AI Regulation: The New Compliance Frontier

Artificial intelligence (AI) utilization in healthcare has rapidly transformed from peripheral use cases to core clinical and operational infrastructure. It is increasingly embedded across clinical decision support (CDS), diagnostics and administrative workflows.

As a result of this rapid acceleration, AI adoption has outpaced legislation and overall policy development at the federal level, leaving state legislatures to take the lead in regulating the deployment of AI in the healthcare industry.

State-Level Activity: Near-Term Landscape, Long-Term Implications

States have emerged as primary actors in regulating the use of AI in the healthcare industry. In 2025, more than 250 AI-related healthcare bills were introduced in state legislatures, with a consistent focus on:

• patient disclosure and informed consent frameworks for AI-enabled care
• ensuring AI use does not lead to biased or otherwise discriminatory effects
• preservation of clinician accountability for AI-informed decisions
• ensuring AI technologies do not provide services that are reserved for licensed healthcare professionals
• restricting the use of AI by health insurers, particularly in coverage determinations and utilization review

Different state requirements, particularly around bias and discrimination requirements, pose a risk of creating a fragmented regulatory environment that could constrain AI deployment.

Federal Activity: U.S. Congress and the Trump Administration

Congress has not passed any significant legislation to date that directly impacts the use of AI in healthcare. Rather, lawmakers have focused their efforts on oversight and policy development. The policy focus of congressional Republicans has shifted focus toward adopting an industry-agnostic framework of laws that focuses on supporting innovation and addresses targeted risks such as child safety, intellectual property and infrastructure costs.

The Trump Administration released a "National Policy Framework for Artificial Intelligence" on March 20, 2026, that asks Congress to establish a single federal approach for regulating AI use, with specific guardrails on areas including child safety, free speech, intellectual property, workforce impacts and national security.

The framework also calls for codifying elements of President Donald Trump's December 11, 2025, executive order on the National Policy Framework for Artificial Intelligence that sought to preempt state-level AI activity. Executive orders, however, do not carry the force of law needed to preempt state statutes.

Federal Activity: HHS AI Actions

Under the current U.S. Department of Health and Human Services (HHS), AI-related activity remains incremental but directionally significant, with the U.S. Food and Drug Administration (FDA), Centers for Medicare & Medicaid Services (CMS), Centers for Disease Control and Prevention (CDC), and National Institute of Standards and Technology (NIST) advancing policy through targeted guidance and pilot programs rather than new rulemakings.

FDA Actions

The FDA is advancing AI policy through guidance, targeted pilots and internal modernization efforts. Agency activity remains focused on clarifying how existing statutory and regulatory authorities apply to AI-enabled technologies, particularly in clinical and diagnostic contexts.

Recent actions of note:

• clarification of CDS boundaries, with continued emphasis on whether clinicians can independently evaluate the basis for recommendations when distinguishing non‑device CDS from regulated software
• use of pilots and enforcement discretion, including initiatives such as the Technology-Enabled Meaningful Patient Outcomes (TEMPO) Pilot, which aims to utilize real‑world evidence generation for certain digital health technologies, including AI‑enabled tools, in coordination with CMS payment models
• expansion of low-risk pathways, including general wellness and other lower‑risk digital health products, signaling reduced regulatory burden for certain applications
• increased expectations for transparency and validation, particularly with respect to data inputs, model development, intended use and known limitations
• movement toward life cycle oversight, including post‑deployment monitoring, change management and performance tracking for adaptive algorithms

In parallel, the FDA has deployed AI tools internally to support scientific review, inspections and surveillance functions, reflecting the agency's interest in operational use of AI.

CMS Actions

CMS is shaping AI adoption primarily through payment models, demonstrations and administrative pilots rather than direct regulation. Through the Center for Medicare and Medicaid Innovation, CMS is testing how AI-enabled and data-driven tools can be integrated into care delivery and program administration.

Recent actions of note include:

• Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) model, which tests outcome-based payment approaches for technology-enabled chronic care in Original Medicare and is structured to support AI-enabled analytics and decision-support tools
• Wasteful and Inappropriate Service Reduction (WISeR) model, which pilots the use of AI and machine learning to support prior authorization and utilization review for select services in traditional Medicare
• Agency-wide AI engagement, including requests for information and AI-focused demonstration efforts such as CMS "Demo Days," to assess commercially available tools relevant to care delivery, enrollment and program integrity

CDC Actions

The CDC is approaching AI through research guidance, internal governance and public health capacity building, with an emphasis on responsible use and public trust.

Recent actions of note include:

• agentic research guidance released on March 12, 2026, titled "Considerations for Agentic Research in Public Health," addressing the use of "deep research" tools that autonomously plan and execute multistep research tasks, emphasizing human oversight and clearly defined use cases
• agency-wide AI strategy released on March 13, 2026

NIST Actions

NIST continues to shape AI governance through voluntary standards, technical frameworks and stakeholder-driven processes rather than regulation.

Recent actions of note include:

• The AI Standards "Zero Drafts" pilot project aims to accelerate standards development by producing preliminary, technically grounded drafts for submission into private sector-led standards development organizations.
• Initial focus areas include AI dataset and model documentation, testing and evaluation methodologies, and foundational concepts related to transparency and validation.

Cross-Agency Themes

These actions reflect a coordinated approach within the department, reinforced by HHS' Artificial Intelligence Strategy, released on December 4, 2025. The strategy outlines how HHS intends to integrate AI across departmental operations, including research and public health programs, with an emphasis on governance, responsible use, workforce readiness and operational efficiency.

Within this framework, agency‑level guidance, payment models, pilots and standards activities function as complementary components of HHS' broader effort to incorporate AI across health and human services on a risk‑based, use-case specific basis.

Across HHS, several common priorities are emerging:

• auditability, or the ability to understand and reconstruct how AI outputs are generated
• traceability of data sources, training methods and model versioning
• human oversight and interpretability, particularly in clinical and public health contexts
• ongoing performance monitoring, especially as models evolve over time

Strategic Outlook

Several trends are expected to shape the regulatory trajectory for AI in healthcare:

• Continued State-Federal Divergence. States are likely to remain more active in the near-term while federal policy evolves incrementally.
• Low- and High-Risk AI. Lower-risk, consumer-facing tools will face lighter oversight, while clinical decision-making applications will be subject to greater scrutiny.
• Generative AI Policy Gaps. Existing frameworks do not fully address newer use cases.
• Adoption Acceleration. AI is already embedded in key workflows, particularly in documentation and clinical support.

Tracking Activity: HK Health AI Navigator

Holland & Knight launched its Health AI Navigator, a centralized, interactive resource designed to help healthcare stakeholders track and interpret the rapidly evolving legal and regulatory landscape for AI in healthcare.

As regulatory expectations increase, organizations are adopting tools to operationalize compliance. Holland & Knight's Health AI Navigator is designed to:

• map applicable federal and state requirements
• track regulatory developments and enforcement trends
• support audit-ready documentation
• integrate governance, risk and compliance workflows

For more information or questions, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.