Ambient AI Isn’t the Liability. Your Consent Process Is.

Ambient AI scribes have gone from pilot projects to everyday use across health systems in a remarkably short time. They cut documentation time, and many systems that have adopted them report real relief from clinician burnout. That’s the pitch, and it’s a genuine one.

But 2026 has also been the year the technology met the courtroom, and in every case so far, the complaint isn’t about the AI. It’s about what happened, or didn’t happen, in the thirty seconds before the microphone turned on.

The lawsuits, in brief

The first major challenge came in November 2025, when a Sharp HealthCare patient filed a proposed class action in San Diego Superior Court alleging that a 2025 medical appointment was recorded by an ambient AI tool without his knowledge. The complaint’s most damaging allegation wasn’t the recording itself. It was that his chart later contained boilerplate language claiming he’d been “advised” and had “consented,” when he says neither conversation ever happened.

Roughly four months later, three more patients sued Sutter Health and MemorialCare in the Northern District of California over the same underlying pattern: audio captured and sent to a third-party vendor without clear notice or meaningful consent. Both suits lean on California’s Invasion of Privacy Act (CIPA) and Confidentiality of Medical Information Act, statutes built for a wiretap era and now being applied to cloud-based clinical AI. CIPA allows statutory damages of up to $5,000 per violation, and while how a “violation” gets counted in the ambient-scribe context has yet to be settled, plaintiffs in the Sharp case estimate a class of more than 100,000 patients. Even under conservative assumptions, the exposure adds up fast.

California isn’t alone, and the wider signal is that these consent theories are being tested across a growing set of AI voice tools, not just clinical scribes. In January 2026, an Illinois federal court dismissed federal wiretap claims against an AI-enhanced phone system used to record and triage patient calls, finding the technology fell within the Wiretap Act’s “ordinary course of business” exception. That ruling was narrow, and courts elsewhere have allowed similar claims to move forward. Separately, a wave of lawsuits under Illinois’s Biometric Information Privacy Act (BIPA) argues that a person’s voiceprint is protected biometric data that can’t be captured without consent. So far those suits have targeted meeting-transcription tools and voice-AI training, not exam-room scribes, but the underlying theory could apply just as readily to a recorded clinical visit.

Two regulatory responses to the same problem

Interestingly, different jurisdictions are converging on the same fix from different directions.

In the U.S., the response has mostly come through litigation and, more recently, statute. Texas’s Responsible AI Governance Act, effective January 1, 2026, now requires healthcare providers to disclose their use of AI to patients in plain language before or at the time of care, codifying what careful clinicians were already doing voluntarily. Roughly a dozen U.S. states also carry all-party consent recording laws, meaning a health system operating across state lines can be fully compliant in one market and legally exposed in the next using the exact same workflow.

In Canada, the pressure is coming from regulators and medical bodies rather than plaintiffs’ attorneys. The Canadian Medical Protective Association, Ontario’s Information and Privacy Commissioner, BC’s OIPC, Alberta’s OIPC, and provincial colleges have all issued 2025 and 2026 guidance converging on the same baseline: general intake consent doesn’t clear the bar for ambient AI, patients need plain-language disclosure of privacy and accuracy risks before recording starts, and a documented refusal must never be inferred from silence.

Different enforcement mechanism, identical root cause: consent captured verbally, inconsistently, and after the fact, if it’s captured at all.

What these frameworks actually demand

Strip away the jurisdiction-specific statute names and four requirements show up everywhere:

1. Consent before the recording starts. Not a script recited mid-visit, and not a general registration waiver signed months earlier.
2. Plain language the patient can actually understand, with the ability to ask questions or read further before signing, not a dense legal paragraph buried in intake paperwork.
3. Disclosure of privacy and accuracy risks, including that audio may be processed by a third-party vendor. Consistent every time, regardless of which clinician is in the room.
4. A documented, revocable, retrievable decision. Proof that a patient said yes or no, not a system-generated note asserting that they did.

That fourth point is exactly where the current lawsuits are strongest. A checkbox that logs “consent obtained” isn’t consent. It’s a record that something was supposed to happen. When that field auto-populates regardless of what actually occurred in the room, it doesn’t just fail to protect the health system; it becomes the plaintiffs’ best exhibit.

There’s also a quieter risk running underneath all of this: consent processes built only for English-speaking, non-disabled patients. Ambient scribe rollouts have often moved faster than the language-access and disability accommodations that meaningful consent requires, and that gap is itself a foreseeable future claim, separate from the wiretap and privacy theories driving today’s suits.

Where the exposure actually lives

None of this is an argument against ambient AI. The clinical and burnout case for it is real. The exposure sits specifically in the gap between “we deployed the tool” and “we can prove, for every patient, that they understood what was happening and agreed to it before it happened.”

That’s a solvable problem, and it doesn’t require ripping out a scribe vendor or slowing down a rollout. It requires treating consent as its own governed workflow: captured digitally, before the visit, in plain and multilingual language, standardized across every clinician and site, and archived in a form that can be produced on demand rather than asserted after the fact.

That’s the layer Interlace Health’s Nova Informed Consent is built to handle. It captures a patient-signed, timestamped authorization during pre-registration and intake, configurable to the specific privacy and accuracy language your counsel and privacy office approve, and retrievable the moment a patient, a regulator, or opposing counsel asks for it. It isn’t a replacement for your privacy program, your vendor’s security controls, or your clinicians’ review of every AI-generated note. It closes the one gap that keeps showing up, jurisdiction after jurisdiction, at the center of every current claim.

---

Informational only; not legal advice. References pending litigation and regulatory guidance that continue to evolve; details may change as cases proceed. Confirm current requirements with your legal and privacy counsel.