Assistive, medium risk
and with the physician in control
Laudos.AI is not SaMD (Software as a Medical Device). We developed the control matrix to support the applicable requirements of CFM Resolution 2.454/2026, without replacing the institution's assessment or medical responsibility.
The regulatory pillars
Medium risk
Canonical public classification. The physician provides the findings, reviews, edits, validates and signs in the official system.
- AI suggested · 14:02:11Physician edited · 14:02:39Signed · 14:02:58 · log recordedNOT SaMD
Writing support, not clinical decision-making
The platform does not interpret images, does not make autonomous diagnoses, and does not sign or release reports autonomously.
- RESPONSIBILITY
Mandatory human supervision
Final responsibility for the content, the clinical decision and the signature remains with the licensed professional.
Requirement, control and evidence
The CFM published Resolution 2.454/2026 on 02/27/2026. It has been in force since 08/26/2026. The matrix below shows how the product's controls support institutional governance. It does not replace the legal, regulatory and clinical assessment of each context of use.
| Requirement | Product control | Available evidence |
|---|---|---|
| Human supervision | Mandatory review, editing and signature by the physician | Editor workflow and log per exam |
| Auditability | Event per exam, user and model version | Audit trail export |
| Transparency | Documented purpose, limitations and assistive role | Deployment documentation |
| Usage record | Record of AI support linked to the report | RIS integration and exam audit trail |
| Monitoring | Production metrics and periodic performance review | Reports and public benchmark (LaiBench) |
What CFM 2.454/2026 asks for, in practice
CFM Resolution 2.454/2026 governs the clinical use of artificial intelligence and requires governance proportional to risk. Laudos.AI classifies itself as a medium-risk assistive application.
We developed the controls to meet the applicable requirements; compliance depends on the deployment context and on the responsibilities of the institution and the physician.
Where the LGPD meets the reporting routine
Under the LGPD, health data is sensitive personal data. The institution must assess minimization, purpose, security, transparency and governance in the workflow actually contracted.
Audio, intermediate transcription, draft, final report and metadata are distinct categories. Transmission, persistence, logs, retention and backups depend on the feature and the contracted configuration.
In one line
- REPORT AUTHORThe licensed physician who validates and signs
- ROLE OF AIAssistive: structures and suggests, never decides
- CLASSIFICATIONMedium risk under CFM Resolution 2.454/2026
- REGULATORY STATUSNot SaMD (Software as a Medical Device)
- LIMITSNo autonomous image interpretation, diagnosis, signature or release
- DATAFlow, region, retention and subprocessors defined per deployment
Direct questions
Does using assistive AI require patient consent?
The answer depends on the purpose, the legal basis, the care context and the applicable transparency obligations. The institution should assess the workflow with its legal team and data protection officer.
Who answers for the report before the CFM?
The physician who validates and signs remains responsible for the content and the clinical decision. The platform does not sign or release the report autonomously.
Is Laudos.AI a medical device?
No. The platform is not SaMD (Software as a Medical Device). It supports Speech-to-Report after the physician provides the findings.
Does this page guarantee compliance at any hospital?
No. We developed controls to meet the applicable requirements, but compliance depends on the deployment, the configurations, the institution's processes and professional practice.
Compliance that shows up in the workflow
From the rule to a demonstrable control
Meaningful human supervision becomes a concrete sequence: a visible suggestion, free editing, a signature by the physician only and a trail that records the path. Data minimization becomes discarding audio and transcription. Accountability becomes access control, a record per exam and documentation of the role of the institution and of Laudos.AI in the processing.
A serious assessment does not stop at citing the LGPD or the CFM. Link each relevant requirement to three things: the control that meets it, the person responsible for operating it and the evidence the institution presents. This matrix is part of the due diligence documentation. When the context requires specific legal or regulatory interpretation, the institution's legal team and DPO validate the matrix.
The limit of automation is part of the product
The platform does not create an autonomous path to the signature. It structures, suggests and records; the physician reviews and decides. That limit is the design that sustains clinical authorship and shows how the decision was made in each exam.
Compliance is a deployment conversation
IT, DPO and clinical leadership join the process from the demo onward. Documentation ready for review.
FAQ
Questions and answers
When does CFM Resolution 2.454/2026 take effect?
The CFM published the resolution on February 27, 2026, and it has been in force since August 26, 2026. The six implementation playbooks
How does the platform meet meaningful human supervision?
The application is assistive: the physician provides the findings, reviews, edits, validates and signs in the official system. It does not interpret images, does not make autonomous diagnoses, and does not sign or release reports autonomously. How the workflow works
What about LGPD requirements?
Controls include minimization, role-based access, logical segregation, auditing and encryption in transit. The documentation for each deployment records the data flow, subprocessors, regions, retention and responsibilities; this does not replace the institution's governance. Security fundamentals
Does the compliance matrix replace legal assessment?
No. It shows how the product's controls support institutional governance, and it does not replace the legal, regulatory and clinical assessment of each context of use. Talk to us