How medical AI regulation will move: the Utah\u2013China\u2013ARPA-H signal.

In January 2026, Utah's HB 249 became the first US statute to move AI from “clinical decision support” to “supervised autonomous prescriber.” The bill authorizes AI systems to prescribe approximately 190 chronic medications - statins, antihypertensives, maintenance inhalers, thyroid replacement, oral contraceptives - under a framework where a licensed physician retains supervisory accountability but does not approve each prescription individually.

The scope is deliberately narrow. The formulary excludes controlled substances, chemotherapy agents, and anything requiring titration against labs not yet standardized for automated ingestion. The AI must operate within an approved clinical protocol filed with the Utah Division of Professional Licensing. The supervising physician must review a statistical sample of AI-generated prescriptions monthly and is required to intervene within 24 hours of any flagged adverse event.

What makes HB 249 structurally significant is not the formulary size but the legal category it creates. Before Utah, every US jurisdiction treated AI as a tool in the hands of a practitioner. The practitioner made the decision; the AI informed it. Utah created a third category: AI as a supervised practitioner-equivalent, where the system makes the prescribing decision and the human provides oversight after the fact. This is not a semantic distinction. It rewires liability, insurance, and scope-of-practice law simultaneously.

The bill passed 54-17 in the House. The margin was not close. Utah's legislature was responding to a specific pressure: rural counties where the nearest prescribing clinician for chronic disease management is 90+ minutes away. The AI prescribing authorization is, at its core, a workforce patch - but the legal architecture it established will outlast the immediate crisis.

While Utah moved one state at a time, China moved an entire national healthcare system. By late 2025, the Ministry of Industry and Information Technology had deployed autonomous clinical AI across more than 260 hospitals in 93.5% of China's provinces. These are not pilot programs. They are operational systems handling triage, preliminary diagnosis, and treatment recommendations in real clinical workflows.

The deployment model is top-down and state-backed. Provincial health authorities select hospitals, the MIIT provides technical standards, and the AI systems are integrated through a national interoperability layer that most Western health systems lack. The liability framework is functionally nonexistent in the Western sense - the state absorbs the risk implicitly, and malpractice litigation as Americans understand it does not apply.

This matters for two reasons. First, China is generating clinical outcome data on autonomous AI at a scale no other country can match. When regulators in Washington, Brussels, or Geneva ask “does autonomous clinical AI work in practice,” the largest dataset will come from a jurisdiction with fundamentally different incentive structures around safety reporting. Second, the pace sets a geopolitical floor. Any country that takes 10 years to authorize what China deployed in 18 months will face workforce arbitrage - patients in underserved regions will seek AI-assisted care through cross-border telemedicine platforms that route through permissive jurisdictions.

The Chinese model is not replicable in the US or EU. But it is already shaping the timeline those jurisdictions are working against.

ARPA-H - the Advanced Research Projects Agency for Health, stood up in 2022 - is the first US federal entity to fund agentic AI in clinical settings. Its PARADIGM program and successor initiatives are backing systems designed to operate with minimal human intervention: autonomous monitoring, autonomous escalation, autonomous adjustment of treatment parameters within pre-approved protocols.

The significance is jurisdictional. FDA regulates devices and drugs. CMS regulates reimbursement. Neither has a clean mandate for autonomous AI agents that monitor, decide, and act across a patient's care trajectory. ARPA-H, by funding these systems before the regulatory framework exists, is creating facts on the ground. Federal dollars flowing into agentic clinical AI make it politically expensive to later classify these systems as impermissible.

The funded projects share a common architecture: a foundation model with clinical fine-tuning, a decision layer that maps model outputs to clinical actions, and a deployment harness that enforces guardrails, logs decisions, and maintains audit trails. That last component - the harness - is consistently the weakest link in proposals. Model labs know how to build models. Hospitals know how to treat patients. The connective tissue between the two is where most projects underspecify, and where ARPA-H reviewers are pushing hardest for rigor.

ARPA-H is not waiting for FDA to figure out the classification problem. It is funding the thing and letting the classification catch up. This is the DARPA playbook: build the capability, then dare the bureaucracy to say no.

The FDA has cleared over 950 AI/ML-enabled medical devices through its Software as a Medical Device (SaMD) pathway. Every single one is classified as clinical decision support - a tool that assists a clinician who retains final authority. None are authorized to act autonomously.

