0 AI malpractice cases. Insurers move first

Picture the pitch right before you sign anything for the third location: an AI scribe, an imaging tool, a scheduling assistant, whatever it is this quarter. The rep tells you not to worry about who is on the hook if it makes a mistake, because regulators are already sorting that out. A commission published a report on 10 September 2026, government is reviewing it, and once that lands, the industry will finally know where liability sits. It is a reassuring line. It is also not close to what actually happened on 10 September, and it skips over something more urgent: while that report sits with government, your own insurance carrier has already started answering the question in a way you may not have noticed.

"Regulators are working on this. Once the report lands, we'll know who's liable when the AI gets it wrong." It is the line vendors use to close a deal, and increasingly the one practice owners repeat to each other at conferences. Neither version survives contact with what the report actually says, or with what a policy renewal actually contains.

What the 10 September report actually recommends

The document in question is the National Commission into the Regulation of AI in Healthcare's "Recommendations for a future regulatory framework," published 10 September 2026. The Commission was established by the Medicines and Healthcare products Regulatory Agency in September 2025, chaired by Professor Alastair Denniston of the University of Birmingham, with Patient Safety Commissioner Professor Henrietta Hughes OBE as deputy (National Commission into the Regulation of AI in Healthcare, GOV.UK, September 2026). On liability specifically, its central recommendation is that contracts between AI manufacturers and healthcare providers should carry an explicit allocation of responsibility for controlling risk, assigned to whoever is best positioned to manage it across the AI tool's lifecycle, rather than defaulting to the clinician who happened to be using it when something went wrong (National Commission into the Regulation of AI in Healthcare, GOV.UK, 10 September 2026).

That is a genuinely useful principle for any practice to borrow for its own contracts. It is also, by the government's own description, advice rather than policy. The Commission "was established to advise government on a future regulatory framework," and the publication page states that "a cross-government response will follow separately," with no date attached to when that response arrives (GOV.UK, 10 September 2026). Thirteen days on from publication, no such response has landed.

So what for you: nothing about how liability actually gets assigned changed on 10 September. A well-argued recommendation is not an enacted rule, and the gap between the two is exactly where an AI vendor's contract, not a government report, currently decides what happens if something goes wrong.

The US gap is bigger, not smaller

If you are waiting for an American equivalent to settle this instead, the picture is less developed, not more. Deepika Srivastava, chief operating officer of The Doctors Company, the country's largest physician-owned medical malpractice insurer, put it plainly: physicians and health systems "bear the biggest risk" when an AI tool contributes to a clinical error, while manufacturers operate in what she called a comparatively sheltered legal space unless a design defect can be proven (Medical Economics, "The new malpractice frontier: who's liable when AI gets it wrong?", October 2025). A health system carries exposure for failing to properly validate, train staff on, govern, and audit whatever tool it adopted. The vendor that sold the tool faces a claim only if the product itself, not how it was used, is shown to be defective.

The more unsettling detail is what is missing. As of that reporting, no documented US malpractice case exists where AI was central to the claim. That is not evidence the risk is small. Adoption is moving faster than the legal framework around it, according to Srivastava, and law professor David Simon's research points to AI gradually reshaping the standard of care across specialties, with, in his words, "a lot of unknowns" about where liability actually lands once it does. A gap nobody has tested in court is not a gap that has been resolved. It is a gap waiting for a first case to define it, and there is no guarantee that case looks anything like the one your own AI tool would eventually produce.

So what for you: "no case yet" means the theory has not been tested, not that your practice is protected. The first dental, physical therapy, or optometry claim to test this sets a precedent nobody currently controls, and there is no reason to assume it lands in the practice's favor.

While regulators deliberate, insurers already moved

Here is the part that should actually change how you read your next renewal notice. Insurers are not waiting for a Commission report or a landmark case. Commercial carriers have started attaching AI-specific language to general liability and professional liability policies, either through Insurance Services Office endorsements that carve out claims arising from generative AI, covering bodily injury, property damage, and products-and-completed-operations losses, or through broader absolute exclusions some carriers are adding independently, removing coverage for virtually any claim that touches AI at all, including a failure to catch AI-generated content or a regulatory investigation tied to how a practice deployed a tool (Lathrop GPM, "The AI Coverage Gap: What New Insurance Exclusions Mean for Your Business," May 2026).

None of that requires a court ruling or a government response to take effect. It requires a renewal cycle, and most practice owners only discover the exclusion exists when a broker mentions it in passing, or when a claim gets denied.

So what for you: the party actually resolving this question first is not a regulator on either side of the Atlantic. It is your insurer, one renewal at a time, and the direction of travel is toward less coverage for AI-related claims, not more.

Why this matters more at a second or third site

A single-location practice can absorb an ambiguous risk by staying close to it: one owner, one set of vendor relationships, one insurance conversation a year. Add a second or third site and that changes. Different sites often end up on different AI tools bought at different times, from different vendors, with different contract terms that nobody has compared side by side. A scheduling assistant at one location and an AI-assisted charting tool at another may sit under the same umbrella policy while carrying entirely different, unreviewed risk language. Consolidation-minded competitors already run this kind of audit as a matter of course before adding sites; a growing independent practice usually does not, simply because nobody owns the task across locations.

So what for you: growth is exactly when contract and coverage gaps multiply fastest, and exactly when nobody on staff has time to notice. Treat a new site as the trigger to audit every AI-related contract and policy across the whole practice, not just the new location's.

What "explicit allocation of responsibility" should actually look like

The Commission's phrase is useful, but only if you know what to check for. A contract that meets that bar names, in writing, who is responsible for monitoring the tool's outputs day to day, who is responsible for retraining or reconfiguring it as your patient population or workflow changes, and who carries the cost if a documented tool failure, not a misuse of it, contributes to a patient complaint or claim. A contract that is silent on all three has not left the question open. It has left it with whoever holds the weakest negotiating position when something goes wrong, which in almost every vendor relationship a small practice signs is the practice itself.

So what for you: read your existing AI vendor contracts, plural, against this checklist before you sign anything at the new site, and ask the vendor directly to add the language if it is missing. A vendor unwilling to put risk allocation in writing is telling you something about how confident it is in its own product.

The call

The evidence points toward treating the liability question as open, not pending resolution, and acting on that before your next AI contract, not after it. Three things are worth doing regardless of what the National Commission's eventual government response says. Ask your broker directly, in writing, whether your current general liability or professional liability policy carries any AI exclusion, absolute or ISO-endorsed. Read the risk-allocation language in every AI vendor contract you sign from here on, and if it is silent on who is responsible when the tool gets something wrong, treat that silence as the vendor's answer, not an oversight. And stop treating "regulators are working on it" as a reason to defer either check. No report, in the UK or the US, currently obligates anyone to cover you if it does not.

For an independent, practice-specific look at where AI risk and opportunity actually sit before you add another tool at a growing practice, the AI Opportunity and Growth Assessment starts with exactly this kind of question. Book a free 20-minute discovery call to walk through what is actually in your current contracts and coverage.

See also: the five questions worth asking before buying any AI tool, and why "AI is priced for DSOs, not practices like mine" does not hold up either.

Related: 5 questions before buying any AI tool · $39, not $249: the dental AI marketing myth · 5,944 denials: Medicare's AI pilot exposed