On October 13, 2026, the American Medical Association published a one-page governance framework for agentic AI that takes on clinical functions. It fits on a single page and is useful enough to keep on the wall. Its governing principle: "Clinical authority should be earned through evidence and maintained through demonstrated performance. Authority and oversight can evolve as evidence, performance, risk or the technology itself changes."
In August, a JAMA Perspective by Ezekiel Emanuel, Neal Khosla, Vinod Khosla and Abe Baker-Butler argued that AI-alone care is likely to outperform physicians working with or without AI. AMA CEO John Whyte answered that "medicine is not a collection of tasks." The October framework moves the argument somewhere more productive. It accepts that an AI system can earn the authority to decide and act, and it asks what that system has to prove first.
Four questions
The framework rests on four questions. The first is function: what task the AI performs, for which patients, in which setting, for what intended use. The examples run from documenting and monitoring through triage, recommendation and diagnosis, to treating and prescribing.
The second is evidence and risk: what demonstrates that the AI can perform the function, and what happens if it fails. Performance, safety, clinical benefit, population fit and uncertainty are to be evaluated "in proportion to potential consequence." Greater consequence and greater autonomy call for stronger evidence.
The third is authority and oversight: what the AI is permitted to do and under what conditions, along a scale from inform, to recommend, to decide, to act.
The fourth is accountability: who is responsible for the risks and outcomes. The framework's answer is to "allocate accountability according to authority, control, knowledge of risk and ability to prevent or mitigate harm," and it names the candidates: developer, deployer, health system, physician, payer and other actors.
Around those questions sit three areas the AMA intends to work on, regulation, licensure and liability, and a continuous loop of deploy, monitor, reassess and learn.
What it gets right
The framework borrows a process healthcare already runs well. Hospitals grant physicians privileges for defined procedures based on demonstrated competence, review those privileges over time, and restrict them when outcomes slip. The AMA has described the same discipline for software: a defined scope, evidence proportionate to the stakes, ongoing review, and authority that can expand or contract. Medical staff offices, quality committees and peer review exist in every health system. The framework gives them a shape for a new kind of applicant.
It ties accountability to control. Responsibility follows whoever sets the AI's permissions, sees its failure data and can stop it. Depending on the deployment, that may be the vendor, the health system or the payer, and only sometimes the physician who happens to be nearest the output. With any model in production, the hard questions arrive after launch, when the system does something unexpected and someone has to own the response. A framework that assigns ownership by control gives that someone a name before the incident.
It names payers. The framework says nothing specific about prior authorization or utilization management, but listing payers among the accountable parties matters, because some of the most consequential "decide" and "act" uses of AI in healthcare sit on the payer side.
And it treats authority as dynamic. The deploy, monitor, reassess and learn loop means a system that performs well can earn more room, and one that drifts can lose it. That is how trust works between people, and it is a sensible way for it to work with software.
The work still ahead
The framework is a scaffold. Several of its load-bearing pieces are left for later work.
It sets no thresholds. It says stronger evidence is needed for greater autonomy, but not how much evidence earns which level of authority, or who decides. The candidates include the FDA, state regulators, accreditors and each health system's own committees, and those bodies will reach different answers unless someone sets a common bar. The FDA's fiscal 2027 guidance priorities, as Healthcare Dive reported them, cover lifecycle management for AI-enabled devices and generative AI conversational devices for mental disorders. Agentic systems are not called out.
Licensure has no home yet. The AMA uses "licensure" to mean authorization for an AI system to operate in a defined clinical capacity, and its own footnote says terminology "remains unsettled" and the field has not converged on a shared term. No body yet issues that authorization.
The evidence needed for "decide" and "act" is hard to generate. The JAMA authors themselves acknowledge that more real-world clinical evidence is needed and that liability, regulatory and reimbursement barriers limit the studies that would produce it. A framework that conditions authority on evidence also needs a path for producing that evidence safely.
Liability is still contractual and case by case. Utah offers a live example. Its AI sandbox approved three pilots on October 6, including one in which an app would prescribe from a short list of topical acne medications. Two physicians review every prescription in the first stage, later stages move to after-the-fact review, and the company needs written regulatory approval before advancing. That is the framework's earned-authority model in practice. Yet Stanford's Michelle Mello has argued in JAMA Health Forum that the contract behind an earlier Utah prescription-renewal pilot, Doctronic's, is unclear about who bears responsibility for AI prescribing errors that injure patients. The AMA's fourth question, in other words, is still unanswered in one of the few places where agents are already prescribing.
