Regulatory-Ready vs. Exposed: The AI Health Investment Decider

The burgeoning landscape of artificial intelligence in healthcare presents a dual reality for investors and health plan executives: companies are either meticulously building for regulatory compliance or inadvertently exposing themselves to significant risk. This binary classification, Regulatory-Ready vs. Regulatory-Exposed, is rapidly becoming the most critical lens through which to evaluate AI health ventures. As regulatory scrutiny intensifies, understanding where a company falls on this spectrum can mean the difference between sustainable growth and costly operational paralysis.

The Regulatory Chasm: Defined Pathways vs. Enforcement Blind Spots

The distinction between regulatory-ready and regulatory-exposed hinges on a company’s proactive engagement with established and emerging regulatory frameworks. Regulatory-ready entities typically operate within well-defined pathways, possessing a clear understanding of, and often having secured, necessary clearances and certifications. Their operations are characterized by a clean enforcement record, reflecting a commitment to compliance from inception. Conversely, regulatory-exposed companies often lack a clear regulatory pathway, operate in gray areas, or have a history of enforcement actions, signaling potential future liabilities.

Consider the contrast between companies like Tempus AI, Viz.ai, and Aidoc, which largely operate within the FDA’s Software as a Medical Device (SaMD) Framework, and those navigating less defined territories. Tempus AI, for instance, has strategically pursued FDA clearances for its AI-powered diagnostic tools, aligning its product development with regulatory expectations, including recent 510(k) clearances for its ECG-AF algorithm and ECG-Low EF software, as well as updates to its Pixel cardiac imaging platform and xR IVD device. Similarly, Viz.ai and Aidoc, both focused on AI-driven medical imaging analysis, have prioritized obtaining 510(k) clearances, demonstrating a clear commitment to regulatory adherence. Viz.ai has secured clearances for tools like Viz Subdural Plus for subdural measurements, Viz ICH Plus for intracerebral hemorrhage quantification, and Viz ANEURYSM for cerebral aneurysm detection. Aidoc recently received FDA clearance for the healthcare industry’s first comprehensive AI triage solution powered by a foundation model, bringing 11 new indications and three previously cleared indications into a single workflow, and has also expanded its clearances for critical neurological and cardiovascular conditions. This proactive approach ensures their technologies are validated through established mechanisms, building trust with both regulators and end-users. As Scott Gottlieb, former FDA Commissioner, has frequently emphasized, clarity on regulatory pathways is paramount for innovation in health technology Scott Gottlieb on FDA regulation of AI.

In stark contrast, other companies, particularly those in the digital mental health or wellness space, have faced greater scrutiny. BetterHelp and Cerebral, for example, have operated in an environment where the lines between medical device, telehealth service, and wellness app are often blurred, leading to questions about their regulatory obligations. BetterHelp faced a $7.8 million settlement with the FTC in 2023 for allegedly sharing sensitive user data with advertising platforms without consent, highlighting ongoing scrutiny over data privacy practices. The FTC Health Breach Notification Rule, for instance, has become a critical area of focus for companies handling sensitive health data outside of HIPAA’s direct purview, with the FTC expanding its enforcement and clarifying its applicability to health apps and similar technologies not covered by HIPAA. The lack of a predefined regulatory pathway or a history of consumer protection concerns can classify these entities as regulatory-exposed, presenting a higher risk profile for investors. This divergence highlights a key observation by Casey Ross, who has extensively covered the regulatory challenges facing digital health companies Casey Ross analysis of digital health regulatory landscape.

Navigating Data Privacy and Security: HIPAA, FTC, and the EU AI Act

Beyond product-specific clearances, the handling of sensitive health data is a universal regulatory flashpoint. The HIPAA Privacy Rule and HIPAA Security Rule are foundational for any entity dealing with Protected Health Information (PHI) in the United States. Companies like Omada Health and Hinge Health, which provide digital therapeutic and chronic disease management programs, must meticulously adhere to these regulations. Their business models are built on capturing and analyzing patient data, making robust data security and privacy protocols non-negotiable. Their ability to demonstrate compliance, often through certifications like SOC 2 or HITRUST, directly contributes to their regulatory-ready status.

