The Inadmissible Clinical Output Is the Regulated Event

A radiology model reports a finding inconsistent with the patient's documented history. A drug-interaction checker recommends a contraindicated medication. A clinical decision support module proposes a regimen outside the patient's formulary or the institution's protocol. In each case an AI system produced a clinically inadmissible output, and that output reached a clinician. Every healthcare AI regulatory regime treats this as the event to be controlled. FDA design controls under 21 CFR 820.30 require that software output be verified and validated against defined requirements before release. 21 CFR Part 11 requires that electronic records and the actions that produce them be attributable, contemporaneous, and audit-trailed. The FDA's marketing-submission guidance for AI-enabled device software functions, together with the Predetermined Change Control Plan framework, requires that the conditions under which an adaptive model may change be specified and bounded in advance. IEC 62304 imposes a software lifecycle in which each output traces to a controlled requirement; ISO 14971 requires that foreseeable hazards, including a clinically wrong recommendation, be mitigated by design rather than by downstream inspection. EU MDR Annex I demands clinical-performance evidence and risk control for software as a medical device, and the EU AI Act classifies medical AI as high-risk with corresponding obligations for human oversight, logging, and accuracy. The NIST AI Risk Management Framework and the HHS strategic posture for AI in health both presuppose a control that prevents the harmful outcome rather than one that annotates it afterward.

This article is built on Inference Control, disclosed in United States Patent Application 19/647,395, specifically the inference-time semantic execution control of Chapter 8. The premise of that disclosure maps directly onto the clinical problem: the regulated event is the production of the inadmissible output, so the control must act before the output exists. A clinical recommendation is admissible by construction only if the act of generating it is gated against patient context, clinical guidelines, and institutional policy at the semantic transition that would commit it, not by a classifier examining a recommendation that has already been generated and may already have been logged, surfaced, or acted upon.

Why Post-Generation Filtering Cannot Satisfy the Frameworks

Post-generation filtering, the prevailing pattern in deployed clinical AI, generates the candidate recommendation and then asks a separate model or rule set whether it should have been generated. By the time the filter runs, the inadmissible output already exists as a record. Under 21 CFR Part 11 that record is an attributable electronic record whose existence the audit trail must reflect. Under ISO 14971 the hazard has already occurred and the residual-risk argument depends on the reliability of a second statistical component layered on the first. Under the Predetermined Change Control Plan framework, a filter that is itself a learned model widens rather than bounds the space of behaviors a submission must characterize in advance.

The framework that healthcare regulators are converging on does not ask whether a harmful output was caught. It asks whether the system was designed so the harmful output could not be produced in the first place, and whether the design produces evidence to that effect. Inference control answers both. It relocates the admissibility decision inside the inference loop and produces, for every clinical inference, a deterministic record of why it was admitted, rejected, or decomposed. That record is the artifact a design-controls audit, a Part 11 inspection, or an MDR technical file requires, and it is generated as a byproduct of the control rather than reconstructed after the fact.

How Inference Control Governs a Clinical Inference

The mechanism the application deploys is the semantic admissibility gate disclosed at Section 8.6 of the cited application. During generation, the system maintains a typed semantic state object whose fields carry the inference context, a memory of established content, a policy reference, a lineage of admitted transitions, and entropy and uncertainty bounds. In the clinical embodiment, the policy reference field encodes the constraints that make a recommendation admissible for this patient: the patient's documented context and history, the contraindications and interaction rules of the applicable clinical guideline, the institution's formulary and protocol, and the licensing and scope-of-practice boundaries of the recipient. Each candidate inference transition, whether a single token, a phrase, or a complete reasoning step, is mapped to a proposed semantic mutation and evaluated against the current state object before it is permitted to advance.

The gate evaluates each proposed mutation through four sequential stages and a mutation must pass all four to be admitted. First, policy constraint evaluation tests the mutation against the policy reference field; a transition that would carry the output into contraindicated, out-of-formulary, or out-of-scope territory is rejected at this stage because policy violations are absolute. Second, mutation descriptor validation checks that the proposed change is internally consistent and compatible with the established state, so the recommendation cannot presuppose patient facts that were never established or contradict facts that were. Third, lineage continuity validation tests the mutation against the trajectory of previously admitted transitions, so the recommendation cannot exhibit an unexplained discontinuity from the clinical reasoning already on record. Fourth, entropy bounds evaluation tests whether the mutation introduces uncertainty within the permitted bounds; in a high-precision clinical context the bounds are tight and a speculative transition is rejected, while a lower-stakes explanatory context may admit greater latitude.