The SaMD framework was designed for static algorithms: a model is trained, validated, locked, submitted, and cleared. The FDA's predetermined change control plan (PCCP) introduced in 2023 allows some post-market model updates without resubmission, but the underlying assumption remains that the software is a tool, not an agent. An autonomous clinical AI - one that monitors, decides, and acts - breaks this assumption at every level.

The regulatory gap is concrete. A locked diagnostic model that flags a chest X-ray for pneumonia and presents the flag to a radiologist fits SaMD. A system that reads the X-ray, orders a sputum culture, adjusts antibiotic dosing based on renal function, and schedules a follow-up - all without a human in the loop - does not fit any existing FDA category. It is not a device. It is not a drug. It is not a biological product. It is practicing medicine, and the FDA does not regulate the practice of medicine. States do.

This jurisdictional mismatch is not hypothetical. It is the core tension that Utah exploited with HB 249: the state authorized the practice of AI-assisted medicine under state medical board authority, sidestepping the question of whether the AI itself needs FDA device clearance. The FDA has not challenged this approach. Whether that silence is strategic patience or jurisdictional uncertainty, the result is the same: a gap that will widen as more states move.

The practice of medicine is regulated by states. Medical devices are regulated federally. When an AI system prescribes a medication under state authority but has not been cleared by the FDA as an autonomous device, both regulatory regimes are arguably satisfied and arguably violated. The AI is practicing medicine (state jurisdiction, state authorization obtained). The AI is also a software system making clinical decisions (federal jurisdiction, no autonomous-device clearance exists).

This is not a novel constitutional structure. It mirrors the cannabis situation: state-legal, federally-prohibited, with the federal government choosing not to enforce. But clinical AI is higher-stakes. A cannabis dispensary operating under state law does not create product liability exposure for a federal agency. An autonomous AI prescriber operating under state law while lacking federal device clearance creates a liability vacuum that no existing doctrine fills cleanly.

The Federation of State Medical Boards (FSMB) issued guidance in late 2025 acknowledging this tension without resolving it. Their position: AI systems operating under state medical board authority should be held to the same standard of care as human practitioners in the same role. This sounds reasonable until you try to operationalize it. What is the standard of care for an AI that processes 400 patients per hour against a human who sees 20? The AI will be statistically safer in aggregate but will make errors no human would make - and miss errors no human would miss.

The resolution will not come from legal theory. It will come from a specific adverse event - an AI prescribing error that harms a patient in a state that authorized autonomous prescribing - followed by litigation that forces a court to decide which regulatory framework controls. That case has not been filed yet. When it is, the infrastructure that the AI operated on - the deployment harness, the audit trail, the clinical guardrails - will be the evidentiary foundation for every party's defense. The harness is not optional. It is the legal record.

The trajectory is legible. Five to ten US states will follow Utah's model by 2028, driven by the same workforce arithmetic: rural provider shortages, aging populations, and Medicaid budgets that cannot absorb the cost of human-only care delivery. States with existing telemedicine-friendly frameworks - Arizona, Texas, Mississippi, Montana - will move first. States with strong medical-society lobbies - California, New York, Massachusetts - will move last.

The EU AI Act takes the opposite approach. Article 6 and Annex III classify clinical AI as high-risk, requiring conformity assessments, post-market surveillance, and mandatory human oversight. The EU is not blocking autonomous clinical AI - it is demanding a compliance infrastructure that most developers cannot yet provide. The practical effect is a 2-3 year delay relative to permissive US states, but with a more predictable legal environment once compliance is achieved.

China will continue expanding nationally. The 260+ hospital footprint will reach 1,000+ by 2028 under current MIIT directives. The data generated will be partially accessible to international researchers through bilateral agreements, but the liability and safety reporting frameworks will remain opaque by Western standards.

A federal US framework will emerge between 2028 and 2030. It will not be a new FDA pathway - it will be a joint framework between FDA, CMS, and ONC that creates a federal floor for autonomous clinical AI while preserving state authority over practice-of-medicine questions. The pressure forcing this is not philosophical; it is fiscal. CMS cannot reimburse AI-delivered care at scale without a federal classification, and the budget math demands AI-delivered care at scale.

The deployment layer - the harness - has to be ready before the regulation arrives. Building it after the rules are written means building to spec. Building it before means the spec gets written around the infrastructure that already works. That is the deployment gap, and it is why the race is not to build the best model but to build the best road for the model to drive on.

Read next: Who is liable when AI practices medicine? · The mountain top · FAQ