The conventional story about healthcare artificial intelligence is that regulation slows innovation. Reduce the regulatory burden, that argument goes, and more startups can enter the market, hospitals can adopt new tools faster and clinicians can gain access to better technology.
But the emerging structure of healthcare AI suggests something more complicated. As the Food and Drug Administration (FDA) loosens some forms of front-end oversight, it is not necessarily removing regulatory costs. It is moving them.
“The deregulation, it doesn’t dissolve the concentration. It relocates the focus,” Douglas Grimm, partner and health care practice co-leader at ArentFox Schiff, told Competition Policy International (CPI), a PYMNTS company, in conversation with Doug McCormack, founder at Acumen Partners.
The FDA’s lighter approach is primarily focused on lower-risk clinical decision-support tools, rather than AI involved directly in diagnosis or treatment. Higher-acuity systems remain subject to more extensive oversight. As a result, the pressure for healthcare organizations integrating innovation technology solutions is shifting from premarket approval toward hospital governance, litigation readiness and continuous monitoring.
“The focus is on the back-end post-market surveillance, real-time monitoring, and then looking to see how the model may drift,” Grimm said. “It’s not static.”
The Cost of AI Compliance Is Becoming Continuous Across Healthcare
Healthcare AI does not behave like a conventional medical device. Performance can change as patient populations, data inputs and software configurations evolve. For hospitals, purchasing an AI tool creates an obligation to govern it throughout its life cycle. Health systems must assess not only whether a product works when acquired, but whether it continues to perform safely across different populations and clinical environments.
The FDA has sought to make adaptive AI easier to update through predetermined change control plans, or PCCPs. These plans allow manufacturers to describe certain future product modifications in advance, reducing the need to return to the agency after every update.
“The PCCP is kind of the discount to get in the door,” Grimm said.
Adoption remains limited, although Grimm noted that use increased from roughly 2% to 10% in the past year. Over time, the plans could give manufacturers more flexibility to improve products without repeatedly restarting the approval process. But the broader adoption of the PCCP’s life cycle model also transforms compliance from an episodic expense into a recurring operating cost.
“Under the surveillance model, it becomes an ongoing cost that the firms must shoulder and continue to support throughout the life cycle,” McCormack said. “That’s a cost that the bigger firms can absorb. But it’s something that’s much more difficult for smaller developers, startup companies, to take on.”
Monitoring for model drift requires engineering talent, quality-management systems and sustained access to clinical performance data. Large companies can spread those investments across multiple products and customers, but startups may need to build sophisticated monitoring capabilities before they have the revenue to support them.
Deep Pockets Are the Best Protection Against Healthcare Liability
The AI healthcare solution market becomes even less forgiving when an adaptive algorithm contributes to a poor diagnosis or treatment decision. Existing legal doctrines were developed for drugs and conventional medical devices, not software that can evolve after deployment.
Under the learned intermediary doctrine, a manufacturer may satisfy its legal obligation by warning a physician or hospital about known risks, leaving much of the resulting liability with the care provider. That framework becomes harder to defend when clinicians cannot fully understand the technology operating behind a recommendation — or reconstruct which version of an algorithm was running when a mistake occurred.
“The company that can afford to litigate an unsettled question wins,” Grimm said.
The lack of a consistent federal liability framework may compound the problem. States have introduced numerous healthcare AI bills, raising the possibility that developers will have to navigate different rules across the country. Large vendors can fund state-by-state compliance programs, but smaller firms may be forced to limit distribution or partner with established platforms.
Data Access Becomes the Real Gatekeeper
At the same time, FDA regulation may not be the most important source of concentration across healthcare. Control over healthcare data and distribution could matter more.
Epic and Oracle together account for more than half of the electronic health record market, according to McCormack. For many AI developers, the most practical route into a hospital is not an independent launch but integration into one of those platforms.
“Whoever controls access to the data also really controls who gets to compete,” McCormack said.
Conversations about clinical efficacy can quickly turn into questions about which electronic health record system a hospital uses, whether the platform will permit integration and whether the developer can access enough data to validate and improve its product. The platform increasingly becomes the market. And once a hospital invests in integrations, compliance processes, training and workflow redesign, switching becomes more difficult.
“The deeper, the more you use it, the bigger investment you make, the harder it is to shift,” Grimm said.
Watch the full CPI TechReg Talks interview with Douglas Grimm and Doug McCormack to learn why:
- Healthcare AI deregulation is shifting compliance costs, not eliminating them. Grimm explains that lighter front-end FDA oversight is moving the burden toward continuous monitoring, model-drift detection and hospital governance — recurring costs that larger vendors are better equipped to absorb.
- Liability uncertainty and fragmented state rules could turn scale into a competitive moat. Adaptive algorithms make it harder to determine what went wrong and which product version was operating, while a patchwork of state regulations favors companies with the resources to manage litigation and compliance nationwide.
- Control of healthcare data may matter more than the strength of the algorithm. McCormack argues that electronic health record platforms determine which AI applications reach hospitals, giving incumbents with data access, distribution and embedded workflows significant power over who gets to compete.
For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.
