalent gate. PHTI has flagged that AI tuned to optimize coding and denials is the highest-volume agentic AI in hospitals today, operating efficiently inside existing rules rather than any oversight built for it Digital Health Wire. Vendors are selling exactly that: one platform reports a 57% drop in preventable denials and an 8% lift in net collections PR Newswire, and Ensemble and Penelope Health are now linking payer policy data directly into claims systems Fierce Healthcare. None of this runs through CLIA, ONC certification, or HIPAA’s clinical data protections in any way that constrains the business logic itself.

The decision for compliance leaders isn’t whether to build a governance committee. It’s whether your inventory of AI deployments has been sorted by which existing accredited regime already governs it, CLIA, ONC certification, HIPAA, versus which ones sit in open air with no floor beneath them yet. Treat the second category as the actual gap. The first was never ungoverned to begin with.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The core argument—that existing frameworks (CLIA, ONC, HIPAA) already govern some clinical AI while revenue cycle AI operates ungoverned—is coherent and well-supported, though the claim that HIPAA ‘se
Source & Claim Verification	Qwen · hosted fallback (qwen-2.5-72b-instruct)	cleared. Most claims are supported by the provided sources, but a few sources could not be opened, affecting the verification of some claims.
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately maps clinical AI deployments to existing frameworks (CLIA, ONC, HIPAA) but omits critical specificity on HTI-1/HTI-5, CMS prior authorization (CMS-0057-F), and NIST AI RMF alig
Technical Accuracy	Llama	cleared. The article accurately describes existing regulatory frameworks governing clinical AI, such as CLIA, CAP, ONC certification, and HIPAA, and correctly identifies areas where these regulations apply and
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively counters the dominant narrative of a regulatory vacuum by highlighting existing frameworks, while also clearly identifying areas where no such oversight exists, with minimal v
Novelty & Non-Duplication	Grok	held. The uneven-floor synthesis (CLIA/CAP/ONC/HIPAA already bite on labs, CDS, and privacy; revenue-cycle AI sits outside) plus concrete deployments (NeoGenomics, Penn epilepsy, ONC 2026 SVAP) is a genuine
Validation	DeepSeek	cleared. The briefing’s central claim that many clinical AI deployments are already governed by existing regimes like CLIA, ONC, and HIPAA is strongly supported by cited examples of diagnostic, EHR-embedded, a

Sources cited: 40. Validation challenges: 0. Production cost: $0.28 (measured across drafting, revisions and every board review, plus an estimated image). Learn how these briefings are written and verified.