The billing code came first; the safety rules are still in committee

On July 2, 2026 CMS released its CY2027 Hospital Outpatient Prospective Payment System (OPPS/ASC) proposed rule, replacing the loose "Software as a Service" label with Software as a Medical Service (SaMS) — "software-based technologies that support clinical decision-making through algorithmic analysis" — explicitly distinguished from prescription digital therapeutics and remote monitoring. Per Wilson Sonsini's breakdown, the rule designates 36 HCPCS codes as SaMS, spanning AI retinal image analysis, CT-derived fractional flow reserve, quantitative brain MRI, algorithmic ECG risk assessment and fracture-risk modelling. It creates a new O1 status indicator — functionally identical to today's S indicator, guaranteeing separate payment without multiple-procedure discounting — while asking whether a T indicator would be better. As a bridge, 21 existing SaMS codes move into New Technology APCs, and 10 codes for algorithmic analysis of existing lab data (genomic reanalysis, AI digital pathology review) migrate off the Clinical Laboratory Fee Schedule to contractor pricing. Second Opinion notes CMS calls this "an interim step towards a more comprehensive payment methodology."

For a decade the structural barrier to commercialising clinical AI was never clearance — it was that nobody knew what to bill it as. Once SaMS exists as a named OPPS category with its own status indicator, AI software stops being an IT cost hospitals absorb and becomes a separately billable service. That matters more for scale than any single 510(k). The caveat: CMS has handed out an identity without a price theory — it says a permanent methodology may be "aligned with clinical outcomes" without saying how. And moving lab-analysis AI off the CLFS quietly changes beneficiary cost-sharing, a point the proposal underplays. Comments close August 31; the companion CY2027 Physician Fee Schedule proposal dropped July 14 and closes September 14.

The most directly affected are imaging and lab AI vendors that already hold CPT/HCPCS codes — FFR-CT vendor HeartFlow, AI retinal screening, AI digital pathology and genomic reanalysis providers. On the advocacy side, AI Healthcare Coalition executive director Cybil Roehrenbeck asks publicly: "How do we distinguish between services that have already been reimbursed and paid for multiple payment cycles versus some that are newer?"

The Digital Omnibus, Regulation (EU) 2026/1744, entered into force on July 27, 2026 — six days before the original high-risk deadline. Per SIG's tracker, what did take effect on August 2 was Article 50 transparency (users must be told when they are interacting with an AI system) and the AI Office's enforcement and fining powers over general-purpose AI providers. The high-risk tier slipped wholesale: Annex III stand-alone high-risk AI to December 2, 2027, and Annex I high-risk AI embedded in regulated products — medical devices, machinery, vehicles — to August 2, 2028. Gibson Dunn notes these are now fixed, unconditional dates rather than contingent on harmonised standards, and that the Commission gains power to disapply specific AI Act requirements where sectoral law already imposes equivalent obligations — precisely the MDR/AI Act double-work complaint medtech has been making for years.

Plenty of people read August 2 as "the AI Act goes live," then woke up on August 3 to find nothing had happened. The reality is subtler: for device manufacturers the heaviest obligations moved out two years, but the disclosure duty is live now. Patient-education chatbots, AI note-summarisation tools and AI triage front-doors operating toward natural persons in the EU must disclose today — and these often are not MDR devices at all, sitting instead in exactly the grey zone people forget to audit. Gibson Dunn also flags a four-month grace period for watermarking existing systems. Deferral is not cancellation: August 2028 comes with no renegotiation hook, and notified-body capacity was not fixed by moving the date.

Affected: every vendor shipping AI-enabled devices into the EU (Taiwanese exporters included), plus every hospital and insurer deploying patient-facing conversational AI. On the regulator side, the Commission's AI Office and national market surveillance authorities. SIG's AI Act summary is being kept current.

Citeline Medtech Insight reported on August 14 that FDA's Center for Devices and Radiological Health will convene a September public meeting on "how regulatory science must evolve to keep pace with advances in medical technology," with an agenda covering three areas: AI and digital health technologies, emerging medtech, and new approaches to evidence generation and testing. Per the FDA event page, the meeting — "Regulatory Science Innovations Catalyzing Medical Device Development," co-hosted with the Medical Device Innovation Consortium — runs September 25, 2026, 8:30am–4:30pm ET at Building 31 on the White Oak campus in Silver Spring, Maryland, with a listen-only virtual option. In-person registration closes September 10; virtual closes September 20 at 4:00pm ET.

