Preliminary risk assessment and classification, with continuous monitoring
Applies from August 26, 2026
- When it relates
- If you are a hospital, clinic or other health institution that develops or uses AI.
- What the rule provides
- Carry out a preliminary risk assessment and classify each system as low, medium, high or unacceptable risk.
- Set up internal safety, quality and ethics governance processes, including for AI already in use.
- Implement continuous audit and monitoring mechanisms; for high-risk systems, regular audits.
- Tell patients the risk level of the system used in their care.
- Typical evidence
- Inventory with risk classification.
- Governance procedures.
- Monitoring plan and audit records.
- Related base documents
- Supporting documents
- Verification
- Verified in the official source on November 2, 2026Checked on the CFM's official portal: published in the DOU on Feb 27, 2026 and in force on Aug 26, 2026 (180 days). Adopted Feb 11, 2026 and corrected Mar 5, 2026 per secondary sources. Correction to the notes: the CFM requires an AI and Telemedicine Commission only for institutions that adopt their own AI systems. Ten health organizations asked for it to be suspended; no ruling suspending it was found as of Nov 2, 2026. Review Nov 2, 2026: Mayer Brown summary (Mar 2026) confirms the preliminary assessment with four levels and the institutional duty of continuous audit and monitoring. The full DOU text could not be extracted (scanned PDF).