FDA’s 2026 decision support guidance shifts the burden to reviewers. In early January, the agency issued revised guidance on clinical decision support software that loosens its approach. It now intends to exercise enforcement discretion for some tools that give a single recommendation, and it no longer treats time-critical support as automatically outside the safe harbor. It also dropped the 2022 guidance’s discussion of automation bias. The condition at the center is still the one Congress wrote into law in 2016, which requires that the clinician be able to independently review the basis for the software’s recommendation.
That condition was always important. Under the new guidance, it carries more weight, because it is doing more of the work that FDA oversight used to do. And it arrives alongside other federal changes that point the same way. Federal health IT officials proposed in December 2025 to remove certification requirements for decision support transparency, and CMS has not adopted rules on AI in Medicare Advantage coverage decisions.
The reviewer has become the main safeguard, in care and in coverage decisions, which FDA’s framework largely does not govern.
Key takeaways
- FDA expanded enforcement discretion. Software that offers a single, clinically appropriate recommendation may now fall under enforcement discretion if it otherwise meets the criteria for non-device decision support.
- Time-critical is no longer an automatic exclusion. The 2022 guidance excluded time-critical support. The 2026 version does not, although software that predicts time-critical events remains under oversight.
- Automation bias left the text. The 2026 guidance removed the earlier discussion of clinicians’ tendency to defer to software.
- Independent review is the hinge. The statutory requirement that clinicians be able to review the basis for a recommendation now carries most of the weight of the framework.
- Other federal guardrails are thinning. Health IT officials proposed removing decision support transparency requirements for certified health IT in December 2025, and CMS has not finalized AI rules for coverage.
- Coverage tools sit mostly outside FDA. Software for administrative functions, including benefit determinations, is excluded from the device definition, so other bodies of law govern it, from CMS rules to state statutes.
What changed in the guidance
The statute sets the frame. The 21st Century Cures Act excluded from the definition of a medical device any software that meets 4 criteria.
- It does not analyze medical images or signals.
- It displays or analyzes medical information.
- It supports or provides recommendations to a health care professional “about prevention, diagnosis, or treatment of a disease or condition.”
- It enables that professional to independently review the basis for the recommendations, so that the professional does not rely primarily on them.
Software that meets all 4 is not a device. Software that misses one may be.
FDA’s guidance interprets those criteria. According to Arnold and Porter’s summary, the 2026 version leaves the statute unchanged but revises how FDA reads the third and fourth criteria, and it was released without a prior public comment period.
| Topic | 2022 guidance | 2026 guidance |
|---|---|---|
| Single recommendation | Software giving a single output was generally treated as a device | Enforcement discretion where only one option is clinically appropriate and other criteria are met |
| Time-critical decisions | Excluded from the non-device category | No longer excluded as such, but prediction of time-critical events remains under oversight |
| Automation bias | Discussed as a reason for caution | Discussion removed |
| Basis for review | Clinician must be able to review the basis | Information should be prioritized so the most decision-relevant basis is shown first, with more available as needed |
| Examples of enforcement discretion | Narrower | Include cardiovascular risk prediction from patient data and a radiology or pathology summary with a diagnostic recommendation for clinician finalization |
Compiled from Arnold and Porter and Orrick summaries (January 2026).
What remains a device is also clear. Software that analyzes medical images or signals stays under oversight, as does software that predicts time-critical events such as a cardiovascular event within the next day. According to Orrick, the agency signaled that oversight should still be expected for opaque models and directive outputs. It said it will prioritize enforcement against AI outputs that guide clinical care without adequate human oversight or validation.
For generative AI, the guidance does not create a separate category. Its question is the same for any method, namely whether the clinician can understand and verify the logic and the data inputs behind a recommendation. Orrick read the update as extending enforcement discretion to certain generative AI features on that condition.
FDA also revised its general wellness guidance at the same time, widening the set of consumer wearables that can report physiological measures, such as blood pressure estimates, without device oversight, provided they are intended only for wellness and make no diagnostic claims.
