When an Administrative AI Supplier Takes on a Clinical Function

Follow the Function Beyond the Contract Label

The board should ask what an outsourced agent now does, not merely what procurement called the service. Scheduling, documentation, benefits administration, and patient communication can expand into prioritization, recommendations, or decisions affecting care. The relevant boundary follows the actual function and consequence.

MHRA explains that software meeting a clinical need may fall within medical-device regulation.¹ Qualification depends on the product and intended purpose; this is not a rule that every administrative tool is a device. Management should obtain the appropriate assessment when a service’s function changes.

For a hypothetical scheduling agent, arranging an available appointment differs from interpreting symptoms to decide how urgently a patient should be seen. If the supplier adds the latter capability, the board should expect a new assessment of responsibility, evidence, professional involvement, and patient safeguards.

Identify How the Clinical Boundary Was Crossed

A changed prompt, new data source, additional tool, or revised service target can alter the practical role without changing the contract title. A supplier may describe the update as improved efficiency while it changes who decides the next step in a patient journey.

The study describes processes and organizations not fully adapted to agentic delivery.² It does not establish healthcare harm or device status. The transferable issue is whether the buyer’s governance notices a consequential change in responsibility when the delivery method evolves.

Management should map the original and current workflow. Identify who interprets clinical information, prioritizes patients, makes recommendations, communicates conclusions, and authorizes action. Include informal human correction by provider staff. An operator’s undocumented judgment may be essential to the changed service.

Use a Clinical Boundary Change Record

Figure 1 proposes four questions: what changed, which consequence follows, what assessment is required, and who accepts the new scope. Record the affected patient population, intended purpose, decision authority, evidence, limitations, and operating controls.

The assessment should involve clinical, quality, privacy, security, legal, procurement, and relevant technical owners. It should determine which qualified people must participate and what they must be able to see or override. A nominal reviewer does not solve the issue if the workflow leaves no time or information for meaningful judgment.

FDA and EMA’s joint drug-development principles emphasize defined context of use and assessment of the complete human-AI system.³ Those principles concern drug development, not a direct rule for scheduling. They illustrate why the clinical use context and surrounding human process must be evaluated explicitly.

Apply Local Health and Professional Requirements

EU, UK, Swiss, US, and other healthcare systems differ in medical-device qualification, professional practice, privacy, patient rights, and institutional responsibilities. Management should document the relevant local conclusions rather than extrapolate one jurisdiction’s classification across the service.

The commercial agreement should support disclosure of functional changes, access to necessary evidence, restrictions, correction, and transition. The buyer should not discover the changed scope only after a complaint or safety signal. Require the provider to explain how downstream model or tool changes can affect intended function.

Where the assessment is incomplete, restrict the new capability while retaining any administrative work that remains demonstrably suitable. Preserve a clear route to qualified care and avoid a transition that creates a new access barrier. The response should match the consequence rather than the supplier’s marketing terminology.

Approve the New Function as a New Decision

A reasonable objection is that service improvements would become too slow if every update required board approval. Establish delegated change thresholds. Routine improvements can proceed within a defined scope; changes to clinical purpose, patient consequence, or decision authority should reach the appropriately qualified decision body.

Require management to test the revised workflow with representative and difficult cases, including uncertainty and escalation. Confirm that the clinical and administrative teams can distinguish permitted actions and that patients receive accurate information about the service’s role and limitations.

The board should require a defensible decision on the function the service now performs. An administrative contract is not permanent permission for clinical expansion. Useful innovation can continue when evidence, authority, professional involvement, and local obligations evolve with the service.

Evidence and Source Note

The study is a nonrepresentative cross-section of 850 vendor delivery-team respondents on 150 engagements serving Tier 1 financial institutions, collected during January–June 2026. Neither banks nor vendors corroborated the accounts. It establishes reported experience, not causation, legal breach, or market prevalence. Its application here is a mechanism to investigate, not an estimate of conditions in other industries. The author-supplied version 1.8.2 is dated November 1, 2026 and is cited as a forthcoming manuscript consulted October 23, 2026.⁴

This is an analytical decision paper based on the supplied study and selected primary public sources checked through October 23, 2026. The original contribution is a clinical-boundary change record distinguishing administrative improvements from changes in clinical responsibility and patient consequence. The proposed method has not been independently validated. Legal requirements depend on the entity, activity, jurisdiction, and effective provisions; supervisory observations, research, and professional commentary have distinct authority.

Notes

1. Medicines and Healthcare products Regulatory Agency, “Medical Devices: Software and Artificial Intelligence (AI),” Medicines and Healthcare products Regulatory Agency, updated February 3, 2025, scope of software meeting a clinical need and linked guidance, https://www.gov.uk/government/publications/software-and-artificial-intelligence-ai-as-a-medical-device. ↩
2. Phil Hatch, Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report, version 1.8.2 (Akholi, forthcoming manuscript dated November 1, 2026), Part 2, “The Shift From Managing People to Managing Agents”; Part 6, “The Executive Action Plan”, https://doi.org/10.2139/ssrn.7164559. ↩
3. US Food and Drug Administration and European Medicines Agency, Guiding Principles of Good AI Practice in Drug Development (US Food and Drug Administration and European Medicines Agency, January 2026), principles 2, 4–6, 8–10, https://www.fda.gov/media/189581/download. ↩
4. Hatch, Agentic AI Outsourcing, Introduction, “Executive Summary” and “Evidentiary Basis and Its Limits”. ↩

Bibliography

• Hatch, Phil. Agentic AI Outsourcing at Tier 1 Financial Institutions: Full Study Report. Version 1.8.2. Akholi. Forthcoming manuscript dated November 1, 2026. Author-supplied manuscript consulted October 23, 2026. https://doi.org/10.2139/ssrn.7164559.
• Medicines and Healthcare products Regulatory Agency. “Medical Devices: Software and Artificial Intelligence (AI).” Medicines and Healthcare products Regulatory Agency. Updated February 3, 2025. https://www.gov.uk/government/publications/software-and-artificial-intelligence-ai-as-a-medical-device.
• US Food and Drug Administration and European Medicines Agency. Guiding Principles of Good AI Practice in Drug Development. US Food and Drug Administration and European Medicines Agency, January 2026. https://www.fda.gov/media/189581/download.