Who writes the rules for AI that practices medicine?

On October 14, STAT reported that a 22-member workgroup convened by the Federation of State Medical Boards is developing recommendations for autonomous clinical AI. For clinicians and health systems, those recommendations could influence how states approach software that performs clinical functions with little direct physician supervision, including what evidence and accountability its use should require.

According to STAT, the workgroup includes executives from the American Medical Association, American Hospital Association, Anthropic, and Elevance Health, met privately in Washington earlier this month, and plans to open its recommendations for feedback before adoption. Who is in the room is reason enough to watch how the recommendations take shape.

What the workgroup is charged with

FSMB's May 19 announcement directly confirms the assignment: develop a report and recommendations or model guidelines for state medical boards. Particular attention goes to tools performing clinical functions with limited or no direct physician supervision.

The remit includes safety evidence, regulatory gaps, consent, documentation, and oversight responsibilities. Studying those questions does not itself authorize an AI system to diagnose, prescribe, or manage care independently.

When the recommendations arrive, read them alongside the action each state takes. Which institution adopted a recommendation, and under what authority would it have legal force?

Several institutions hold different powers

FSMB's guide to medical regulation explains that state Medical Practice Acts give boards their authority. Board structures and responsibilities vary. Boards also adopt policies and guidelines.

An advisory model could inform those policies, a rule within a board's delegated powers, or proposed legislation. Each route has its own decision-makers and legal constraints. A national association's recommendation does not automatically rewrite every state's medical-practice law.

Federal oversight adds another layer. FDA's January 2026 clinical decision support guidance distinguishes software functions excluded from the medical-device definition from functions that remain subject to device policies, including some intended for patients or caregivers. State decisions about clinical authority leave those federal product questions in place.

For readers, ask which permission is being discussed. Is the question whether a product may be marketed, or how it may be used in a particular setting? Performing a clinical function without individual review raises a further question about clinical authority and accountability.

What would justify autonomy?

What evidence would justify a specific system doing a specific job for real patients?

In a September 9 essay, Ezekiel Emanuel and Abe Baker-Butler argue that AI alone could outperform AI-assisted physicians on some medical tasks. They acknowledge inadequate licensing and liability arrangements and favor building those arrangements alongside real-world testing. Their case for a regulatory pathway leaves better care across clinical settings to be demonstrated.

AMA CEO John Whyte's counterpoint that day emphasizes patient context, values, relationships, and responsibility. He acknowledges useful automation while questioning whether success at discrete tasks establishes the ability to practice medicine.

A fair comparison needs a defined job and comparator. Are researchers measuring the quality of an answer, decisions during an encounter, or patient outcomes over time? Did the system operate independently? Who caught mistakes? Without those details, an impressive result can carry more weight in a policy argument than its design supports.

The positions have room for overlap

AMA's October 13 framework introduction describes clinical authority as something earned through evidence and maintained through performance. Under that approach, oversight can evolve as evidence, risk, and technology change.

FSMB leaders have offered a different institutional emphasis. In their August 3 signed essay, CEO Humayun Chaudhry and board chair Christy Valentine Theard favor existing professional and institutional accountability over independently licensing AI like a physician today. They distinguish licensing clinicians from authorizing or registering tools.

The essay sets out the leaders' views; the new workgroup's final consensus remains to be seen.

Either way, oversight has to be real. What information can the reviewer inspect? Can the reviewer change a decision or stop the system? A route to autonomy should specify when the system must hand a case back and who is available to receive it.

Responsibility needs an address

A proposed alternative appears in an April 29 JAMA Perspective by Alon Bergman, Robert Wachter, and Emanuel. Their framework assigns developers primary responsibility for model performance and deploying institutions responsibility for implementation, including workflow integration, monitoring, and adverse-event reporting. It also proposes supervised evaluation and continuing reassessment.

They propose shared responsibility, with different duties for developers and institutions. How an individual patient's legal claim would be allocated remains a separate question.

AMA's AI principles also call for autonomous-system developers to accept liability for directly attributable system failure or misdiagnosis. That is AMA policy. It is not law. Developer responsibility offers potential common ground even where participants disagree about supervision.

What counts as a model failure? What counts as deployment outside validated conditions? Which organization must investigate, disclose, and remedy a problem? Patients should not need to understand a software supply chain to learn whom they can contact after something goes wrong.

What to watch in the draft

FSMB's nonbinding AI policy adopted in April 2024 provides a baseline: human accountability, consent and privacy, review of AI-generated records, and tools that medical boards can audit. The next document can be judged by how clearly it addresses the circumstances created by greater autonomy.

Five questions should guide that assessment:

1. Clinical boundaries: Which clinical functions may the system perform, for which patients and in which settings? Where must its authority stop?
2. Evidence bar: What evidence supports each function, against which comparator, and does it measure patient outcomes or performance on a narrower task?
3. Escalation and hand-back: When must the system return a case to a clinician, and who is available to receive it? Can the reviewer inspect, change, or stop its decisions?
4. Named responsibility: Which developer and deploying institution must monitor performance, investigate failures, and respond when something goes wrong? Can patients identify whom to contact?
5. Post-update reassessment: How will performance be reassessed after updates? Who must notice changed evidence or failures, act on them, and make the response visible?

Public feedback needs a usable target and a clear account of how competing concerns are addressed in the final text. Readers should be able to identify the recommendation they are being asked to assess, the evidence behind it, and the alternatives considered. A broad promise of safety offers little help when two approaches assign responsibility differently. Publishing the reasoning would let clinicians, patients, and developers challenge assumptions without having to guess what happened in a meeting.

Workgroup membership matters because participants may bring different priorities to the draft. Readers should be able to trace how the recommendations would assign clinical authority and responsibility for care.

Follow @OpenRoundsAI and read the OpenRounds daily brief at openrounds.ai for more reporting on AI in health care.