AI for Healthcare and Life Sciences
The sector where a model's error has a clinical consequence, a regulator and a legal record. Fourteen verticals, each written for the person who signs off the deployment rather than the person who demonstrates it.
Nothing here fails quietly.
Healthcare is the sector where the gap between a model that scores well and a model that helps is widest, and where the cost of confusing the two is highest. A retail recommender that misfires loses a sale. A deterioration model that misfires either misses a patient or floods a ward with alerts until the staff learn to ignore it, which is worse than not deploying it at all, because now the alarm carries no information.
So the evidence bar is different, and it is different in a specific way: retrospective performance on your own data predicts almost nothing about prospective performance in your own workflow. The literature is full of models that validated beautifully and then failed in deployment. That is not a reason to avoid the work. It is a reason to design the evaluation before the model, to insist on prospective silent-mode running before anything reaches a clinician, and to treat a supplier who will not do that as a supplier with something to hide.
Where AI actually earns its place in healthcare
Ranked by how much published evidence exists rather than by how much attention it gets. The maturity column is our own read and we will argue for it; the catch column is the part most suppliers leave out of the deck.
| Where | What it does | Maturity | The catch |
|---|---|---|---|
| Imaging triage and detection | Flags likely findings on radiology, pathology and ophthalmology images so the worklist is ordered by urgency. | Proven | Roughly three-quarters of FDA-authorised AI devices are radiology, so the tooling is real — but performance drops on scanners and populations unlike the training set. |
| Ambient clinical documentation | Drafts the note from the consultation so the clinician edits rather than types. | Proven | Measured time savings are real but modest, and they show up as less after-hours work rather than as more patients seen. Sell it as burnout relief, not capacity. |
| Document and coding automation | Extracts structured data from referrals, prior authorisations, lab reports and claims. | Proven | The exception rate, not the accuracy rate, determines whether it saves anyone time. Ninety-five per cent accurate means one in twenty needs a human anyway. |
| Operational forecasting | Predicts admissions, theatre over-runs, no-shows and staffing demand. | Strong | Value depends entirely on whether anyone can act on the forecast. A perfect prediction that arrives after the roster is fixed is a report, not a decision. |
| Clinical deterioration and risk prediction | Scores inpatients for sepsis, deterioration, readmission or deconditioning. | Mixed | The most over-sold category in the sector. Widely deployed proprietary sepsis models have externally validated far below their vendor-reported figures. |
| Drug discovery and target identification | Narrows candidate space, predicts structure, optimises leads. | Mixed | Real acceleration in early discovery; no demonstrated improvement in late-stage clinical success, which is where the money is lost. |
| Patient-facing conversational systems | Triage, symptom checking, appointment handling, medication questions. | Early | Safe for logistics and scheduling; a regulated activity the moment it edges toward advice, and the boundary is easier to cross than teams expect. |
| Autonomous clinical decision-making | Systems that decide rather than suggest. | Not ready | We do not build these, and we would want to see far more prospective evidence than currently exists before anyone should. |
The one number worth carrying into every vendor meeting
A widely deployed proprietary sepsis prediction model, externally validated across 38,455 hospitalisations, achieved an AUC of 0.63 and missed 67 per cent of sepsis patients while generating alerts on 18 per cent of all admissions — against a substantially better figure reported by its vendor. That is not an argument against clinical prediction. It is an argument for insisting on external, prospective, site-specific validation before deployment, and for treating any performance number you did not generate on your own patients as marketing. See model monitoring and drift detection.
Four regulatory regimes, and they do not align
Healthcare AI sits at the intersection of medical device law, data protection, sector-specific health rules and now general AI regulation. They were written at different times by different bodies and they overlap awkwardly. This is our reading as at September 2026 and we work alongside your regulatory and legal teams rather than in place of them.
High-risk by two routes
AI that is a medical device, or a safety component of one, requiring notified body assessment under MDR or IVDR is Annex I high-risk — obligations apply from 2 August 2028 after the Digital Omnibus extension. Separately, AI used for health and life insurance pricing and risk assessment is Annex III high-risk, from 2 December 2027. Administrative AI — scheduling, rostering, billing — is generally outside both.
Not replaced, added to
The AI Act complements device law rather than superseding it. In practice that means two documentation sets that must agree: ISO 13485 quality management alongside AI-specific data governance, and ISO 14971 risk management extended to cover algorithmic bias, model drift and adversarial inputs. Clinical evaluation under MDR does not discharge Annex IV AI documentation.
PCCP final, lifecycle guidance still draft
The predetermined change control plan pathway is finalised and in force: you may specify in advance which model changes you can make without a new submission, provided the change types, validation protocol and performance boundaries are precise. Vague change descriptions are rejected. The January 2025 lifecycle-management draft remains draft. QMSR, aligning US requirements with ISO 13485, took effect 2 February 2026.
GDPR, HIPAA and what is coming
Special-category data under GDPR; PHI under HIPAA, whose Security Rule modernisation — multi-factor authentication, asset inventory, mandatory encryption — is now expected around July 2027 rather than sooner. The European Health Data Space entered into force in March 2025 with secondary-use provisions mostly applying from March 2029.
