Artificial intelligence in healthcare requires limits: how LISA incorporates clinical safety and regulatory responsibility

Artificial intelligence is changing how healthcare institutions interact with their patients. Intelligent agents can explain preparations for examinations, reinforce treatment instructions, support recovery journeys and facilitate access to care teams.

These applications present an opportunity for hospitals, clinics, laboratories and other healthcare organizations. After all, many of the difficulties patients face are not necessarily related to clinical care itself, but to the communication that takes place before, during and after it.

However, this development raises a fundamental question:

How can we ensure that technology capable of discussing health does not exceed the boundaries of medical practice?

At LISA Discovery, this concern informs an initiative called Lisa ANVISA Ready, dedicated to regulatory assessment, clinical safety and the continuous improvement of the platform.

The principle is simple: artificial intelligence can extend the reach of healthcare professionals' guidance, but it must not take over decisions that belong to them.

The difference between communicating guidance and making a clinical decision

Consider a patient who receives instructions from their physician on how to prepare for a procedure.

An intelligent agent can help the patient understand those instructions, remember important steps and organize questions for the responsible team.

It can also confirm whether the patient has received the necessary information, explain administrative procedures and route requests that require professional assessment.

This is fundamentally different from interpreting an examination result, establishing a diagnosis, recommending a new treatment or changing a medical prescription.

This distinction is essential to understanding the regulatory classification of healthcare technologies.

In Brazil, Resolution of the Collegiate Board RDC No. 657/2022, issued by the Brazilian Health Regulatory Agency (ANVISA), establishes rules for software classified as medical devices, known internationally as Software as a Medical Device (SaMD).

The regulation considers aspects such as the software's intended purpose and the functions it actually performs.

This means that technology used for administrative communication may fall under a different regulatory classification from a system that performs clinical analyses or recommends therapeutic decisions.

For this reason, LISA takes an approach of continuously assessing its functions, recognizing that different applications of artificial intelligence may require specific regulatory analyses.

The purpose of the technology matters as much as its technical capabilities.

Five principles guiding LISA's development

Clinical safety should not be treated merely as a step that follows product development.

It must inform the architecture, processes and operational boundaries from the outset.

LISA organizes this approach around five fundamental principles.

1. Medical decisions remain with the healthcare professional

LISA's agents are designed to support the communication of information previously documented by the care team.

The governance architecture for voice agents establishes restrictions on activities such as:

• Making diagnoses or formulating diagnostic hypotheses.
• Prescribing medication or suggesting dosage changes.
• Interpreting examination results independently.
• Recommending new treatments.
• Modifying previously approved clinical instructions.

The objective is to maintain a clear separation between automated communication and clinical decision-making.

Artificial intelligence can help make medical guidance easier to understand and follow.

However, responsibility for clinical decisions remains with legally qualified professionals.

2. All clinical guidance requires an approved source

One of the main challenges of generative artificial intelligence is its ability to produce seemingly convincing responses even when it lacks sufficient information.

In healthcare applications, this behavior requires particular attention.

For this reason, LISA's architecture includes content control mechanisms intended to link agents' communications to previously approved information.

In the voice agent module, for example, checks consider the availability of approved content and the existence of valid operational policies before a session is enabled.

This model seeks to reduce the risk of an automated interaction introducing unauthorized clinical instructions.

The intention is not to allow the agent to devise new courses of clinical action, but to facilitate patients' access to information the healthcare institution has already defined.

Reliable guidance requires a known source, controlled content and clearly assigned responsibility.

3. Recognizing limits is part of intelligence

One of the most important characteristics of an agent used in healthcare is not its ability to answer every question.

It is its ability to recognize when a response must be referred to a professional.

Consider a situation in which a patient asks:

"Can I double my medication dose because I forgot to take it yesterday?"

This request involves a possible change in therapeutic management.

Rather than independently producing a recommendation, an agent with clinical boundaries is expected to recognize that the question falls outside its scope and refer it to the responsible team.

LISA incorporates mechanisms intended to identify requests related to medication changes, requests for human assistance and certain expressions that may indicate urgent situations.

These mechanisms guide the routing of the interaction rather than authorize autonomous clinical decisions.

It is important to emphasize that automated risk identification systems do not replace care protocols, professional assessment or emergency services.

Nor do they guarantee the identification of every clinically relevant situation.

Their role is to provide an additional layer of protection within a supervised process.

4. Security and traceability are part of the architecture

Digital relationships with patients require safeguards that extend beyond the quality of responses.

It is necessary to consider who can access information, which data are used, how interactions are recorded and which mechanisms make it possible to monitor the agents' operation.

LISA includes access management features, operational policies, interaction histories and controls over agent activation.

The voice architecture also includes mechanisms intended to limit the context sent to artificial intelligence models, restricting information that is unnecessary for conducting the conversation.

These measures are aligned with the principles of necessity, security and accountability set out in Brazil's General Personal Data Protection Law (LGPD).

However, full compliance with the LGPD depends on additional factors, such as appropriate legal bases, supplier contracts, retention policies, institutional controls and technical checks applicable to each operation.

Security must be understood as a continuous process of governance, assessment and improvement.

