Your healthcare malpractice policy may no longer cover AI.

Three things have already happened — and none of them require a new law to hurt you.

First, your carrier moved. As of January 2026, standard-form AI exclusion endorsements are available to every malpractice insurer in the country. W.R. Berkley, Hamilton Select, and Philadelphia Indemnity have already adopted them. These exclusions cover AI scribes, EHR algorithms, scheduling chatbots — any AI tool touching patient care. If your policy has one, an AI-related claim gets denied. You bear the full cost.

Second, the laws are already enforceable. Texas TRAIGA carries $200,000 per uncurable violation. Illinois enacted two AI laws — the IHRA AI Amendment (employment discrimination, eff. Jan 2026) and the WOPR Act (HB 1806, $10,000 per violation for AI in therapy without licensed oversight, eff. Aug 2025). Colorado SB 24-205 enforces at $20,000 per consumer with no aggregate cap starting June 30, 2026. If you conduct telehealth follow-ups with patients who have returned to any of these states — and in Florida, with its snowbird population, you almost certainly do — those states\' laws apply to those encounters. Globally, the EU AI Act now classifies healthcare AI as high-risk and requires conformity assessments — U.S. states are building on that model.

Third, the standard of care shifted. The Federation of State Medical Boards established that physicians are liable for AI errors just as for any diagnostic tool — and went further: both reckless use and failure to use beneficial AI can fall below the standard of care. You cannot opt out. You can only govern it or remain exposed on both sides.

Independent third-party certification is the documented evidence that you govern AI properly. It's what carriers evaluate at renewal, what defense counsel can draw on if your governance is challenged, and what you can present to regulators as evidence of good-faith compliance posture. Self-attestation carries zero evidentiary weight. Certification does.

It protects the vendor. Not you. Most AI scribe contracts shift all compliance, regulatory, and clinical liability to the practice. The vendor retains broad rights to modify their software — including changing the underlying AI model — without advance notice or your consent. Accuracy warranties are typically disclaimed entirely or limited to vague "commercially reasonable" standards that wouldn't survive regulatory scrutiny.

But even if you negotiated the most favorable vendor agreement possible — full indemnification, accuracy guarantees, mandatory model update notifications — that only governs your relationship with the vendor. It does nothing for your liability to patients under malpractice law, to payers under the False Claims Act, to regulators under state AI laws, or to carriers under your insurance policy. Better vendor terms might give you a contribution claim against the vendor after you've already been sued — but they don't prevent the lawsuit, the regulatory fine, the payer recoupment, or the insurance denial.

Contracts are between you and your vendor. Governance is between you and everyone else — patients, payers, regulators, carriers. Our certification optionally includes a vendor governance assessment that identifies where your agreement leaves you exposed.

Because of telehealth. The practice of medicine occurs where the patient is physically located during the encounter — not where your office is. A Texas snowbird who sees you in-person at your Florida office? That visit is governed by Florida law. But when that patient returns home to Texas and you do a telehealth follow-up, Texas TRAIGA applies to that visit — $200,000 per uncurable violation — because the patient is now physically in Texas. The same logic applies to Colorado: a patient who visited Florida returns to Colorado, and your telehealth follow-up triggers SB 24-205 at $20,000 per consumer, no aggregate cap, once enforcement begins June 30, 2026. The Illinois WOPR Act (HB 1806) applies to behavioral health encounters where AI is used therapeutically — $10,000 per violation.

This is not hypothetical. 71% of physicians now use telehealth weekly (AMA, 2024). If you conduct telehealth follow-ups with patients who have returned to states with enacted AI laws, those laws apply to those visits. Each cross-state telehealth encounter potentially triggers disclosure requirements, documentation obligations, and penalty exposure in the patient's state. As more states enact AI laws (47 states have introduced bills, 17 enacted in 2025 and counting), the compliance footprint for every telehealth-enabled practice expands with every out-of-state follow-up.

