AMA Releases Framework Assigning AI Liability to Developers, Health Systems, and Physicians

The American Medical Association released the first major framework for assigning legal liability when a clinical AI system harms a patient — distributing responsibility among AI developers, health systems, and individual physicians based on each party's level of authority and practical ability to prevent harm. The framework arrives as hospitals accelerate AI deployment without clear legal guardrails, filling a gap that federal regulators have not yet addressed.

Healthcare IT Today covered the AMA's release in its November 7 roundup.

Why There Was No Framework Before

Clinical AI has been deployed in U.S. hospitals for years. The FDA has cleared more than 1,300 AI-enabled medical devices, covering applications from radiology interpretation to sepsis prediction to medication dosing recommendations. What the FDA has not done is specify who bears legal responsibility when those cleared devices cause harm.

Existing medical malpractice law was built around human practitioners making human decisions. Product liability law covers defective manufactured goods. Neither framework maps cleanly onto a situation where:

• A physician follows an AI recommendation that turns out to be wrong
• A hospital deploys an AI system without validating it for their patient population
• An AI developer releases a model that performs well on benchmark data but fails in real-world clinical conditions

The result has been legal paralysis. Hospitals have been reluctant to document AI use in medical records because doing so creates a paper trail for malpractice claims. Physicians have been unsure whether following an AI recommendation constitutes due diligence or abdicates clinical judgment. Developers have been writing liability waivers into contracts that health systems often sign without fully reviewing.

The AMA's framework is an attempt to rationalize this mess.

How the AMA Distributes Responsibility

The framework's core principle is that liability tracks authority. The party with the most control over whether harm occurs bears the most responsibility for preventing it.

Developer liability applies when:

• The AI system itself is defective — meaning it performs as designed but the design is flawed
• Training data contained systematic biases that caused predictable failures in identifiable patient populations
• The developer failed to disclose known limitations, failure modes, or demographic performance gaps
• Post-market surveillance identified problems the developer failed to act on

Health system liability applies when:

• The institution deployed an AI tool without validating it for their specific patient population (a system trained on a predominantly young, white patient dataset deployed in a geriatric care setting, for example)
• Staff were inadequately trained on the system's limitations
• The institution knew of performance issues and failed to address them
• Procurement contracts did not require developers to provide adequate limitation disclosures

Physician liability applies when:

• A physician relied on an AI recommendation without exercising appropriate clinical judgment
• The physician ignored or overrode a warning the system appropriately generated
• The clinical documentation does not reflect that the physician actually reviewed the AI's output

One critical clarification in the framework: if a physician cannot override an AI recommendation — because the system is automated and operates without physician approval, like certain drug-dispensing or alarm-filtering systems — liability shifts away from the physician and toward the institution or developer who configured the system that way.

What This Changes in Practice

The AMA framework is not law. It doesn't have the force of a court ruling or a federal regulation. But it matters for several reasons.

Malpractice insurers will use it. Underwriters pricing physician malpractice coverage and hospital professional liability insurance are already grappling with AI exposure. A published AMA framework gives them a structure for assessing whether a client's AI practices are defensible — and for pricing premiums accordingly. Expect insurers to begin incorporating AMA-aligned AI governance requirements into coverage terms within 12-18 months.

Courts will reference it. When AI-related malpractice cases reach trial — and they are coming — both sides will cite expert opinion on what constitutes the standard of care for clinical AI use. The AMA's framework, authored by the profession's largest representative body, will be exhibit A. Courts don't have to adopt it, but most judges will give it significant weight.

Procurement will change. Health systems that want to shift liability toward AI developers will need contracts that require developers to provide explicit performance data, limitation disclosures, and demographic validation results. Developers who don't provide those disclosures will face harder negotiations — and potentially less market access.

Documentation practices will evolve. Rather than avoiding AI documentation to dodge liability, hospitals following the AMA framework will want to document AI use and physician review — creating a record that shows the clinical team exercised judgment, reviewed the AI's recommendation critically, and made an independent determination. That documentation posture is a liability shield, not a liability magnet.

What Federal Regulators Haven't Done

The FDA's current framework for AI-enabled medical devices focuses on premarket clearance — reviewing a device before it goes to market — but does not specify post-deployment liability allocation. The Office for Civil Rights at HHS has addressed AI bias in covered entities to a limited degree. No federal statute directly answers the question the AMA is trying to address.

Congress has introduced health AI bills — including the Patient AI Act that passed committee in 2026 — but none has become law with specific liability provisions. The AMA framework may help those legislative efforts by providing legislative drafters with a tested policy structure.

What to Watch

Watch for state medical boards to begin incorporating AMA-aligned AI governance standards into professional conduct guidelines. If even a handful of large states — California, Texas, New York, Florida — adopt versions of this framework as standard of care, it effectively becomes national policy through the malpractice system even without federal legislation.

Also watch how the major clinical AI vendors — Epic, Oracle Health, Nuance (Microsoft), Abridge — respond. Their terms-of-service and clinical documentation tools will need to evolve if the framework gains traction. The vendors who get ahead of this will be better positioned than those who resist.