Healthcare AI Regulatory Tracker: Federal, State and EU Sources
Last updated: October 2026
This tracker lists the federal, state and EU sources that bear on healthcare AI and says what each one covers, as read from the source itself on October 6, 2026.
A healthcare AI regulatory tracker is a dated list of the laws, rules and guidance that touch AI used in clinical, coverage and administrative work, with a link to each primary source. Integral Healthcare Solutions (IHS), founded in 2002 by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC, keeps this one. It is a point-in-time summary of the sources opened on October 6, 2026. Rules change after publication, so read the current text and ask your counsel which sources apply to your organization. IHS is not a law firm.
Which federal sources bear on healthcare AI?
Five federal documents and one voluntary framework are listed below. Each row summarizes the source in IHS's words, with a link to the Federal Register, eCFR or agency page opened on October 6, 2026. Which of them applies to a given organization is for your counsel to confirm.
| Source | What it covers |
|---|---|
| ONC HTI-1 final rule, 89 FR 1192, January 9, 2024 (effective February 8, 2024) | Updates certification criteria for decision support, patient demographics and case reporting in the ONC Health IT Certification Program and advances the USCDI standard to Version 3. It is aimed at health IT developers in that program. |
| HHS Section 1557 final rule, 89 FR 37522, May 6, 2024 (effective July 5, 2024) | Includes 45 CFR 92.210 on patient care decision support tools. Paragraph (a) bars a covered entity from discriminating on the basis of race, color, national origin, sex, age or disability through those tools. Paragraphs (b) and (c) set a duty to make "reasonable efforts" to identify uses of tools that use input variables measuring those characteristics and to mitigate the risk of discrimination. |
| CMS interoperability and prior authorization final rule, 89 FR 8758, February 8, 2024 (effective April 8, 2024) | Requires impacted payers, including Medicare Advantage organizations, Medicaid and CHIP programs and qualified health plan issuers on the federally-facilitated exchanges, to improve electronic exchange of health care data and streamline prior authorization. The abstract does not mention AI, so how the rule bears on an AI-assisted prior authorization workflow is a question for your counsel. |
| FDA draft guidance on AI-enabled device software functions, 90 FR 1154, January 7, 2025 | A draft guidance on lifecycle management and marketing submission recommendations for AI-enabled device software functions. A draft is not final, so check FDA for its current status. |
| FDA final guidance on Predetermined Change Control Plans, 89 FR 96259, December 4, 2024 | Gives FDA's recommendations for what a PCCP should contain in a marketing submission for a device with AI-enabled software functions: the planned modifications, the methodology to develop, validate and implement them and an assessment of their impact. |
| NIST AI Risk Management Framework 1.0, released January 26, 2023 | A framework intended for voluntary use, organized around four functions named Govern, Map, Measure and Manage in the framework document (NIST AI 100-1, opened October 6, 2026). NIST's page says AI RMF 1.0 is being revised as part of the White House AI Action Plan. |
FDA user fees for device submissions
FDA publishes its device user fees on its MDUFA fees page (page opened October 6, 2026). The page lists fees for October 1, 2026 through September 30, 2027, and they apply to device applications and establishment registration, not to governance consulting. Read the amounts there.
Federal sources this pass did not open
This pass did not reopen the HIPAA Privacy, Security and Breach Notification Rules, CMS risk adjustment audit programs or FTC materials, so this tracker does not summarize them. Their absence is a limit of this page, not a statement that they do not bear on AI.
Which state AI laws affect healthcare organizations?
State AI laws differ by jurisdiction, and your counsel decides which ones apply to your footprint. Two state laws are listed because their legislature pages were opened on October 6, 2026. Other states are not listed because IHS did not open their pages this pass.
| State law | What the source shows |
|---|---|
| Colorado SB24-205, Consumer Protections for Artificial Intelligence | The bill page describes duties for developers and deployers of high-risk AI systems that make consequential decisions, including risk management policies, impact assessments and notice to consumers. Confirm the current effective date and any later amendments in the statute with counsel. |
| Texas SB 1188, relating to electronic health record requirements | Signed June 20, 2025, with an effective date of September 1, 2025. The enrolled text (page opened October 6, 2026) permits a practitioner to use artificial intelligence for diagnostic purposes if, among other conditions, the practitioner reviews all records created with artificial intelligence "in a manner that is consistent with medical records standards" (Section 183.005(a)(3)), and requires a practitioner who does so to disclose that use to patients (Section 183.005(b)) and requires electronic health records to be physically maintained in the United States or a territory, with a January 1, 2026 date stated in the bill (Section 183.002(a)). Counsel confirms who counts as a practitioner under the bill. |
Note: IHS builds a state-by-state table for your footprint as part of an AI governance engagement, and your counsel confirms each entry. Schedule a Free Discovery Session to scope that table.
When does the EU AI Act apply to healthcare AI?
The EU AI Act entered into force on August 1, 2024 and applies in stages, with Article 113, as amended by Regulation (EU) 2026/1744, listing August 2, 2026 as the general application date, December 2, 2027 for Annex III high-risk systems and August 2, 2028 for Annex I high-risk systems. Which stage and which obligations reach a given product is a question for EU-qualified counsel.