The gate produces exactly one of three deterministic outcomes, with no probabilistic scoring or soft threshold. An admitted mutation is committed to the state object and the lineage is extended. A rejected mutation is discarded and the inference engine is directed to an alternative candidate or to termination, so the inadmissible recommendation is never produced. A coarse-grained mutation that bundles admissible and inadmissible content is decomposed into sub-mutations, each independently re-evaluated, so the admissible portion of a clinical statement can proceed while the inadmissible portion is held back. The determination is deterministic: the same state object and the same proposed mutation yield the same outcome every time, which is the property a validated medical device under IEC 62304 and 21 CFR 820 requires and which a probabilistic filter cannot offer.

Across a multi-step clinical reasoning chain, trust-slope continuity validation operates as a cumulative diagnostic over the sequence of individually admitted transitions, detecting drift in which each local step is admissible but the chain as a whole departs from the patient's context or the original clinical question. On detecting drift the system issues a warning annotation, applies a correction that re-anchors the reasoning and may tighten the entropy bounds and narrow the policy constraints, or halts the inference and emits the content admitted prior to the drift along with a structured report of where divergence occurred. The entire trajectory, every determination, every drift response, and every committed mutation, is recorded in the lineage field so the complete behavioral path of the generation is deterministically reconstructible from the record alone.

Clinical Embodiments and Deployment Options

The control is model-agnostic: it governs the inference of any underlying model whose candidate transitions can be mapped to semantic mutations, so an institution can adopt it without replacing the diagnostic or language models already cleared into its workflow, and can change models behind a stable governance boundary. The cited application discloses embedded, co-resident, and hardware-assisted deployment configurations, and the clinical application spans them. In an embedded configuration the gate runs inside the inference runtime of an on-device clinical tool, suitable for point-of-care imaging, surgical robotics, or ambulance telemedicine where the patient-context and protocol policy must be enforced without a network round trip. In a co-resident configuration the gate runs alongside a hospital-hosted model serving multiple departments, with department-specific policy reference fields encoding distinct formularies and protocols. In a hardware-assisted configuration the gate's evaluation is accelerated for high-throughput screening pipelines.

The same primitive instantiates across clinical functions by varying only the policy reference field, the entropy bounds, and the lineage seed. A diagnostic-imaging assistant gates each reported finding against the patient's documented history so a finding inconsistent with that history is rejected before it is surfaced. A prescribing assistant gates each medication mutation against the interaction and contraindication rules of the applicable guideline and the patient's active medication list. A clinical decision support module gates each recommended step against the institution's protocol and the patient's formulary. A clinical-documentation generator gates each generated statement against the established encounter record so the note cannot assert facts not in evidence. A patient-facing triage or education agent gates each transition against scope-of-practice boundaries so the output cannot cross from information into individualized medical advice the deployment is not authorized to give. In every case the admissibility decision precedes the existence of the output, and the lineage record it produces is the evidence the governing framework demands.

Adoption is graduated. An institution first introduces the gate at the output boundary of a single high-risk function, encoding that function's contraindication and protocol rules into the policy reference field and capturing the lineage record as Part 11 and design-controls evidence. It then extends the same primitive across functions by authoring additional policy reference fields rather than building new control logic, since the gate, the state object, and the lineage mechanism are shared. Finally it integrates the lineage records into its quality-management system under ISO 14971 and its technical documentation under EU MDR and the EU AI Act, so generation-time governance becomes the source of the clinical-performance and human-oversight evidence those regimes require, rather than a procedural exception bolted onto an ungoverned model.

Disclosure Scope

The inference-time semantic admissibility mechanism described in this article, comprising the typed semantic state object maintained during inference with its policy reference, memory, lineage, and entropy-bounds fields; the mapping of candidate inference transitions to semantic mutations; the deterministic four-stage admissibility gate of policy constraint evaluation, mutation descriptor validation, lineage continuity validation, and entropy bounds evaluation, producing admit, reject, or decompose outcomes; trust-slope continuity validation with warning, correction, and halt responses; and the recording of every determination in the lineage field, is disclosed in United States Patent Application 19/647,395, including at Chapter 8 and Section 8.6. This article describes an enabling application of that disclosed mechanism to healthcare AI admissibility. The scope extends to clinical inference engines not enumerated whose candidate transitions are mappable to semantic mutations, to the embedded, co-resident, and hardware-assisted deployment configurations disclosed in the application, and to clinical functions beyond those described in which the policy reference field encodes patient context, clinical guidelines, institutional protocol, or scope-of-practice constraints, provided each candidate transition is evaluated against the semantic state object before commitment.