Moving faster than the federal layer
Seven states now require a licensed clinician rather than an algorithm to make an adverse medical-necessity determination — California, Texas, Maryland, Nebraska, Arizona, Washington and Alabama, with dates running from January 2025 through October 2026. New York requires disclosure when a patient is interacting with AI. If you operate across states, the strictest applicable rule is the practical design constraint.
The regime nobody legislates
Your own clinical safety process — hazard logs, clinical safety officer sign-off, incident reporting — is frequently the binding constraint long before any regulator is. It is also the one most often discovered late, after the model is built. We ask about it in week one.
What this means for a build
If your system is a device, the AI Act obligations are engineering requirements, not paperwork: logging, human oversight design, data governance and post-market monitoring have to be in the architecture from the first sprint because retrofitting them is a rebuild. If it is administrative, most of this does not apply and you should not let a supplier tell you otherwise in order to sell a compliance workstream. Working out which of the two you have is the first thing we do — see EU AI Act compliance readiness and AI risk assessment.
Who we write for
Each page starts from that organisation's own problems, names the regulatory exposure it carries, and routes into the engineering. Depth varies and is stated on each page.
Hospitals & health systems
Imaging triage, ambient documentation, patient flow forecasting and coding — with clinical safety governance built in rather than added.
Read more →Clinics & private practice
Documentation, scheduling and patient communication — where buying the product usually beats building one.
Read more →Telemedicine
Intake, routing and documentation for virtual care — with the line between routing and regulated triage drawn precisely.
Read more →Pharmaceuticals
Evidence synthesis, regulatory documents, pharmacovigilance and commercial analytics — plus an honest read on discovery.
Read more →Biotechnology
Experimental data infrastructure, screening analysis and phenotyping — starting with reproducibility, which is usually the actual problem.
Read more →Medical devices
Model development under device regulation — PCCPs, Annex I readiness, and monitoring designed for the submission.
Read more →Clinical research / CRO
Recruitment, monitoring risk signals, data management and document production — under GxP, with the audit trail built in.
Read more →Health insurance & payers
Claims, fraud detection, care management and risk adjustment — with the automated-denial line drawn where the law draws it.
Read more →Diagnostics & pathology labs
Digital pathology, autoverification and lab quality control — with scanner and stain variability treated as the main engineering problem.
Read more →Mental health
Administrative and measurement support for mental health services — with therapeutic interaction firmly out of scope.
Read more →Dental
Radiograph analysis, recall and claims — where DSO scale changes the build-versus-buy answer.
Read more →Veterinary
Documentation, imaging support and client communication — lighter regulation, and much less data than human healthcare.
Read more →Elder & home care
Rostering, routing and care documentation — where the scheduling problem is real and the monitoring question is ethical.
Read more →Medical billing & RCM
Coding support, denial prediction and appeal generation — with the compliance line on upcoding drawn explicitly.
Read more →FAQ
Marked up with FAQPage schema so these answers can surface in search results and inside AI assistant responses.
Do you have healthcare experience?
Yes in imaging, document and coding workflows, operational forecasting and clinical data engineering. Less in genomics, and none in regulated device submissions as the manufacturer of record — on that we work alongside your regulatory team and your notified body rather than replacing them. Each of the fourteen vertical pages states our depth in that specific area rather than implying uniform expertise across the sector.
Is our AI system a medical device?
It depends on intended purpose, not on technology. Software that diagnoses, screens, monitors, predicts or treats is generally a device; software that schedules, rosters, bills or summarises for administrative purposes generally is not. The boundary is narrower than teams expect — a triage tool that prioritises a worklist may cross it depending on claims made. Settle this in week one with your regulatory team, because it determines the entire shape of the build.
How do we know a model will work on our patients?
You do not, until you run it on your patients. Published performance transfers poorly across sites: different case mix, different scanners, different coding practice, different documentation habits. Every engagement we run includes a site-specific retrospective baseline followed by prospective silent-mode running, where the model produces predictions nobody acts on and we measure against what actually happened. If a supplier will not do that, the honest reading is that they are not confident it will survive it.
Can we use patient data to train a model?
Sometimes, and the constraint is usually legal basis and governance rather than technology. De-identification is weaker than most teams assume for rich clinical data, especially imaging and free text. Depending on the case the answer may be a data-sharing agreement with a defined purpose, a federated approach where data does not move, or synthetic data for development with real data reserved for validation. See AI data privacy compliance.
What is the most common way healthcare AI projects fail?
Not modelling. The project builds something accurate that nobody has agreed to act on. There is no clinical owner, no agreed threshold, no plan for what happens when it fires at 3am, and no one has asked the nurses whether they will look at it. We front-load that question — who acts, on what, and what happens when it is wrong — before any model is trained, and we have recommended stopping at that point more than once.
Start with the problem, not the technology.
Thirty minutes, no charge, no deck. Tell us what is going wrong in your organisation and we will tell you whether AI is the right instrument — including when it plainly is not.