While generative AI–enabled medical devices could be on a path toward delivering autonomous medical care, the legal framework has not kept pace. FDA broke its relative silence with its August 2026 discussion paper on generative AI–enabled devices. This paper offers a window into the agency’s current thinking on product design and testing necessary for authorization, but does not change or establish regulations or policies. But FDA authorization is only half the picture: as these devices increasingly take on more clinical functions, state laws on the practice of medicine, prescribing, and pharmacy become just as important.
Below we provide an overview of the key takeaways from recent FDA developments and the challenges still remaining at the state level, as of September 2026.
Key Takeaways
- FDA is considering a framework focused on function, not autonomy. Risk turns on what a device does (informing vs. driving clinical action) and the severity of harm from a wrong output, not on how independently it operates.
- FDA’s framework is evolving, but incomplete. The discussion paper floats competency-based clearance, postmarket monitoring tools, and mechanisms such as PCCPs for model drift but leaves core questions unresolved, particularly around analysis of medical signals and foundation models.
- State law has emerged as the primary barrier. Decades-old practice-of-medicine, prescribing, and pharmacy statutes were not written with AI in mind, and broad definitions of “practicing medicine” likely already capture many generative AI functions, disclaimers notwithstanding.
- A regulatory gap is opening. FDA may clear autonomous AI devices before states allow them to operate without a licensed human in the loop; absent state-level legislative action (sandboxes like Utah’s and Arizona’s are only a partial fix), FDA authorization could become just the first of several hurdles to autonomous care.
FDA: Risk-Based with Lifecycle Oversight
FDA currently applies its existing device framework to generative AI–enabled products, which framework has shown to be imperfect for this technology. FDA’s recent clearance of UpDoc, however, points to a potential workable model: FDA review focused on the locked algorithm computing dosing recommendations, considering it separate from its generative AI–powered chatbot interface.
That approach may not work for every device, especially ones that perform clinical functions autonomously and evolve over time. FDA’s discussion paper explores how to adapt existing regulatory concepts to these characteristics. Four takeaways stand out:
- Function over form. FDA discusses a possible framework under which risk would be based on what the device does, not how it does it. Accordingly, autonomy of a device does not solely determine its risk. Risk turns on whether the device informs or drives clinical action and the severity of harm from an incorrect output. The intended user (i.e., a patient or healthcare professional) and whether the device analyzes a medical signal may also shape the device’s risk-benefit profile, but the discussion paper does not discuss to what extent these factors would affect that assessment.
- New methodologies to establish reasonable assurance of safety and effectiveness. FDA discusses potential alternatives to traditional evidence that would support premarket review, including a competency-based assessment inspired by clinician credentialing. This could entail benchmarking a device’s clinical knowledge and analytical capabilities, and confirming such through real-world or clinical studies. Whether this would materially change the evidentiary bar remains to be seen.
- Postmarket monitoring remains critical. FDA identifies potential approaches for ongoing oversight including periodic benchmarking, clinician reviews of sampled output, and ongoing performance monitoring to ensure these devices continue to perform as intended.
- Rapid model changes and reliance on third-party foundation models remain unresolved. FDA discusses such mechanisms as Predetermined Change Control Plans (PCCPs) and voluntary Foundation Model MAFs as potential ways to streamline regulatory oversight and facilitate information sharing, but does not offer a comprehensive solution.
The discussion paper is a starting point, and FDA’s digital health leadership has signaled that more guidance is coming. But while this information is welcome, the harder questions are playing out at the state level.
Beyond FDA: State Medical Practice and Pharmacy Law
FDA authorization does not guarantee deployment. State law determines where a device can actually be used and, currently, states are where the toughest questions are being debated.
State practice-of-medicine laws determine who may hold a medical license, practice medicine, or dispense drugs. As generative AI increasingly becomes capable of performing these functions, state laws have emerged as the biggest barrier, with approaches differing from state to state:
- Old statutes, new technology. Most state medical practice laws were written for human providers, and in some cases it is unclear whether they capture AI at all. For example, Washington prohibits a “person” from “practic[ing] or represent[ing] himself or herself as practicing medicine without first having a valid license to do so” (RCW 18.71.021). Enacted in 1987, the law does not define “person” and predates any modern understanding of AI. A separate provision clarifies that the “ term ‘person’ may be construed to include . . . any public or private corporation or limited liability company” (RCW 1.16.080), but not all states permit the corporate practice of medicine, restricting the practice of medicine to individuals with the specified credentials.
- Broad definitions likely capture AI functions. Washington defines the practice of medicine to include “[o]ffer[ing] or undertak[ing] to diagnose, cure, advise, or prescribe for any human disease, ailment, injury, infirmity, deformity, pain or other condition, physical or mental, real or imaginary, by any means or instrumentality” (RCW 18.71.011). The more personalized an AI output becomes, the closer it comes to diagnosis or medical advice as defined by the statute. And a disclaimer does not necessarily change this.
- Prescribing and dispensing regulations add another layer of regulation. State oversight extends past licensure to ordering and dispensing medications. A device that autonomously prescribes medication may implicate state prescribing rules, while a pharmacy filling an order generated without an authorized human prescriber faces its own dispensing questions. Physician supervision, delegation, and professional responsibility requirements can add further constraints.
- No national standard. Unlike FDA authorization, state professional rules vary widely. The same autonomous functionality could be lawful in one state, require clinician oversight in another, and be barred outright in a third. Some states, such as Utah and Arizona, have launched regulatory sandboxes that temporarily ease practice-of-medicine and pharmacy requirements for controlled AI pilots, but these efforts are not a long-term fix.
Looking Ahead
A regulatory gap is becoming more apparent. FDA may eventually authorize autonomous AI devices to perform clinical functions safely and effectively, while state law may not allow those functions without a human in the loop. Closing that gap may require state legislative or regulatory action, and while sandboxes are a start they are not a permanent solution.
FDA’s discussion paper signals that FDA is searching for a way to use its regulatory paradigm to address the unique characteristics and risks of generative AI. Perhaps more importantly, the paper indicates that FDA is contemplating a future in which regulated medical devices perform clinical functions with autonomy.
The next frontier may lie outside FDA. Without corresponding evolution in state practice-of-medicine, prescribing, and pharmacy laws, FDA authorization is only the first of several regulatory gates to truly autonomous treatment.