On February 27, the Federal Council of Medicine (CFM) published Resolution No. 2.454/2026, which for the first time regulates the use of artificial intelligence in Brazilian medicine. The news is not that AI has arrived — it is already in 17% of medical offices, according to the TIC Saúde 2024 survey. The news is that there is now a legal framework separating what is an administrative tool from what is a medical decision.

Scheduling and queue organization are low risk

The resolution adopts four classification levels. At the lowest level are administrative functions: appointment scheduling, queue organization, reminders, confirmations, and rescheduling. Systems that do this do not affect clinical decisions and do not require constant medical supervision. The CFM is saying, in other words, that automating the front desk is not medical practice — it is management.

This matters because it clears the regulatory fog that many clinic managers felt. "Can I use a WhatsApp bot to confirm appointments?" The answer, now explicit, is yes. The resolution takes effect in 180 days (August 2026), but the classification already guides anyone evaluating tools today. For those running a small clinic or a medical office, the message is clear: tools that only touch scheduling and communication with the patient do not fall within the radar of regulated medical practice.

What rises in risk requires supervision

At the middle level are triage systems, list prioritization, and protocol suggestions — all with constant human supervision. At high risk are systems that execute critical medical decisions with the potential to cause physical, psychological, or moral harm. Does the AI communicate diagnoses or courses of action directly to the patient? The resolution prohibits it. The physician remains ultimately responsible for any clinical, diagnostic, or therapeutic decision.

The design is clear: AI is a support tool, never a substitute. Institutions that use their own AI systems must create AI and Telemedicine Committees for auditing. Oversight is the responsibility of the Regional Councils of Medicine. The text also guarantees physicians the right to refuse systems without adequate scientific validation and to preserve their professional autonomy — an important safeguard when the pressure for "productivity" tries to push questionable tools.

Why this matters for the small clinic

Small clinics and medical offices rarely develop their own systems. They consume third-party technology. The resolution does not require every office to have a committee — that applies to hospitals and institutions with their own systems. What applies to everyone is the classification: if you use a tool that only schedules, confirms, and reminds, you are in the low-risk category.

The practical impact is measurable. Patient no-shows can compromise up to 32% of the schedule in some clinics, according to estimates from tools such as the Conclínica No-Show Calculator. Automatic reminders via WhatsApp reduce no-shows by up to 40%, with an open rate above 90% — email does not come close. None of these systems decides a diagnosis or course of action — they free the front desk for what really matters.

The timing is favorable

The resolution arrives at a moment when Amazon has just launched Amazon Connect Health (March 2026), a platform that automates scheduling, compilation of patient histories, and medical coding, operating 24 hours a day. The healthcare administrative automation market is heated. The difference is that there is now an objective criterion for knowing where your tool fits — and for communicating that clearly to physicians and managers who still view AI with distrust.

For the clinic manager who is still hesitating: the regulatory doubt has diminished. Scheduling and confirmation tools are explicitly in the low-risk category. What remains mandatory is data protection — LGPD, legal bases, governance — but that was already the case before the resolution. In 2026, the ANPD gained regulatory agency status with reinforced autonomy, and the healthcare sector is among the priority topics of the ANPD Map for the two-year period. In other words: data privacy remains high on the agenda. The CFM resolution does not replace the LGPD; it complements it, focusing on what is specific to medical practice.

What to do in practice

If you use or are evaluating an AI tool for your clinic, check which category it falls into. Scheduling, confirmation, reminders, rescheduling? Low risk. Protocol suggestions or triage with supervision? Medium. Automated diagnostic or therapeutic decision? High. The resolution does not prohibit anything — it demands transparency, auditing, and responsibility proportional to the risk. Software used as medical devices remains subject to Anvisa approval; the CFM resolution addresses use in clinical practice.

The CFM is not blocking innovation. It is providing a map. Those who automate the front desk can move forward with more confidence. Those who want to go further need proportional structure. For most Brazilian clinics — where the physician is often also the manager — the message is one of relief: you can use AI for what it does well, without fear of crossing a line that no longer exists in an ambiguous form.

Want to see how it works in your clinic? Try it free for 10 days at simplafy.com.br/saude — no credit card required.

References used to produce this content: