AI in medicine: CFM resolution comes into force, but doubts remain

Resumo

A entrada em vigor da Resolução CFM nº 2.454/2026, que regula o uso da inteligência artificial na prática médica no Brasil, estabelece parâmetros para o uso da IA pelos médicos, ao mesmo tempo em que levanta questões sobre a implementação e os limites da competência normativa do Conselho Federal de Medicina. Este artigo discute a interação entre a resolução e o marco legal brasileiro mais amplo, incluindo proteção de dados, direitos dos pacientes e a regulamentação de software como dispositivo médico. Também destaca desafios práticos relacionados à informação do paciente, consentimento, responsabilidade, auditoria, transparência e alfabetização em IA.

Palavras-chave: Inteligência Artificial; Coordenação e Monitoramento de Cuidados de Saúde; Legislação de Dispositivos Médicos; Autonomia Pessoal, Brasil.

1. Introduction

As of August 26, the rules of CFM Resolution No. 2,454/2026 [1], which regulates the use of artificial intelligence (AI) in medicine, has been in force. The rule is based on a reality already observed in practice: artificial intelligence is no longer an abstract technology and has become part of people’s daily lives, including the practice of medicine.

In this context, the Federal Council of Medicine (CFM) chose to regulate the use of AI in medical practice, establishing parameters for its application. The entry into force of the rule, however, raises issues that go beyond its content, especially regarding the practical application of the rules and the limits of the Council’s normative competence.

• Regulatory competence and fragmentation

The CFM’s competence to discipline the performance of physicians is provided for in Law No. 3,268/1957 [2], which assigns to it the function of supervising professional ethics and disciplining the medical profession (art. 2). The issue lies within the limits of this competence when the resolution starts to deal not only with the performance of the physician, but with the technology itself, establishing parameters for governance, auditing, development, and management of AI systems.

The scenario is even more complex in the absence of general legislation on artificial intelligence in Brazil. The topic is also being addressed at the federal legislative level through Bill No. 2,338/2023 [4], which aims to establish a general framework for the development and use of AI systems in Brazil. While the legislative process is ongoing, specific sectors are beginning to issue their own rules on the use of technology, as occurred in medicine.

There is, therefore, the risk of regulatory fragmentation, with different agencies issuing rules on the same technology even before the legislator defines the general parameters for its use in the country.

• Interaction with the health regulatory framework

CFM Resolution No. 2,454/2026 does not exclude the application of other rules applicable to the use of AI in health. The LGPD [3], the Statute of Patients’ Rights [6], and other applicable legal rules prevail over the resolution, which must be interpreted within the limits established by the legislation.

In the health field, Anvisa’s regulation may also apply when the solution falls under the scope of software as a medical device (SaMD), under the terms of RDC No. 657/2022 [5]. The standard considers SaMD to be software that, independently, is intended by the manufacturer to perform one or more medical functions, such as diagnosis, prevention, monitoring, treatment, or relief of disease, injury, or disability, and may be classified as a medical device even if it is not integrated or used in conjunction with a physical device. In this context, the regulatory framework does not result only from the technology used, but, above all, from the purpose intended by the manufacturer and the functions assigned to the software.

• Patient autonomy and information

Another element that must be considered is the patient. The Statute of Patients’ Rights [6] reinforces the right to information and participation in decisions related to one’s own care. From the bioethical perspective, autonomy occupies a central position and presupposes that the patient is able to understand the relevant information to participate in decisions about his or her health.

In this context, it is not enough to inform that an AI was used. It is necessary to consider, as the case may be, what the technology was used for, what its role was in decision-making, and what its limits are. The information should allow the patient to understand how the technology participated in their care and to exercise their autonomy effectively.

The use of AI, therefore, does not remove the duties of information, consent, and respect for the patient’s autonomy. On the contrary, it makes it even more relevant to define what should be informed and what level of information is necessary.

• Practical Challenges

Most of the challenges, however, will emerge in the practical implementation of the regulation. Several questions remain relevant: When should patients be informed about the use of AI? What level of information should be provided? How should the use of AI be documented in the medical record? How will the systems be audited? Who will have access to the data used by the tool? How will any biases and errors be treated? How far does the doctor’s responsibility go and where does the developer’s or supplier’s responsibility begin? How to reconcile transparency and explainability with the protection of trade secrets?

These issues show that the resolution establishes parameters, but does not end the discussion. On the contrary, it inaugurates a regulatory agenda that will need to accompany the incorporation of technology into medical practice.

• AI literacy

There is also a challenge that no single standard will be able to solve: artificial intelligence literacy. Doctors need to understand not only how to use these tools, but also their limits, risks, biases, and possibilities for error. Patients, in turn, need to understand when and how AI participates in their care, what its role is, and what the limits of this use are.

It is not enough to regulate artificial intelligence if those who use it and those on whom it produces effects do not understand how this technology works and what its limits are. The effectiveness of regulation will also depend on the ability of doctors and patients to understand, question, and use this technology responsibly.

• Conclusion

The entry into force of CFM Resolution No. 2,454/2026 represents a significant step in the regulation of AI in medical practice, but it does not resolve the broader legal and regulatory questions raised by the incorporation of AI into healthcare. The practical application of the resolution will require careful coordination with the existing legal framework, including data protection, patients’ rights, and, where applicable, the regulation of software as a medical device.

At the same time, the limits of the CFM’s normative competence deserve continued legal attention, particularly where regulation of medical conduct intersects with requirements concerning the governance, development, auditing, and management of technology. The next stage of AI regulation in medicine will therefore depend not only on formal rules, but also on their practical implementation, institutional coordination, and the ability of health professionals and patients to understand and critically engage with AI systems.

• References

[1] BRAZIL. Federal Council of Medicine. Resolution No. 2,454, of 2026. Regulates the use of artificial intelligence in medical practice. Brasília, DF, 2026.

[2] BRAZIL. Law No. 3,268, of September 30, 1957. Provides for the Councils of Medicine and other measures. Brasília, DF, 1957.

[3] BRAZIL. Law No. 13,709, of August 14, 2018. General Data Protection Law (LGPD). Brasília, DF, 2018.

[4] BRAZIL. Bill No. 2,338, of 2023. Provides for the development, implementation and responsible use of artificial intelligence systems. Federal Senate, Brasília, DF, 2023.

[5] BRAZIL. National Health Surveillance Agency (Anvisa). RDC No. 657, of March 24, 2022. Provides for the regularization of software as a medical device (Software as a Medical Device – SaMD). Brasília, DF, 2022.

[6] BRAZIL. Law No. 15,378, of April 6^th, 2026. It establishes the Statute of Patient Rights. Brasília, DF, 2026