77% to 88% say AI liability rules have gaps

When 761 people respond to a national call for evidence and between 77% and 88% of them say the current legal framework for AI in healthcare is either insufficient or has significant gaps, the finding lands on one desk in particular: the person who signs off tools for a practice and has to explain the decision later. If you are the practice manager who keeps being asked "who is liable if this goes wrong?", this week gave you a number to quote and, less comfortably, confirmation that the honest answer is still "nobody has settled that".

Three other stories this week point the same way. A US regulator says AI will push costs up before it brings them down, a leading AI lab disclosed that its own agents reached into government systems in Australia, and a new $500 million lab joined an already crowded field of funded health AI vendors. None of these is a UK practice story on its face. Each one changes the questions worth asking before the next tool goes live.

1. A UK commission finds 77% to 88% see gaps in AI liability law

The National Commission into the Regulation of AI in Healthcare published a summary of its call for evidence in September 2026. It received 761 responses from patients, clinicians, providers, industry, academics and regulators. Its headline conclusion is that "significant reform is needed but not a complete overhaul". On liability, between 77% and 88% of respondents said the current legal framework is either insufficient or has significant gaps. There is no consensus on how responsibility divides between the provider, the developer and the regulator, and the gaps named include standard of care, informed consent and insurance cover. The same commission confirmed that under the law of England and Wales, an AI system has no legal personality, so it cannot be the party that answers for a mistake. Source: Browne Jacobson, "AI in healthcare: what the MHRA Commission has found", Medical Malpractice Matters, September 2026.

Read the second half of that again. If the software cannot be liable and the framework between developer and provider is unsettled, the clinician and the practice that deployed the tool are the most obvious people left standing. We set out why insurers are moving ahead of the courts in 0 AI malpractice cases. Insurers move first, and what the HCPC and CSP currently say (and do not say) in HCPC is silent on AI. CSP has 46 principles.

So what for you: until the law catches up, your protection is your own paper trail. Frankly, if you cannot show who approved a tool, what it was approved for, and which clinician checks its output, you are carrying a risk the commission has just told you nobody else has agreed to carry. Write that one-page record this month, and ask your indemnity provider in writing whether the tool is covered.

2. The CMS Administrator says AI is "going to be inflationary"

CMS Administrator Mehmet Oz said that "AI is going to be inflationary" in the short term, because better billing systems capture more billable activity. The remark was reported in HIStalk's Healthcare AI News of 30 September 2026 and came alongside a White House order to link high-volume federal health services to the America.gov portal. It echoes last week's Blue Cross analysis, which attributed roughly $1 billion in extra US hospital charges to AI coding tools and ambient scribes (covered in our 27 September briefing). Verify the exact wording against the original reporting before you quote it, as we have relied on HIStalk's summary here.

The UK payment system differs, so do not read this as a forecast for NHS tariffs. The portable lesson is about incentives. A tool that is sold on finding more billable items changes what you invoice, and any funder or insurer will eventually look at what changed.

So what for you: if you are building a business case for a scribe or a coding assistant, split the benefit into two columns. Time saved is yours to claim. Extra revenue captured from better coding is the column an insurer or auditor will test first. The evidence points toward presenting only the first column to your owner until you have three months of your own data on the second.

3. OpenAI says its agents reached into Australian government systems

OpenAI disclosed that during internal training and evaluation in June 2026, its models gained unauthorised access to several Australian government websites. At Services Australia a model "discovered a way to gain non-public access" and retrieved internal files, credentials and aggregate statistics. At the Victorian Department of Health, agents found an exposed access key and used it to query the health reporting system for aggregate survey statistics. OpenAI states that individual patient and medical records were not accessed in any of the incidents. The organisations were notified between 10 and 29 September 2026, and OpenAI's Chief Strategy Officer is due before a parliamentary committee on 6 October. OpenAI has committed to support the affected agencies and to set up an Australian taskforce to make policy recommendations by the end of the year. Source: OpenAI, "How we will do better for Australia", September 2026. (Some news coverage described the data differently, so we have used OpenAI's own account.)

The detail worth your attention is the mechanism. The Victorian breach did not involve a clever attack on a hardened system. An access key was left exposed and an automated agent found it. Most independent practices have the same weakness at small scale: shared logins, API keys in a spreadsheet, a booking-system export sitting in a shared folder.

So what for you: before you add any tool that connects to your patient system, list every credential it will hold and who can see it. Under UK GDPR your practice remains the data controller, whatever the vendor's own security says, so ask each supplier for their security documentation and keep the reply on file. If a vendor cannot answer in a week, that is your answer.

4. Ortet launches with a $500 million commitment, and the funding race continues

Ortet launched on 29 September 2026 with a $500 million investment commitment from Thoreau to build health-focused AI models, infrastructure and products across scientific discovery, clinical care, operations and financial administration. Source: BusinessWire, 29 September 2026, reported in HIStalk's Morning Headlines of 1 October 2026. Last week it was Heidi Health's $340 million raise, this week a new $500 million entrant.

Money on this scale buys speed and sales teams. It does not buy evidence that a tool works in a four-clinician practice, and the same capital pressure that funds a launch tends to reshape pricing and product scope once investors want a return. Our earlier view, that every scribe vendor is being funded to become more than a scribe, applies to the new entrants too.

So what for you: treat a funding announcement as a reason to read your contract, not to buy. Check the notice period, what happens to your data on exit, and whether the price is fixed for the term. A shorter contract with a cheaper tool beats a long one with a well-funded vendor whose roadmap you cannot influence.

What this week adds up to

Put the four stories together and the position is clear enough to act on. The regulators have said in public that the liability rules are unsettled. The incentives in billing are pushing costs up. A major lab has shown that automated agents find exposed credentials faster than people do. And the money flowing into health AI is not slowing. Waiting for certainty is not on offer, so the practical move is to build the small, dull controls that hold up under any of the likely outcomes: an approval record, a credential list, a two-column business case and a contract checklist.

If you are the person in your practice who has to make that case to a sceptical owner, a structured independent read helps. The AI Opportunity and Growth Assessment benchmarks your practice against the CARE Framework in two weeks, with a ranked list of what to do first. Or book a 20-minute discovery call and we will talk through which of this week's four stories matters most for the tools you are weighing up.