Regulators’ Enforcement: The New AI Safety Standard

The world of AI in healthcare moves so fast that regulations can’t keep up. For compliance officers and people running telehealth platforms, this creates a serious problem. We’re all trying to figure out safety standards that aren’t being defined by pre-market reviews, but by post-market enforcement actions. We’re watching the obligations for responsible AI get written in public, usually through fines and corrective orders instead of proactive guidance.

The Cerebral Enforcement Record: A Case Study in Post-Market Standard Setting

Look at what happened with Cerebral. It’s a perfect, recent example of safety standards being set by enforcement instead of through some traditional clearance pathway. The moves made by the Federal Trade Commission (FTC) and Department of Justice (DOJ) against Cerebral created obligations that no prior clearance letter ever spelled out. Specifically, the FTC’s Health Breach Notification Rule became the hammer for data privacy issues, and the DOJ’s enforcement on controlled substances set hard guardrails for how telehealth platforms can handle prescriptions. Cerebral ended up paying over $3.6 million for practices that led to the unauthorized distribution of controlled substances between 2019 and 2022. It stopped prescribing controlled substances to anyone in October 2022 and agreed not to do so in the future. On top of that, a proposed government order would have Cerebral pay about $5 million back to consumers and face a $10 million civil penalty, though that was suspended down to $2 million because of the company’s limited ability to pay. This wasn’t guidance handed down ahead of time. It was a line drawn in the sand after the fact, making the Cerebral case a foundational entry in the growing log of AI health failures. The story here isn’t about scandal. It’s about sequence, how thin regulatory oversight suddenly got very solid after the product was already out there.

Why Obligations Arrived Outside Traditional Review

So why did these rules show up via enforcement and not a formal review process? The main reason is the nature of a lot of these consumer-facing health AI services. They aren’t always Software as a Medical Device (SaMD) that has to go through the FDA’s tough 510(k) clearance or De Novo classification. Many telehealth platforms and AI wellness apps operate in a grey area, not clearly falling under the FDA’s definition of a medical device. The distinction between Clinical Decision Support (CDS), which just gives recommendations, and diagnostic AI, which makes a call on its own, really matters here. An AI service that’s just providing general wellness tips or helping a clinician without making the final diagnosis might sidestep that intense pre-market scrutiny. As the regulatory commentator Scott Gottlieb has pointed out, enforcement actions are a pretty good signal of where oversight used to be too weak. Telehealth exploded during the pandemic, and the rush to integrate AI tools meant services could scale up incredibly fast, sometimes without thinking through the full regulatory consequences of how they operated. When platforms like Cerebral started dealing with sensitive health data and controlled substances, other agencies (specifically the FTC and DOJ) had to step in and define the rules of the road. It shows a real gap. The FDA’s CDRH is busy managing the device side of things, overseeing AI as SaMD with frameworks like the PCCP (Predetermined Change Control Plan) and GMLP (Good Machine Learning Practice), but the job of policing the larger care platform often falls to other agencies that speak through corrective actions. The FDA did issue its final guidance on Predetermined Change Control Plans in August 2025 and on Cybersecurity in Medical Devices in February 2026, which helps solidify its side of the field. FTC Health Breach Notification Rule guidance