The federal picture beyond FDA
FDA’s guidance is one of several federal developments in the past year that bear on AI used in health care decisions. Read together, they point the same way, toward fewer prescriptive federal requirements and more discretion for the organizations that use AI and the states that regulate them.
| Authority | Development | Effect on AI in decisions |
|---|---|---|
| FDA | Revised clinical decision support guidance (January 2026) | More software outside device oversight if clinicians can review the basis |
| Health IT certification | HTI-5 proposed rule (December 2025) | Would remove certification requirements for decision support transparency, including model cards |
| CMS | Contract year 2026 Medicare Advantage rule (April 2025) and 2027 rule (April 2026) | Declined to finalize AI guardrails for coverage, did not revisit them |
| HHS Office for Civil Rights | Section 1557 rule (in effect since May 2025) | Covered entities must identify and mitigate discrimination risk in decision support tools |
| States | Laws such as California SB 1120 and Texas SB 1188 | Require physician decisions in coverage or clinician review of AI output |
Compiled from the sources described in the text.
The health IT proposal matters because it would remove one of the few federal transparency requirements for decision support. According to a December 2025 summary in Legal 500, the proposed HTI-5 rule would remove certification requirements for clinical decision support algorithms, including the requirement for model cards disclosing data sources and other attributes. If finalized, electronic health record developers would no longer have to support those disclosures to keep their certification.
On coverage, CMS’s contract year 2026 rule declined to finalize proposed guardrails for artificial intelligence in Medicare Advantage, and, as we wrote earlier this month, the 2027 rule did not return to them. Existing Medicare Advantage rules still require that coverage decisions rest on the individual enrollee’s circumstances and that adverse medical necessity decisions be reviewed by appropriate clinicians.
Civil rights law runs the other way. The Section 1557 rule we described in February requires covered entities, including insurers, to make reasonable efforts to identify and mitigate the risk of discrimination from the decision support tools they use. States continue to act as well, as we noted in March. California requires that a physician or other qualified professional make medical necessity determinations when plans use AI in utilization review, and Texas requires practitioners who use AI for diagnosis or treatment recommendations to review the AI-generated records.
Why the reviewer becomes the safeguard
The fourth statutory criterion has always been the most important. It is what separates software that helps a clinician think from software that thinks for the clinician. Under the 2026 guidance, more software can rely on it, including software that gives a single answer and software used in situations with time pressure. The result is that the quality of the clinician’s review, not FDA’s premarket review, is the main protection against a wrong recommendation for a larger set of tools.
That puts weight on a condition that is easy to state and hard to meet in practice. A clinician can independently review the basis for a recommendation only when the software shows that basis, meaning the data it used and the logic or evidence connecting the data to the recommendation, in a form the clinician can check. Review also needs time and room to disagree. A tool designed to speed up decisions, used in a setting with heavy volume, can make careful review the exception rather than the rule, and a recommendation that is hard to reject will rarely be rejected.
Removing the discussion of automation bias from the guidance does not remove the phenomenon. People who work with reliable automation tend to accept its outputs, and the more reliable it usually is, the harder it becomes to catch the cases where it is wrong. A single recommendation, presented confidently, is easier to accept than a list of options. That is a reason to design review carefully, not a reason to assume it happens.
When the clinician’s review is the safeguard, it has to be designed and measured like any other safety control.
What this means for coverage decisions
Most software used in utilization management is not clinical decision support in FDA’s sense. The Cures Act also excluded from the device definition software intended for administrative support, which includes software used to determine health benefit eligibility and to analyze claims data. Tools that help a plan decide whether to cover a service generally fall on that side of the line. FDA’s guidance, loosened or not, was never the main framework for them.
That makes the other authorities more important for coverage tools, not less. A plan using AI in utilization review still answers to CMS’s requirements for individualized decisions and clinician review in Medicare Advantage. It also answers to state laws such as California’s and to the Section 1557 rule on decision support tools. The federal retreat from prescriptive rules in other areas does not change any of those obligations.
It does change the climate. With fewer federal requirements spelling out how AI must be governed, plans have more room to choose how to govern it, and more responsibility for the choice. The FDA guidance offers a useful principle for that choice, whether or not it applies legally. Software should support a reviewer who can see the basis for its recommendation and is in a position to disagree.