Self-assessment has zero evidentiary weight when challenged. When a malpractice carrier evaluates your AI risk, when a plaintiff's attorney asks whether your governance was independently validated, when a regulator reviews your compliance posture — self-attestation is meaningless. Every credible governance standard requires independent third-party validation: SOC 2, ISO 27001, Joint Commission accreditation, HITRUST. The reason is straightforward: an independent assessor has no institutional blind spots, no incentive to overlook gaps, and produces documentation that carries legal weight precisely because it was not self-generated. Governance without independent validation is a binder on a shelf. Governance with certification is a legal defense.

No — and that's the critical insight most practices miss. The Federation of State Medical Boards issued guidance in May 2024 establishing that physicians are liable for AI errors just as for any diagnostic tool. But FSMB went further: both reckless use of AI and failure to use beneficial AI can fall below the standard of care. This is the first licensing body to suggest that not using AI where it would benefit patients could itself be problematic. You cannot opt out. You can only choose whether you govern it properly or remain exposed on both sides.

No — but the window to act is narrowing. Certification doesn't undo an existing exclusion. What it does give you is documented evidence to negotiate at renewal, a defensible governance posture to shop to competing carriers, and protection under any remaining coverage lines (E&O, cyber, general liability) that may still cover AI-adjacent claims. Carriers are rational — they exclude risks they can't evaluate. Give them something to evaluate. The cybersecurity insurance parallel is instructive: by 2022, carriers weren't just requiring security controls — they were offering better rates for documented frameworks. AI governance is on the same trajectory, roughly 12–18 months behind.

No. You're exposed right now — and waiting makes it worse.

17 states have already enacted AI healthcare laws. Texas TRAIGA is in effect. Colorado SB 24-205 is in effect. Illinois, California, New York — all enforceable. These laws don't pause because Washington is drafting a framework. Your practice is subject to them today, through every telehealth visit that crosses state lines.

The federal executive order signed in December 2025 signals intent to establish a national AI standard — but an executive order does not preempt state law. Only Congress can do that through legislation, and the current legislative draft still requires governance obligations, risk assessments, and duty of care for high-risk AI in healthcare. The question isn't whether governance will be required — it's whether the framework is state, federal, or both.

Meanwhile, your malpractice carrier isn't waiting. Carrier exclusion decisions are private market decisions that no federal framework changes. The DOJ False Claims Act applies regardless. Common law negligence applies regardless. The standard of care applies regardless. None of these depend on AI-specific statutes.

Practices that certify now are governed before any mandate — state or federal — requires it. When the framework arrives, you're already compliant. Practices that wait will certify under pressure, at higher cost, with less favorable terms.

Because AI healthcare regulation is moving faster than any compliance area in modern medicine.

In the past 12 months alone: multiple states passed new AI transparency and liability laws, CMS updated billing guidance for AI-assisted documentation, the ONC finalized new rules on AI in health IT, and major malpractice carriers introduced AI-specific exclusion endorsements. A certification based on last year's regulatory landscape does not protect you from this year's enforcement actions.

The parallel is HIPAA Security Risk Assessments — HHS recommends annual reviews, and OCR has fined practices for stale assessments. AI governance moves faster than HIPAA ever did. A two-year-old governance framework would miss entire categories of risk that didn't exist when it was written.

Annual recertification ensures your practice stays current with the law — not just current with the technology. Our renewal process is streamlined for returning clients, recognizes the governance foundation you've already built, and is priced at a reduced renewal rate. You're not starting over — you're staying ahead.

You get a roadmap, not a rejection.

Most practices will have governance gaps on their first assessment — that's the entire point of the evaluation. If your practice doesn't meet the certification threshold, you receive a Conditional outcome: a detailed assessment report identifying every finding by severity, with specific remediation steps and a clear timeline to resolve them.

Here's the key: one re-assessment is included at no additional cost. You implement the corrective actions in the roadmap, we re-evaluate, and if you meet the threshold, you're certified. The re-assessment window is 12 months from your initial assessment — generous enough to implement meaningful changes without rushing.

The assessment report is itself a valuable deliverable. It tells you exactly where your governance stands, what needs to change, and why. Practices that receive a Conditional outcome and follow the roadmap consistently achieve full certification on re-assessment. The goal is certification — the assessment just gets you there safely.