Diagnostic imaging, sepsis prediction, ambient clinical documentation, prior authorization, drug discovery and patient-facing chatbots now operate under the densest overlap of device law, data law, AI statutes and accreditation standards of any industry, and the bodies behind all four changed their expectations materially across 2025 and 2026. AxiLayer AI and AxiSentinel™ give health systems, payers, device and SaMD makers, pharma and health-AI vendors in the UAE and GCC, the European Union, Asia-Pacific, the UK and North America continuous, third-party evidence that every model touching a patient is still safe, fair and within its approved envelope. The FDA has now authorized more than 1,600 AI-enabled medical devices, and California’s AB 1979 and SB 503 set new rules for clinical AI from 1 January 2027.
Last verified: 23 October 2026
26 industry-specific mandates and 61 that apply across all industries, worldwide.
Next date for this industry: 1 Nov 2026, Egypt PDPL compliance period ends.
See all 87 mandates →Across late 2025 and 2026, healthcare regulators, legislatures and accreditors converged on the same demand from different directions: not proof that an algorithm was validated once, but proof that someone is watching it now that it is treating patients.
The FDA has authorized more than 1,600 AI-enabled devices, overwhelmingly via the 510(k) pathway on retrospective and often single-site data, and its lifecycle-management guidance for AI devices, drafted in January 2025, remains unfinalized. Meanwhile most clinical AI, EHR-embedded deterioration scores, ambient scribes, generative assistants, never passes through device review at all. Performance at your site, on your population, after the vendor’s next update is nobody’s approval and everybody’s liability. That is a monitoring problem, not a documentation problem.
Health-AI vendors preparing for procurement and health-system due diligence are covered in depth on the dedicated vendor assessment page.
Go to Vendor AssessmentsA single deterioration model or triage chatbot deployed across a multinational provider group can simultaneously be an FDA-regulated device function in the US, an Annex I high-risk system under the EU AI Act, a high-impact system under Korea’s AI Framework Act, and subject to the DoH Abu Dhabi AI policy, while the data feeding it answers to HIPAA, GDPR, the EHDS and Gulf residency rules. Each regime wants different evidence in a different format. This is the coverage map.
The Gulf pairs the region’s earliest health-AI rulebook with the world’s densest live deployment surface, emirate-scale health information exchanges running AI across entire populations.
US health AI answers to a device regulator, a privacy enforcer, an EHR certification program, fifty legislatures and an accreditor, and in 2025 to 26 all five moved.
Medical AI in Europe is a dual-conformity problem: the same system must satisfy the MDR or IVDR and the AI Act, assessed by notified bodies that are already the system’s scarcest resource.
Whether clinical software is a medical device turns on its intended purpose, not on who makes the final call. EU guidance (MDCG 2019-11) treats software that provides information used for diagnostic or therapeutic decisions as medical device software even when a clinician decides, and EU MDR Rule 11 places it in Class IIa or higher. A clear, tested intended-purpose statement often decides how heavy the regulatory path is. Where that software is AI, the EU AI Act adds high-risk obligations for AI in regulated medical devices from 2 August 2028, under the Digital Omnibus (Regulation (EU) 2026/1744). AxiLayer AI is not a notified body; our third-party assessment is designed to make the notified body review short and first-time.
Beneath the UK’s sandbox headlines sits the older statute that actually gates market entry: the Medical Devices Regulations 2002, still the operative law for Great Britain now that Northern Ireland instead follows the EU regime.
Three regulators reforming device law for AI without an AI act: sandbox-driven in the UK, guidance-led in Canada, framework-review-led in Australia.
Asia-Pacific holds both the strictest binding classification of health AI (Korea) and the most operationally specific lifecycle guidance (Singapore), with the region’s largest device markets accelerating approvals underneath.
No treaty governs health AI, but a recognizable global baseline now exists, and every national regulator on this page cites some part of it.
Each use case below carries a specific classification, a specific evidence expectation and a specific supervisor, or accreditor, in each market. AxiSentinel is configured per use case and per jurisdiction rather than shipped as one fixed pipeline.
Hospitals and health systems use AI to support care pathways, capacity planning and technology purchases. Each recommendation that shapes patient care needs a clear rationale, a named approver and a review when evidence changes.
Clinical AI handles the most sensitive data there is, and a manipulated or leaking system can harm patients and trust at once. AxiLayer AI works hand in hand with your cybersecurity team to test, monitor and evidence that these AI systems stay secure, under your written authorization.