5. Human oversight is part of the process, not an exception

Automation should facilitate the work of healthcare teams, not eliminate the possibility of human intervention.

LISA includes mechanisms for referral to human assistance and features for monitoring interactions.

This model is particularly important when a patient raises an unanticipated question, requests a treatment change or needs individualized assistance.

The objective is to enable technology to contribute to communication and journey coordination while preserving the authority of the professionals responsible for care.

The role of artificial intelligence is to extend teams' capacity, not replace their responsibility.

A new Brazilian reference for artificial intelligence in medicine

Regulatory developments are keeping pace with the expansion of artificial intelligence in healthcare.

In 2026, Brazil's Federal Council of Medicine issued CFM Resolution No. 2,454/2026, which governs the use of artificial intelligence in medicine.

The resolution reinforces principles related to transparency, human oversight, personal data protection, risk assessment and the preservation of medical autonomy.

It also establishes responsibilities concerning the use of these technologies in medical practice and the information provided to patients.

These principles are particularly relevant to organizations intending to incorporate intelligent agents into their operations.

The adoption of artificial intelligence should not be assessed solely in terms of operational efficiency or the quality of the patient experience.

It is also necessary to consider the risks associated with the technology's purpose, the context of use and its potential influence on clinical decisions.

For solutions such as LISA, this context reinforces the importance of incorporating safety and governance from the product design stage, rather than treating them merely as a later compliance step.

Data protection is inseparable from clinical safety

Health-related information receives special protection under Brazil's General Personal Data Protection Law, the LGPD.

This means that platforms processing patient data must consider specific requirements concerning the purposes of processing, applicable legal grounds, data minimization, security and data subjects' rights.

In certain situations, this information may be used to facilitate relationships between institutions and patients, provided that processing complies with the conditions established by law.

In pediatric journeys, this responsibility requires additional attention.

Communication with parents or guardians, the proper identification of recipients and the processing of children's and adolescents' data must take account of applicable legal provisions and the best interests of those data subjects.

LISA's architecture includes settings for recipients and care context, allowing interactions directed to patients themselves to be distinguished from those directed to their guardians.

The legal and operational suitability of these journeys must be assessed according to the institution, the purpose of processing and the data actually used.

Protecting health information is more than a regulatory obligation. It is a fundamental condition for building trust in digital relationships with patients.

Clinical safety across the three stages of the patient journey

LISA's approach to safety can also be understood through the different stages of the care journey.

Before care

Agents can support activities such as appointment confirmation, preparation for examinations, logistical guidance and explanations of administrative procedures.

In these situations, the priority is to facilitate access to information previously defined by the institution, avoiding the autonomous creation of clinical recommendations.

During care

Artificial intelligence can help guide patients within facilities, clarify operational questions, support communication about the care workflow and identify situations requiring human intervention.

The agent acts as a layer of communication and coordination, without taking over decisions concerning the patient's clinical assessment.

After care

Agents can reinforce documented guidance, support follow-up reminders, facilitate contact with the institution and collect information about the patient experience.

When questions arise that require clinical interpretation, therapeutic changes or symptom assessment, the workflow must respect established boundaries and refer the situation to the responsible professionals.

This separation makes it possible to explore the potential of artificial intelligence at different points in the journey while preserving the distinction between communication support and the professional practice of medicine.

Lisa ANVISA Ready: a commitment to continuous development

The Lisa ANVISA Ready initiative organizes the principles guiding the platform's development and regulatory assessment.

It represents an internal commitment to clinical safety, human oversight and the continuous improvement of governance mechanisms.

It is important to clarify that Lisa ANVISA Ready does not represent certification, authorization, registration or approval granted by ANVISA.

The regulatory classification of each function depends on its intended purpose and actual operation.

The initiative aims to promote an architecture in which automated communication respects approved clinical content, recognizes its operational boundaries and preserves human oversight.

This means recognizing that regulatory responsibility is not a permanent state achieved at a particular moment.

It is a continuous process of assessment, documentation and development.

The future of artificial intelligence in healthcare will be defined by trust

The next generation of intelligent agents will have a growing ability to understand natural language, personalize interactions and support complex journeys.

However, technological sophistication does not remove the need for responsibility.

On the contrary.

The greater a system's capacity for interaction, the more important it becomes to establish clear limits on its operation.

In healthcare, an inappropriate response can have consequences very different from those observed in other sectors.

For this reason, the quality of a solution should be measured by more than its ability to respond quickly. It should also be measured by its ability to recognize uncertainty, respect professional guidance and refer situations that require human intervention.

LISA is founded on a conviction:

The future of artificial intelligence in healthcare will not be defined solely by systems that can answer more questions.

It will be defined by systems capable of providing the right guidance, from the right source, within the right boundaries.

Because a truly intelligent healthcare journey must also be safe, responsible and human.

Learn about our approach to clinical safety

LISA Discovery develops intelligent agents to support communication between healthcare institutions and patients before, during and after care.

Learn about the principles of the Lisa ANVISA Ready initiative and our approach to clinical safety and regulatory compliance.

Visit LISA Discovery's Compliance page.