"Regulatory science gaps" sounds like bureaucratic filler, but it names a concrete problem: when a model keeps learning, outputs natural language, and drifts in performance by deployment site, what evidence should FDA use to call it safe? The current toolkit — bench testing, retrospective datasets, predetermined change control plans — was designed for static algorithms. That CDRH is willing to hold this in public is an admission that existing pathways strain under generative AI. Worth noting: FDA's own AI-SaMD landing page still carries a March 2025 currency date, with the most recent formal items being the December 2024 final PCCP guidance and the January 6, 2025 draft on AI-enabled device software function lifecycle management. The gap between the published doctrine and the live questions is exactly what the meeting is for.

STAT health tech correspondent Mario Aguilar reported on August 5 that FDA, CMS and HHS officials held a closed-door "clinical AI demo day" at FDA's White Oak headquarters on July 8, 2026, letting federal officials try AI-doctor products first-hand. The ten companies present: Anthropic, Counsel Health, Curai, K Health, Microsoft AI, Amazon One Medical, Doctronic, Ellipsis Health, Hippocratic AI and Welldoc. The meetings, STAT notes, had not been publicly announced; attendees included companies backed by Andreessen Horowitz and Khosla Ventures, and the discussion touched on both health-AI regulation and Medicare reimbursement.

The weight of this story is not that government met industry — that is routine — but that the same officials hold both the clearance gate and the payment gate, and the meeting was unannounced with no public record. While CMS is taking comment on an entirely new payment category (story 1), getting a face-to-face demo round outside the formal comment window is a real procedural asymmetry. The contrast is clean: CDRH's September 25 session is public, has a registration link, and will post materials (story 3). Whether health-AI regulation over the next few years gets shaped around a handful of companies' product forms depends a great deal on the ratio between those two kinds of meeting.

The attendee list spans three types: foundation-model providers (Anthropic, Microsoft AI), patient-facing AI care agents (Hippocratic AI, K Health, Curai, Counsel Health, Doctronic), and incumbent digital-health/chronic-care players (Welldoc, Ellipsis Health, Amazon One Medical).

Per the Transparency Coalition's count, US states have enacted more than a dozen health-AI laws in 2026, clustered on two fronts. Prior authorisation and claims (7 states): Alabama SB 63 (signed Apr 17) requires insurers to disclose AI use, bases AI determinations on the individual patient's history, and puts denials through physician review; Washington SB 5395 (Mar 23) states that "only a licensed physician or licensed health professional may deny"; Colorado HB 1139 (Jun 2), Iowa HF 2635 (May 13), Utah SB 319 (Mar 19), Georgia (May 5) and Illinois SB 3114 (awaiting signature, barring automated downcoding without human review) are of a piece. AI therapy (5 states): Colorado HB 1195 (Jun 3), Maine LD 2082 (Apr 13), Rhode Island H 7349 and S 2197 (Jun 22), Tennessee SB 1580 (Apr 1) and Vermont H 816 (Jun 17) all bar unlicensed AI-delivered therapy or AI holding itself out as a qualified mental-health professional. Holland & Knight's May review organises the same wave by effective date: Alabama SB 63 effective Oct 1, 2026; Indiana HB 1271 Jul 1, 2026; Maryland HB 1563 Jun 1, 2026; Utah SB 319 and Georgia Jan 1, 2027 — and adds Idaho, Nebraska, Oregon SB 1546 and Delaware HB 191 under "AI companions/chatbots."

This is the most underrated line in health-AI regulation this year. There is no federal law barring insurers from denying with AI, and no federal red line on AI therapy; every concrete, enforceable obligation here comes from state legislatures. Holland & Knight's unifying principle is crisp: "AI may be used to assist and streamline insurance operations, but a health insurer cannot rely upon it as the sole basis for denying care." For multi-state payers and digital-health vendors, that means the compliance floor is set by the strictest state; and for startups building AI companions or mental-health products, five state bans are already enough to rewrite positioning and marketing copy.

