Who Is Liable When an AI Clinical Decision Support Tool Contributes to a Misdiagnosis or Adverse Patient Outcome?

No. FDA clearance addresses product safety: it documents that the AI tool performs within acceptable parameters on the vendor's dataset. It doesn't address how the tool performs on your patient population, whether your staff was trained appropriately, or whether your organization met its institutional duty of care. Those are separate questions that FDA clearance doesn't answer. Organizations that treat FDA clearance as a substitute for local validation and governance documentation are making an assumption that plaintiffs' experts will challenge directly.

In practice, no. Vendors draft their contracts specifically to limit this. Most AI vendor contracts cap liability at a fixed amount, often tied to the annual contract value, and include indemnification language placing deployment risk on the customer. Some contracts include limited warranties that the tool performs to specification, which may create narrow vendor exposure in product defect scenarios. But that's a narrow protection in a specific fact pattern. Assume the liability gap is yours to manage through governance, because the contract almost certainly won't fill it.

Yes, under current malpractice standards. Physicians retain ultimate responsibility for clinical decisions regardless of whether an AI tool influenced them. A clinician who relies on a flawed AI recommendation without applying independent clinical judgment may not have met the standard of care. The standard isn't perfection: it's whether a reasonably competent physician in the same circumstances would have acted differently. The AI tool is treated as decision support that a competent physician is responsible for evaluating, not as an independent decision-maker that shifts accountability.

Automation bias is the tendency to over-rely on automated recommendations and reduce independent critical evaluation of AI output. It's one of the most common contributing factors in current AI-related malpractice claims because it represents a failure mode that governance should have anticipated and addressed. Provider failure to question or override AI-generated suggestions when clinical judgment indicated a different course is the specific pattern. Organizations that train staff on AI limitations, document known failure modes, and establish clear override protocols are addressing automation bias directly. Organizations that don't are leaving a predictable gap in their duty of care.

OCR enforcement is the specific risk channel. Algorithmic bias that produces disparate impact on patients based on race, disability, or other protected characteristics can be pursued under existing civil rights and non-discrimination laws, independently of any individual patient malpractice claim. This is an institutional liability that operates outside the traditional malpractice framework. It requires its own governance response: bias testing and monitoring before and after deployment, not just clinical performance validation. The Optum racial bias case showed that a biased algorithm can be in wide deployment for years before the pattern is detected, and the detection in that case came from external researchers, not from the organization's monitoring.

Most current policies don't clearly address it. Malpractice insurance language largely predates widespread clinical AI deployment, and AI-related incidents often don't fit cleanly into existing coverage categories. Some insurers have begun asking about AI use on applications and introducing AI-specific policy language. Review your current coverage with your insurer and broker: not whether you're generally covered, but whether AI-related incidents specifically are addressed. The gap in coverage language is its own risk management issue, separate from the underlying AI liability exposure.