One week, three signals: HTI-5 is final, a Senate draft rethinks health AI oversight, and WHO Europe sets an AI roadmap

What happened

HTI-5 is final, and narrower than proposed. The US health IT certification rule was finalised in late October. Legal analyses report it removes 14 of 60 certification criteria rather than the 34 proposed, keeps the privacy and security criteria the proposal would have dropped, defers proposed information blocking changes, and removes the AI "model card" requirements for predictive decision support interventions¹². We covered the proposal in From HTI-1 to HTI-5; the final rule confirms the direction on AI transparency while retreating on much else.

A Senate draft rethinks oversight and payment. On 29 October, Senate HELP Committee chair Bill Cassidy released a discussion draft of the PATIENT AI Act. It would clarify whether an AI tool falls under FDA or ONC oversight, let FDA accept premarket software changes, have HHS certify third parties to review lower-risk software, and create a payment pathway for AI-enabled care; comments are due by 1 December³⁴. It is a draft, not law.

WHO Europe sets a direction. The same day, governments across Europe and Central Asia adopted a roadmap for AI in health care, emphasising foundations such as data quality, interoperability, secure access and cybersecurity⁵.

What it means for builders

In the US, certification will ask less of AI vendors about transparency. That does not mean buyers will. Health systems still have to decide whether a model is safe and useful for their patients, and with less standard documentation, they will ask vendors directly and test more themselves. If the PATIENT AI Act's ideas progress, payment for AI-enabled care would come with expectations of evidence. In Europe, the roadmap points the same way through data quality and interoperability. Different routes, one destination: show the model works, here, on these patients.

Build the evidence anyway

Keep your model facts. Maintain the information the model card requirement covered, such as intended use, training data, known limitations and performance, versioned with every release. It costs little if built into the release process, and buyers will keep asking for it.

Make validation portable. A model that performed well where it was built may not perform well elsewhere. The OHDSI community frames this as evidence attributes: results should be repeatable, reproducible, replicable, generalisable to different data and robust to different analyses⁶. Mapping site data to a common model such as OMOP lets you run the same validation at each customer; see clinical prediction models on OMOP.

Plan for software change. If FDA gains clearer authority to accept planned software changes, teams with a disciplined change process will move faster. See predetermined change control plans.

Keep FHIR at the centre. The FHIR API criteria stay, and the direction of travel in both the US and Europe is towards standard, secure data access; see TEFCA in 2026.

Next 90 days

CTO take

The US is stepping back from prescribing AI transparency through certification while exploring how to pay for AI that works, and Europe is investing in the data foundations that make evidence possible. For health tech teams, that adds up to one strategy: own your evidence. Teams that can show, per customer, what their model is, how it performs on that customer's patients and how it is monitored will sell faster under any of these regimes. See healthcare data architecture, the US page and the Europe page.

How I can help

I help health tech teams build model documentation, validation pipelines and FHIR and OMOP foundations that satisfy buyers and regulators. I am based in India, the United States and the UAE, working globally. See healthcare data architecture or analyse your challenge and bring the result to a call.