On January 6, 2026 FDA issued two draft guidances the same day: an updated Clinical Decision Support (CDS) software draft and an updated General Wellness draft. Per McDermott Will & Emery's analysis, the CDS draft makes two substantive moves. First, where non-device software previously had to offer a list of treatment options, the update extends enforcement discretion to single-output software where only one clinically appropriate directive exists. Second, it removes the prior language prohibiting risk-score functions from enforcement discretion — and adds a risk-score function to its list of examples that would receive it. The General Wellness draft broadens the non-device treatment of low-risk wearables: products using "non-invasive sensing to estimate, infer, or output physiologic parameters" such as heart rate variability or blood glucose qualify, provided they avoid clinical claims and do not substitute for an approved device. McDermott reads both as intended "to promote more widespread usage of such products, especially AI-enabled products, and to bolster the speed at which they can be brought to market."

Risk scores are the single most-deployed form of clinical AI — sepsis alerts, readmission risk, deterioration detection are nearly all risk scores. The old "no enforcement discretion for risk scores" line effectively pulled that whole class into device regulation; deleting it moves a large body of home-grown and vendor-supplied predictive models out of premarket review. Read alongside story 3 this is striking: FDA is simultaneously admitting it does not know how to evaluate drifting models and widening the set that needs no prior evaluation. For Taiwan and other regulators that track FDA's classification logic, the final versions are worth watching closely — they move the international baseline for what counts as a device. STAT reported in April that FDA rejected a more aggressive proposal to deregulate AI devices, suggesting the agency is not of one mind on how far to go.

The CY2027 Medicare Physician Fee Schedule proposed rule was released July 14, closes for comment September 14, and mostly takes effect January 1, 2027. Per Nixon Law Group's read, the digital-health highlights: through a Request for Information, CMS asks whether AI companies should be allowed to deliver Annual Wellness Visits via affiliated physicians, and floats "technology-enabled care management" codes with potential outcome-based payment. The PFS also adopts the SaMS terminology in place of SaaS and moves ten laboratory-analysis codes off the CLFS to contractor pricing. Two new mandatory modifiers, BB and BC, will flag claims where the practitioner has a contractual relationship with a telehealth platform owner — no payment effect, but it lets CMS track platform-affiliated volume. And from January 1, 2027, clinical staff performing remote patient monitoring must be direct employees of the practice; outsourcing is prohibited.

That RFI is the most telling paragraph in the rule. It amounts to an admission that AI companies are already doing this and nobody has said out loud whether it is allowed. If CMS eventually greenlights it, an AI-first company could bill Medicare directly through affiliated physicians — which would rewrite the competitive structure of primary care. The BB/BC modifiers are classic measure-first-regulate-later: CMS wants visibility into telehealth platform concentration before deciding whether to intervene. Cutting the other way, the RPM outsourcing ban is the most immediate commercial risk in the proposal, hitting the many remote-monitoring vendors whose model depends on contracted nursing teams.

The UK's MHRA summarised AI Airlock Phase 2 on its official blog on June 9, 2026: the phase ran April 2025 to March 2026 and selected seven AI technologies from 51 applicants, covering cancer diagnostics, rare eye disease detection and obesity management support. Phase 2 targeted three regulatory problems: managing intended purpose across the lifecycle of generative AI devices, safe lifecycle management via predetermined change control plans and post-market surveillance, and strengthening performance evaluation for AI diagnostics. The Department of Health and Social Care has committed £1.2 million a year for Phase 3, 2026–2029, shifting the emphasis from experimentation to "translating insights into clear, actionable regulatory guidance."

AI Airlock is the only regulatory mechanism that treats "intended purpose drifts in generative AI devices" as a formal research question with a budget and a timetable attached. It is the same gap FDA will discuss on September 25 (story 3) — except MHRA has already run an empirical round. The 7-of-51 acceptance rate also reveals a constraint: sandbox capacity is far below demand, and unless Phase 3 raises throughput its value stays at methodology demonstration rather than actual unblocking. For Taiwanese regulators, Airlock's three problems map almost directly onto local smart-device review pain points, making it a more actionable template than FDA guidance.