The Peer Set: Woebot Health and 23andMe in the Same Sequence

Cerebral isn’t alone. It’s part of a clear pattern where consumer-facing digital health companies run into regulatory questions well after they’ve launched. Woebot Health and 23andMe are right there in the same boat. While the details of their regulatory run-ins are different, the story is the same: safety and compliance questions didn’t get serious attention from regulators until after these services were already being used by millions. Woebot Health, which makes AI-powered mental health chatbots, has been trying to figure out its place as a digital therapeutic. It’s a tough spot to be in. The company actually shut down its consumer-facing app on June 30, 2025, and shifted its business to enterprise, health-system, and insurer deals, saying the evolving FDA regulatory expectations made it too hard to keep a consumer product going. But it’s still in the game, having received an FDA Breakthrough Device designation in January 2026 for adolescent depression, which followed a similar designation for postpartum depression back in May 2021. The line between a wellness app and a regulated medical device is often blurry, and the actual effectiveness and safety of these AI tools are under constant regulatory watch. Can an AI chatbot really provide enough clinical oversight? What happens to all that sensitive mental health data? And how do you stop the algorithm from drifting over time? These are the big questions. 23andMe, the direct-to-consumer genetic testing company, has had its own regulatory battles, especially around how it explained health-related genetic risks. The FDA stepped in early on to define what was a diagnostic claim versus just general health info. More recently, 23andMe had a massive data breach in October 2023 that hit about 6.9 million customers. That led to a $46.75 million class-action settlement for US customers (approved in January 2026) and another $18 million settlement with 41 states and D.C. over its weak cybersecurity. California filed its own lawsuit in May 2026, and the UK’s Information Commissioner’s Office fined the company £2.31 million in June 2025. By March 2025, 23andMe had filed for Chapter 11 bankruptcy, and its assets, including all that genomic data, were sold to TTAM Research Institute, a nonprofit started by its former CEO. This was yet another standard that got set through post-market regulatory action, proving that for some consumer health tech, the regulatory story starts with deployment and is written through enforcement. FDA guidance on direct-to-consumer genetic tests For compliance officers, these cases show you have to do proactive risk assessment, even if your service doesn’t look like a traditional medical device at first. The FTC has a long reach when it comes to data privacy under HIPAA and consumer protection, and it applies these rules consistently to health services. If you don’t see these broader regulatory issues coming, you can get hit with major enforcement actions that end up defining the safety standard through penalties.

The Standard Written Through Enforcement

The enforcement against Cerebral, Woebot Health, and 23andMe is creating a de facto safety standard. It might not be written down in any pre-market guidance document, but it demands that telehealth operators and compliance officers pay attention to a few things: 1. Data Privacy and Security are Everything: The Cerebral case makes it crystal clear that the FTC’s Health Breach Notification Rule is no joke. Strong data security and transparent breach notifications are non-negotiable. The FTC updated this rule in 2024 to specifically cover health apps and connected devices, then rescinded an older 2021 policy statement in September 2026 because the new rule made it redundant. Any AI health service that handles personal health information (PHI) has to operate with HIPAA-level diligence, period, regardless of whether it’s technically a covered entity. This includes all your third-party vendors and the entire data chain. Plus, HIPAA itself is getting updated in 2026, with tougher requirements for both the Privacy and Security Rules and shorter deadlines for PHI access. HIPAA compliance guidelines

1. Clinical Oversight and Proper Use of AI: If your service involves diagnosis, treatment, or prescriptions, the standard for clinical validation and oversight is sky-high. The DOJ getting involved with Cerebral over controlled substances shows that you can’t just let AI run on its own. Human clinical judgment and real medical protocols have to be at the center of the process, especially when patient safety risks are high. AI augments, not replaces, responsible medical practice.
2. Transparent, Truthful Advertising: The FTC is a consumer protection agency first. That means any claims you make about your AI’s capabilities, effectiveness, or safety have to be accurate and backed up with real proof. Saying your AI has amazing diagnostic accuracy or provides therapeutic benefits without strong clinical evidence is a huge compliance risk.
3. Proactive Regulatory Engagement: Your direct-to-consumer health AI might not fit into a neat FDA device category right now, but you should still build it with the principles of responsible AI in mind (like GMLP). You have to assume that as your service grows and has a more direct impact on patients, regulatory scrutiny will get more intense, and standards will be created or applied retroactively. In the end, when formal regulatory review is late to the party, enforcement actions write the rules. For compliance officers and telehealth operators, that means you have to watch enforcement trends, understand that agencies like the FTC and DOJ have real power, and build responsible AI practices from day one instead of waiting to be told. The stories of Cerebral, Woebot Health, and 23andMe are the new playbook for how AI healthcare regulation is taking shape.