Article 2(1) applies the regulation to providers placing AI systems on the EU market whether they are established in the EU or in a third country, and to third-country providers and deployers whose system output is used in the Union (Article 2, page opened October 6, 2026). A U.S. company can therefore fall within scope, depending on what it sells and where the output is used.
| Date | What applies |
|---|---|
| August 1, 2024 | Entry into force. The timeline page says none of the Act's requirements applied at that point. |
| February 2, 2025 | Prohibitions and AI literacy requirements begin to apply, except Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b), which Article 113(a) as amended places at December 2, 2026. |
| August 2, 2025 | Obligations for general-purpose AI models begin to apply. |
| August 2, 2026 | General application date under Article 113. |
| December 2, 2027 | Chapter III requirements apply to high-risk systems under Annex III. |
| August 2, 2028 | Chapter III requirements apply to high-risk systems under Annex I. |
Sources: the implementation timeline and Article 113, both opened October 6, 2026. The Annex III and Annex I dates in Article 113 come from Regulation (EU) 2026/1744 of July 8, 2026, published in the Official Journal on July 24, 2026, which replaced Article 113 point (c) (Regulation (EU) 2026/1744, text opened October 6, 2026 through the Publications Office). Article 99 (page opened October 6, 2026) sets administrative fines of up to EUR 35 000 000 or 7 % of worldwide annual turnover for prohibited practices, and up to EUR 15 000 000 or 3 % for non-compliance with the operator and notified-body obligations it lists in paragraph 4.
What dates are coming up?
Only dates stated on a source opened October 6, 2026 appear here. Read the source for current status.
| Date | Item | Source |
|---|---|---|
| December 2, 2026 | EU AI Act Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b), as moved by Article 113(a) | Article 113 |
| December 2, 2027 | EU AI Act Annex III high-risk systems | Article 113 |
| August 2, 2028 | EU AI Act Annex I high-risk systems | Article 113 |
| Not dated | Revision of NIST AI RMF 1.0 | NIST |
What this is not
This tracker is not legal advice, and IHS is not a law firm. IHS gives no opinion on whether a law applies to your organization.
IHS is not a regulator, certifier or accrediting body, and it does not certify that an organization is compliant. IHS drafts the governance documents, and your organization's named contact submits to any agency.
The tracker is a point-in-time summary of the sources opened on October 6, 2026. It does not report changes made after those sources were published, and it does not guarantee any audit, certification or enforcement outcome.
Frequently asked questions
Which federal rules apply to healthcare AI?
No single answer fits every organization, because the rule depends on what the organization does. The table above lists the sources IHS opened, including the ONC HTI-1 rule for certified health IT developers, the Section 1557 rule on patient care decision support tools and FDA guidance on AI-enabled device software. Your counsel confirms which apply to you.
What did the ONC HTI-1 final rule change?
The final rule, 89 FR 1192, updates certification criteria for decision support, patient demographics and case reporting and advances USCDI to Version 3. It applies to health IT developers in the ONC Health IT Certification Program (Federal Register, page opened October 6, 2026). Ask counsel whether your products are covered.
What does Section 1557 say about patient care decision support tools?
45 CFR 92.210 bars a covered entity from discriminating on the basis of race, color, national origin, sex, age or disability through those tools. It also sets a duty to make reasonable efforts to identify tools that use input variables measuring those characteristics and to mitigate the risk of discrimination (eCFR, page opened October 6, 2026). Counsel confirms whether your organization is a covered entity.
Is the NIST AI Risk Management Framework required?
No, NIST describes AI RMF 1.0 as intended for voluntary use. NIST's page says the framework is being revised as part of the White House AI Action Plan (page opened October 6, 2026), so check it for the current version.
What does Texas SB 1188 require when a practitioner uses AI?
The enrolled bill permits a practitioner to use artificial intelligence for diagnostic purposes if, among other conditions, the practitioner reviews the records created with it, and it requires disclosure of that use to patients (bill text, page opened October 6, 2026). It also requires electronic health records to be physically maintained in the United States or a territory. Counsel confirms who counts as a practitioner.
When do the EU AI Act high-risk rules apply?
As amended by Regulation (EU) 2026/1744, Article 113 lists December 2, 2027 for Annex III high-risk systems and August 2, 2028 for Annex I high-risk systems (Article 113, page opened October 6, 2026). EU-qualified counsel can tell you where your product falls.
How much does AI governance consulting cost?
The cost has three parts: IHS's consulting fee, your internal time from compliance, clinical, legal and IT staff, and any fees charged by outside bodies, which they set. FDA's device user fees are published on its MDUFA fees page and apply to device submissions, not to governance consulting. IHS sets a fixed fee for each engagement after a free discovery session, because scope, number of sites and gap severity change the work.
Who is this tracker not for?
An organization that wants a legal opinion on whether a law applies, an FDA submission written for it or a certified algorithm audit needs its counsel, regulatory engineers or a qualified auditor. IHS drafts governance documents for your compliance, clinical and IT leaders to review and approve.
Related resources
- AI governance service overview: what IHS drafts, the engagement phases and who it serves.
- Healthcare AI governance FAQ: buyer questions on the sources, documents and cost.
Ready to review your AI governance against these sources?
IHS maps your organization's AI tools against the sources your counsel confirms apply and drafts the charter, inventory, risk records and policies for your leaders to approve. A free discovery session covers where you stand and what it would take to close the gaps.