On the payer side, the states are drawing lines of their own. Seven state laws passed in 2026 set rules for AI in coverage decisions. Several bar AI from being the sole basis for a denial, Washington's requires that only a licensed physician or health professional deny a request on medical necessity grounds, and Colorado's adds periodic accuracy audits. In traditional Medicare, CMS's WISeR model, which began January 1, 2026, tests technology including AI to review prior authorization for 13 services in six states. Those rules and the AMA framework point the same way, but they were written separately.
Meanwhile deployment is running ahead of governance. In a September 2026 survey of 250 U.S. healthcare leaders, conducted by Vanson Bourne for the identity security company Imprivata, 28% reported agentic AI in production, 44% were piloting it, and 72% reported AI tools or agents deployed without formal IT approval. A vendor survey is a directional signal, and the direction is clear enough.
What can be done now
Most of the open items belong to regulators, accreditors and courts. The fourth question does not have to wait for them.
A health system can keep a register of every agent in production that answers the framework's questions in plain terms: the function it performs, its permission level on the inform-to-act scale, a named owner, the evidence that justified that level, and a performance record that decides whether the permission widens or narrows. That turns a one-page framework into an operating practice, and it brings shadow deployments into the open.
Vendors can treat the framework as a preview. Evidence matched to the autonomy being claimed, monitoring built into the product, and a clear statement of what the system is and is not permitted to do are what procurement teams will ask for as they adopt this language.
Payers have the clearest opening. Under a framework that assigns accountability by control, AI that informs or recommends a coverage decision, with its documentation visible to the provider, sits on firm ground. It also fits the direction the states have set. Shared evidence that the right care is being followed builds the confidence on both sides that utilization management has always been trying to produce, and it does so without adding another review layer.
The AMA describes its goal as keeping "evidence, authority, oversight and accountability" aligned as AI capabilities advance. The framework supplies the vocabulary for that alignment. The organizations building and running these systems can supply the practice, and the ones that do will help set the bar everyone else is measured against.
Sources
- American Medical Association. "A Governance Framework for Agentic AI Assuming Clinical Functions." October 2026. https://www.ama-assn.org/system/files/governance-framework-agentic-ai.pdf
- AMA. "A governance framework for agentic AI assuming clinical functions." October 13, 2026. https://www.ama-assn.org/practice-management/digital-health/governance-framework-agentic-ai-assuming-clinical-functions
- Fierce Healthcare. "As AI advances, a debate grows over the future role of physicians." August 21, 2026. https://www.fiercehealthcare.com/ai-and-machine-learning/ai-advances-debate-grows-over-future-role-physicians
- Healthcare Dive. "Utah approves slew of health AI pilots for drug management, women's health." October 6, 2026. https://www.healthcaredive.com/news/utah-approves-health-ai-pilots-drug-management-womens-health/832318/
- Healthcare Dive. "FDA to prioritize guidance on AI, surgical robots next year." October 2, 2026. https://www.healthcaredive.com/news/fda-to-prioritize-guidance-on-ai-surgical-robots-next-year/832120/
- Becker's Payer Issues. "7 AI health insurance state laws passed in 2026." July 28, 2026. https://www.beckerspayer.com/policy-updates/7-ai-health-insurance-state-laws-passed-in-2026/
- Fierce Healthcare. "Senate strikes down Dems move to overturn CMS' WISeR AI prior auth pilot." July 17, 2026. https://www.fiercehealthcare.com/regulatory/legislators-introduce-resolution-seek-congressional-disapproval-cms-wiser-ai-prior-auth
- Imprivata. "New Imprivata Research Finds 72% of Healthcare Organizations Have AI Tools or Agents Deployed Without Formal IT Approval." September 15, 2026. https://www.globenewswire.com/news-release/2026/09/15/3362174/0/en/new-imprivata-research-finds-72-of-healthcare-organizations-have-ai-tools-or-agents-deployed-without-formal-it-approval.html