Medicine's top safety hazard for 2026 is your diagnostic model, and nobody flinched

On 9 March 2026, ECRI, the Pennsylvania-based patient safety nonprofit that has been ranking healthcare hazards since the Carter administration, published its annual Top 10 Patient Safety Concerns and placed the risk from artificial intelligence in clinical diagnosis at number one ^[1][2]. According to the dev.to account of the release, the response was a press release and a few trade-press write-ups: no congressional hearings, no rolling news coverage, no agency statements promising action ^[3].

The scope of what ECRI named matters more than the ranking. It was not the consumer chatbots patients use at 3am, and not the ambient scribes that draft notes from consultation audio. It was the diagnostic systems already sitting inside hospital workflows: models reading mammograms, screening chest X-rays for nodules, flagging deteriorating inpatients, routing radiology priorities, and drafting preliminary impressions that a busy specialist either confirms or ignores ^[4].

The language was closer to a risk register than a manifesto. ECRI called for no moratoria and named no vendors ^[5]. It asserted three things: that diagnostic AI deployed without rigorous oversight raises the risk of missed, delayed, or incorrect diagnoses; that training data can encode bias; and that clinicians are subject to automation bias, the documented tendency to defer to a confident-sounding machine that is wrong ^[6]. The dev.to piece reads this as an accountability vacuum, with clinical AI arriving faster than the legal, regulatory, and institutional machinery to govern it ^[7].

That is the operationally useful part. Automation bias means your model's failure mode is not a wrong output; it is a wrong output that a clinician signs. Which puts the burden squarely on the deployment site, and that is where the evidence is thinnest. The State of Clinical AI 2026 report, published two months earlier in January by a group convened across Stanford and Harvard and their affiliated health systems and led by Peter Brodeur, Ethan Goh, Adam Rodman, and Jonathan H. Chen, argues that clinical AI is already embedded in care and that the open question is whether the institutions deploying it can evaluate it honestly ^[8][9]. Its authors draw the distinction that should govern procurement: the gap between controlled-study performance and behaviour once a system is wired into a teaching hospital, a community clinic, or a rural primary care practice ^[10].

The volume explains the silence. By the early months of 2026 the FDA had authorised more than 1,350 AI-enabled medical devices, roughly double the 2022 figure ^[11], which puts the 2022 baseline near 675 ^[1]. You do not convene hearings about a category that has already been cleared into daily use twice over. The regulatory pressure is arriving elsewhere: the EU AI Act, in force in stages since February 2025, classifies almost every clinical AI system as high-risk and brings its full enforcement regime to bear in August 2026 ^[12], about five months after ECRI's warning ^[2]. The UK's MHRA has been running its AI Airlock pilot since April 2024 and is expected to publish a new framework for AI in medical devices during 2026 ^[13].

So the finding for anyone shipping clinical decision support is not that regulators are coming for you. It is that the most authoritative threat list in American medicine ranked your product category first and the market did not blink, which means the constraint will not arrive as a ban. It will arrive as an evidentiary burden at procurement, and as an unresolved question about who owns the error.

Watch the August 2026 EU enforcement date for changes in hospital contract language on high-risk classification ^[12], and whether the MHRA framework lands inside 2026 as expected ^[13].