Explore AI Cybersecurity Request an AI Cybersecurity Readiness Review
Status as of 28 October 2026. General information, not legal advice. Certifications, CE marking and regulated assessments named here are issued by the bodies the law designates.
AxiSentinel does not replace clinical governance, quality committees or regulatory affairs. It gives all three a continuous, third-party evidence feed, and it gives the board something it currently cannot get, which is an answer to “is every model touching a patient still performing, here, today?”
The first ask of the Joint Commission, CHAI, AIHGle 2.0 and Korea’s Act alike, maintained continuously from what is actually running, including EHR-embedded models switched on by default.
Continuous local validation evidence per deployment site and per population, the answer to models approved on someone else’s data, and the practical watch on the EU’s undefined “substantial modification” threshold.
Ongoing, evidenced testing across demographic groups, age, sex, ethnicity, payer class and site, sized for CHAI expectations, EU fairness duties and the risk-score failure modes the literature documents.
Evidence that HTI-1’s 31 source attributes, Korea’s explanation duties and Article 50 disclosures are present, accurate and current, not merely that they were written once.
Detects alert fatigue, override anomalies and rubber-stamped physician review, the specific failure SB 1120 legislates against and every clinician-in-the-loop regime assumes away.
Evidence that every model update stayed inside its predetermined change control plan, FDA’s final guidance of December 2024, the UK’s draft 2026 equivalent and Korea’s pre-approved change plans.
Incident, trend and performance records shaped for MDR/IVDR post-market surveillance, the GB PMS regulations and the FDA’s lifecycle expectations, generated continuously, not reconstructed at audit.
The AXI-Node agent runs inside your own environment, cloud, on-premise or fully air-gapped via the .axibatch format, so HIPAA, GDPR, EHDS and Gulf health-data residency are satisfied by architecture, not by exception. Patient data stays inside your environment or your in-region instance, with a Business Associate Agreement and Data Processing Agreement for every engagement.
Hallucination and omission detection for scribes and clinical copilots, disclaimer compliance under AB 3030, and the device-boundary evidence MHRA’s ambient voice guidance now expects.
Most hospital AI is bought, not built, and every regime on this page makes the deployer accountable anyway. Vendor and foundation-model behavior is monitored in situ, in your environment.
Tamper-evident, time-ordered records for accreditation surveys, notified bodies, FDA inspections and internal quality committees, verifiable without relying on AxiLayer AI.
Evidence that deactivation and rollback mechanisms exist, are tested and have been exercised, the last line of defense when a clinical model drifts, and the first question after an incident.
Healthcare AI in 2026 sits under several overlapping rules. Korea's AI Framework Act took effect on 22 January 2026 and classes healthcare AI as high-impact. Texas TRAIGA has required providers to disclose AI use in treatment since 1 January 2026. EU AI Act Article 50 transparency has applied since 2 August 2026, and California's AB 1979 and SB 503 cover clinical AI from 1 January 2027.
Under the Digital Omnibus, EU AI Act obligations for AI embedded in devices under the MDR or IVDR apply from 2 August 2028. Standalone Annex III health uses, such as emergency triage and dispatch and healthcare access and eligibility, apply from 2 December 2027. Systems already on the market are grandfathered unless substantially modified, a threshold regulators have not yet defined.
Not on its own in California. Under SB 1120, in effect from 1 January 2025, utilization-review AI cannot be the sole basis for denying care on medical-necessity grounds, and a licensed physician must make that determination. Payers should keep denial audit trails and evidence that physician review is real rather than rubber-stamped, as a 2026 wave of state prior-authorization AI bills follows.
A healthcare AI audit is a third-party assessment of whether each model touching patients or claims is still safe, fair and within its approved envelope, at your site and on your population. It covers the AI inventory, site-level performance and drift, bias testing across patient groups and human-oversight evidence. A qualified AxiLayer AI auditor reviews and signs every finding before it counts.
AxiLayer AI evaluates clinical and operational AI continuously with AxiSentinel against the rules that apply in each market, from FDA guidance and HTI-1 in the US to the EU AI Act, Korea's AI Framework Act and Singapore's AIHGle 2.0. A threshold breach becomes a finding only when a qualified AxiLayer AI auditor signs it. Request a briefing to review your clinical AI estate.
Last verified: 23 October 2026. See every mandate for this industry on the AI Audit Mandates Map.
A clinical AI estate review maps every model touching patients or claims, bought or built, device or not, against each regulator, statute and accreditor that supervises it: classification, evidence expectation, deadline and gap, and what continuous monitoring would look like inside your own environment, including fully air-gapped.
