A plain-English map of healthcare AI rules for US and UK businesses, October 2026

Neither the US nor the UK has a single healthcare AI law. In the US you work with existing federal rules (HIPAA, FCC, FDA, CMS, FTC) plus a growing set of state laws. In the UK you work with UK GDPR as amended in 2025, NHS assurance standards, MHRA device rules and sector regulators. Several headline items are guidance, drafts or policy direction rather than law, so the status label matters more than the headline.

Status below is as of early October 2026. In force means binding now. Guidance explains existing law or sets expectations. Draft or policy direction can still change. This is a plain-English map, not legal advice, so check with qualified counsel before relying on any item for a decision.

Which US federal rules matter most?

• HIPAA Privacy and Security Rules (in force). They apply to AI uses of PHI today: establish a permission for each use, run a Security Rule risk analysis and sign a business associate agreement with vendors that handle PHI. The January 2025 Security Rule overhaul proposal is not final. The federal agenda lists it as a long-term action with a July 2027 target, which is a target, not a deadline.
• FCC ruling on AI voices (8 February 2024, in force). AI-generated voices are artificial voices under the TCPA, so covered outbound calls need prior consent.
• CMS-0057-F (final rule). Payer decision timeframes and denial reasons apply generally from 1 January 2026, and the required APIs generally from 1 January 2027.
• CMS WISeR model (1 January 2026 to 31 December 2031). AI and machine learning alongside clinician review for selected Original Medicare services in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington. It is not a nationwide rule.
• FDA clinical decision support guidance (final, 6 January 2026, reissued 29 January 2026). Test each software function against the statutory criteria, because patient-facing functions can still be devices. Digital health companies should run the test function by function.
• FDA AI-enabled device lifecycle guidance (draft, 7 January 2025). It is still a draft, not for implementation. The PCCP guidance is final (18 August 2025), and a generative-AI discussion paper (19 August 2026, comments requested by 19 October 2026) is neither guidance nor a policy change.
• FTC Health Breach Notification Rule (amended rule in force since 29 July 2024). It reaches many non-HIPAA health apps. The FTC withdrew a 2021 policy statement on 9 September 2026, but the rule itself stands.

Which US state laws should you know?

• California AB 3030 (in force 1 January 2025). Clinics and physician offices must identify generative-AI-produced patient clinical communications and say how to reach a human, unless a licensed provider reviews them.
• California SB 1120 (in force 1 January 2025). In utilization review, AI cannot itself deny, delay or modify medically necessary services. A licensed professional decides.
• Texas HB 149, TRAIGA (1 January 2026). Disclose AI use in relation to a healthcare service no later than the first date of service.
• Texas SB 1188 (storage rules apply from 1 January 2026). Covered electronic health records must be kept in the US or a US territory, and AI-assisted diagnostic use must be reviewed and disclosed.
• Mental health AI laws. Illinois (1 August 2025) and Nevada (1 July 2025) restrict AI from delivering therapy or professional mental health care directly. Colorado HB 26-1195 (12 August 2026) sets conditions for AI in psychotherapy, and Utah HB 452 (7 May 2025) regulates mental health chatbots. Administrative support stays allowed with safeguards, and mental health providers face the most state-specific rules.
• Colorado SB 26-189 (law since 14 May 2026). It repealed and replaced SB 24-205 before that act's postponed 30 June 2026 start. Main duties for automated decision-making technology in consequential decisions, including healthcare and insurance, begin 1 January 2027.

Which UK rules and expectations apply?

• UK GDPR, Data Protection Act 2018 and the Data (Use and Access) Act 2025 (in force). Royal Assent was 19 June 2025 and most data protection changes commenced 5 February 2026. UK GDPR was amended, not replaced. Health data still needs a lawful basis and an Article 9 condition, and the Act is not an unrestricted route for solely automated decisions on health data.
• ICO automated decision-making guidance (draft). Published for consultation on 31 March 2026, with a final update listed for winter 2026. It is not law.
• NHS England ambient scribing guidance (guidance). First issued 27 April 2025 and updated through 29 July 2026. A joint MHRA and NHS clarification of 29 July 2026 says scribes limited to clinician-reviewed transcription, summaries or draft letters may fall outside device regulation.
• NHS DTAC, DSPT, DCB0129 and DCB0160 (existing standards). These are assurance requirements for hospitals and NHS trusts and their suppliers, not new AI laws. The DSPT deadline for 2025/26 was 30 June 2026.
• CQC (existing regulation). CQC does not approve individual AI products. It expects human oversight, patient information, staff training, risk management and data protection under existing care regulations. Draft sector frameworks from March 2026 are still draft.
• PECR and ASA/CAP rule 12.12 (in force). Marketing email and text generally need consent, and prescription-only medicines cannot be advertised to the public, whether a person or an AI wrote the copy.
• National Commission into the Regulation of AI in Healthcare (policy direction). Its 44 recommendations were published on 10 September 2026 and accepted by the government on 6 October 2026, but they are not enacted requirements. MHRA plans draft guidance on changes to adaptive AI devices by December 2026 and a wider roadmap by spring 2027. AI Airlock Phase 3 applications opened on 6 October 2026.

One caution applies on both sides of the Atlantic. A device determination from the FDA or MHRA, a listing on an NHS supplier registry and compliance with privacy law answer different questions. Passing one does not settle the others.

What should an operator do with this map?

Use it to sort, not to panic. Most obligations come from existing rules applied to AI, and several of the loudest headlines are not law yet. Start here:

1. Inventory every AI use, including tools staff adopted themselves, and note the data each one touches.
2. For each, note the jurisdiction and whether it affects patients, payers, marketing or a regulated product.
3. Classify any software with a clinical function by intended use before you buy or build.
4. Record each rule's status and date, and set a review reminder for anything still draft or proposed.
5. Name an owner. AI governance works when one person can answer which AI you use, on what data and under whose review.