However, the regulatory landscape for data is not static. The FTC, through its enforcement of the FTC Health Breach Notification Rule, has increasingly targeted companies that collect health data but may not fall under traditional HIPAA jurisdiction. This creates a significant compliance challenge for companies like Hims & Hers or even consumer-facing AI applications from Purolea and Exer Labs AI, which might collect health-related data without being traditional covered entities or business associates. Hims & Hers, for example, has faced significant regulatory challenges in 2026, including an FDA warning letter to one of its compounding pharmacies for manufacturing violations, an SEC investigation, a DOJ referral regarding unapproved drugs, and patent infringement lawsuits from Novo Nordisk related to compounded GLP-1 medications. The risk of FTC enforcement actions, as highlighted by HHS OCR’s activities, underscores the importance of a comprehensive data governance strategy HHS OCR HIPAA enforcement actions.

Furthermore, the global nature of AI development and deployment means companies cannot ignore international regulations. The EU AI Act, which entered into force in August 2024, is already imposing requirements, with prohibited AI practices and AI literacy obligations applicable since February 2025. While a “Digital Omnibus” amendment approved in June 2026 has deferred deadlines for high-risk AI systems (standalone systems to December 2027 and those embedded in regulated products to August 2028), transparency obligations for AI systems generating synthetic content or interacting directly with people are still set to apply on August 2, 2026. For companies with aspirations in European markets, early alignment with these regulations is crucial. The investment landscape, as observed by Rock Health and CB Insights, is increasingly factoring in these complex regulatory considerations, recognizing that a clean compliance record is a significant de-risking factor.

Lessons from the Exposed: Olive AI, Babylon Health, and Assurance IQ

The journey of companies like Olive AI and Babylon Health serves as cautionary tales, illustrating the financial and reputational costs of a regulatory-exposed posture. Olive AI, once a darling of healthcare AI, faced significant operational restructuring, partly due to challenges in demonstrating clear value and navigating complex healthcare billing and integration issues, which often touch upon regulatory nuances. While not directly an FDA or HIPAA enforcement issue, the inability to clearly articulate and demonstrate regulatory-compliant utility and value contributed to their struggles. Similarly, Babylon Health’s rapid expansion and subsequent retrenchment highlighted the difficulties of scaling healthcare AI solutions without a firm grasp of local regulatory and reimbursement landscapes, leading to questions about the sustainability of their model. In fact, Babylon Health is no longer in operation, having filed for bankruptcy in August 2023, closing all its US operations and selling its UK businesses by September 2023. Its UK operations were acquired and rebranded by eMed Healthcare UK.

Even in adjacent sectors, such as insurance, the regulatory environment can be unforgiving. Assurance IQ, an insurance technology company, has faced scrutiny over its sales practices and data handling, demonstrating that even companies leveraging AI for customer acquisition and matching must contend with robust regulatory oversight, particularly from state insurance commissioners and consumer protection agencies. These examples reinforce the notion that a lack of clear regulatory strategy or a history of operational missteps can quickly erode investor confidence and lead to significant write-downs.

The Investor’s Imperative: Prioritizing Regulatory-Ready Architectures

For investors and health plan executives, the message is clear: a company’s regulatory posture is no longer a secondary consideration but a primary determinant of its long-term viability and investment appeal. The ECRI AI healthcare hazard rankings for 2026, which identified the misuse of AI chatbots in healthcare as the top hazard, alongside ongoing AMA legislative activity concerning AI healthcare oversight, will further sharpen this focus. The American Medical Association, at its June 2026 annual meeting, adopted new policies emphasizing physician oversight of AI, transparency in its use, and advocating for AI as an assistive tool rather than an autonomous decision-maker in clinical and insurance contexts. The FDA CDRH continues to issue guidance updates, including those on AI/ML-based SaMD, providing clearer pathways for development and deployment. Payer policy changes are also increasingly influenced by a company’s regulatory status, with many payers now demanding evidence of robust clinical validation and regulatory clearance before considering reimbursement. Bob Kocher, a prominent voice in healthcare innovation, has consistently advocated for a focus on solutions that demonstrate clear clinical utility and navigate regulatory hurdles effectively Bob Kocher on healthcare innovation and regulation.

The classification of AI health companies into regulatory-ready versus regulatory-exposed offers a crucial framework for strategic decision-making. Companies that proactively engage with regulatory bodies, build their products with compliance in mind, and maintain a transparent and clean enforcement record will be better positioned for success. For investors, this means prioritizing due diligence on regulatory pathways, data governance, and past enforcement. For health plan executives, it translates to partnering with companies that minimize risk and maximize the potential for compliant, effective, and reimbursable AI solutions, thereby securing the investment case for healthcare AI regulatory compliance in 2026 and beyond.