Table 1.

A practical integration and classification for distinguishing categories of medical AI by governance needs

Category of medical AI	Representative examples	Typical regulatory status	Typical clinical risk	Primary user group	Main governance body or mechanism	Minimum evidence requirement before deployment	Priority post-deployment monitoring needs	Main unresolved governance gap
FDA-regulated diagnostic or therapeutic decision software	AI-enabled image interpretation, ECG or arrhythmia detection, software that directly informs diagnosis or treatment selection	Often, within FDA device or software-as-a-medical-device pathways, in Europe often overlaps with AI Act high-risk obligations plus MDR/IVDR requirements	Moderate to high, because outputs can directly affect diagnosis, treatment, or escalation decisions	Clinicians	FDA, manufacturer quality systems, and local health system implementation oversight	Analytic validity, clinical validity, external validation in intended-use populations, subgroup performance, human factors, documentation of intended use and update pathways	Performance drift, subgroup degradation, adverse events, override patterns, site-specific failures, effects of model or software updates	How to manage adaptive updates, local generalizability, and real-world performance after deployment
Workflow-embedded clinician-facing AI	Ambient documentation, note drafting, inbox summarization and chart review assistance	Often outside classic FDA device regulation, when framed as administrative or documentation support, governed mainly through health-system policy, vendor contracts, privacy and IT oversight	Low to moderate direct risk but potentially substantial indirect risk, because errors may propagate into records, communication, orders, or follow-up	Clinicians and clinical staff	Health systems, EHR governance, privacy/compliance offices, quality and safety programs	Local pilot testing, usability assessment, documentation fidelity, error and omission review, workflow impact evaluation	Hallucination or omission rates, correction frequency, downstream documentation errors, privacy incidents, clinician overreliance, workflow disruption	Clinically meaningful effects despite sitting outside traditional device pathways
Triage, risk-prediction, and resource-allocation AI inside care delivery	ED triage tools, risk scores used for escalation or referral, care-management prioritization, discharge or follow-up prioritization	Mixed status; some may be regulated, but many operate mainly under institutional oversight, civil-rights obligations, payer rules, and quality governance	Moderate to high, because tools can alter prioritization, access, escalation, and resource distribution	Clinicians, care managers, administrators	Health systems, quality and patient-safety programs, civil-rights and compliance oversight; FDA in selected cases	Local validation in the target population and workflow, calibration assessment, subgroup performance, threshold justification, demonstration of clinical utility	Calibration drift, subgroup inequities, changes in referral or escalation patterns, override rates, access disparities, unintended workflow effects	Tools can reshape access and care pathways without fitting neatly into diagnostic-device categories
Patient-facing generative AI and consumer health AI	Symptom-checking chatbots, medication question-answering tools, care-navigation assistants, wellness or retail-health AI	Highly heterogeneous; often outside traditional clinical oversight and sometimes outside FDA pathways unless specific medical claims are made; may instead rely on FTC, privacy, and consumer-protection mechanisms	Variable but potentially high, because tools may delay care, give false reassurance, escalate anxiety, or provide biased recommendations	Patients and caregivers	FTC and consumer-protection authorities, developers, platforms, app marketplaces; FDA in selected cases	Accuracy and safety testing for common scenarios, clear disclosure of limitations, escalation rules, readability, evaluation across demographic groups, provenance and source disclosure	Harmful advice reports, escalation failures, misinformation patterns, user complaints, uneven performance across populations, commercial steering or bias	The largest gap between clinical consequence and formal medical oversight
Hybrid or general-purpose AI repurposed for clinical use	General LLMs are used ad hoc for diagnosis support, letter drafting, patient messaging, or medication explanation	Often not originally developed or cleared for a specific clinical use; governance depends on local policy, user behavior, and context of deployment	Variable and context-dependent, ranging from low-risk drafting support to high-risk decision influence	Clinicians, staff, and sometimes patients	Local institutional governance, professional standards, procurement controls, privacy/security oversight	Restriction to defined use cases, user training, disclosure of non-authoritative outputs, and local testing in intended workflows	Off-label use expansion, hidden decision influence, data leakage, hallucinations, overreliance, scope creep beyond approved workflows	General-purpose tools can become clinically consequential without entering a formal medical-AI pathway

AI artificial intelligence, FDA Food and Drug Administration, ECG electrocardiogram, MDR Medical Device Regulation, IVDR In Vitro Diagnostic Regulation, ED emergency department, FTC Federal Trade Commission, LLM large language model.