What good review looks like
Whether the reviewer is a physician using a diagnostic tool or a nurse reviewer using a coverage tool, the same design questions apply.
- Show the basis first. The recommendation should arrive with the specific facts and the specific rule or evidence behind it, not as a score with an explanation available on request.
- Prioritize what matters. FDA’s revised discussion of the fourth criterion is right that too much information can be as unhelpful as too little. The basis should lead with the facts that decide the case.
- Measure overrides. If reviewers almost never disagree with a tool, either the tool is nearly perfect or the reviewers are not really reviewing. Override rates by reviewer and by type of case show which.
- Audit with blind samples. Periodically, have reviewers decide a sample of cases without the recommendation and compare. The difference is a direct measure of how much the tool is shaping decisions.
- Protect time. Volume targets that leave no time for review turn a safeguard into a formality. Staffing and workload should be set with review in mind.
- Treat negative outcomes differently. For decisions that harm a patient or member if wrong, such as a denial of care, require an affirmative decision by a qualified person, not acceptance of a default.
Where Redlake stands
We build tools health plans use in utilization review, and our rules were written for exactly the problem the FDA guidance raises. A clinician makes every denial, because a machine can say yes but only a person can say no. Every recommendation shows its reasons, in the form of the criteria applied and the facts from the record that met or missed them, so the reviewer can check the basis rather than trust it. Every decision can also be reconstructed, down to what the tool recommended and what the reviewer decided.
We think the reviewer’s independence is worth measuring, not assuming. A coverage tool that reviewers always agree with is a tool whose influence nobody can see. Plans should know how often their reviewers disagree with recommendations and what happens to those cases on appeal.
The federal direction this year leaves more of these choices to the organizations that use the tools. That is a reason for plans to make the choices deliberately and be able to show them, because members will ask, and under state laws so will regulators.
What to watch in 2026
- Reaction to FDA’s guidance. Whether FDA receives and responds to comments on a guidance it issued without a prior comment period, and whether it revises the examples.
- HTI-5. Whether federal health IT officials finalize the removal of decision support transparency requirements, and what electronic health record developers do with the features they built.
- CMS and AI in coverage. Whether CMS returns to guardrails for AI in Medicare Advantage coverage decisions in the contract year 2028 proposal.
- State legislation. Whether more states adopt rules like California’s on AI in utilization review, or rules like Texas’s on clinician review of AI output.
- Enforcement. Whether FDA acts against AI tools that guide care without adequate oversight, as it signaled it would prioritize.
About this analysis
Basis. The description of FDA’s January 2026 guidances relies on law firm summaries. The wider federal picture draws on a summary of the HTI-5 proposed rule and CMS’s fact sheet for the contract year 2026 Medicare Advantage rule, along with laws discussed in earlier Rounds pieces.
Data notes. Descriptions of FDA’s guidance rely on published summaries rather than the guidance text, and the comparison table simplifies detailed discussions. The discussion of the device exclusion for administrative software summarizes the statute and is not legal advice.
Sources. Arnold and Porter (January 2026). Orrick (January 2026). Legal 500 (December 2025). CMS, contract year 2026 Medicare Advantage final rule fact sheet (April 2025).
Frequently asked questions
What did FDA change in its 2026 clinical decision support guidance?
It expanded enforcement discretion to some software that provides a single, clinically appropriate recommendation, and it stopped treating time-critical support as automatically excluded. It also removed its discussion of automation bias.
Does FDA’s guidance apply to utilization management software?
Generally not. The Cures Act excludes from the device definition software intended for administrative support, including determining benefit eligibility and analyzing claims data. Coverage tools are governed mainly by CMS rules and state laws.
What is the independent review criterion?
It is the fourth statutory condition for non-device decision support. The software must enable a health care professional to independently review the basis for its recommendations, so that the professional does not rely primarily on the software to make a diagnosis or treatment decision.
Did the federal government remove AI transparency requirements for health IT?
The HTI-5 rule proposed in December 2025 would remove certification requirements for clinical decision support algorithms, including model card disclosures. It had not been finalized as of April 2026.