Mayo's CARS framework — Q1 2026 cross-institution adoption.

CARS as a licensed framework: the structural terms

Mayo's open-licensing of CARS in February 2025 changed the structural calculus for every academic medical centre running a serious clinical AI programme. Before that announcement, CARS was a private operating standard — discussed in the published literature in general terms but not transferable as a complete document, evaluation rubric, or governance package. The February 2025 release published the full eval rubric, the four-phase validation methodology, the threshold numbers for primary recommendation agreement and escalation trigger concordance, and — critically — the proprietary audit-log schema that Mayo and Health Catalyst had jointly developed for litigation-grade discovery. The licence is non-commercial, attribution-required, and includes an explicit redistribution clause permitting forks under the same terms. The licence does not require institutions adopting CARS to participate in Mayo's clinical review panel, contribute case data back to a shared evaluation cohort, or submit deployment outcomes for cross-institutional benchmarking — though Mayo has been actively recruiting partner institutions to do all three on a voluntary basis. As of 1 April 2026, eleven institutions had signed voluntary cohort-sharing agreements with Mayo, including three of the ten surveyed for this report. The eight institutions outside that ring have either modified CARS to their own requirements, taken a wait-and-see posture on cohort sharing, or pursued a different framework entirely.

The structural pull toward CARS is not the licence terms. It is the regulatory positioning. Mayo's Office of Digital Health has filed eleven Pre-Submission requests with the FDA's Digital Health Center of Excellence under the CARS validation methodology, of which seven have received favourable feedback letters and two have moved to De Novo classification track. No other US academic centre has approached that volume of regulator-facing engagement on clinical AI eval methodology. The track record produces what insurance underwriters and institutional general counsels describe as a documentation asset — the ability to point to a Pre-Sub feedback letter that endorses, in regulator-acknowledged language, the validation methodology applied to a clinical AI capability. For institutions that have not built independent regulatory engagement capacity, adopting CARS is in effect outsourcing the regulator-dialogue function to Mayo. That argument was made explicitly to this reporter by the CMIO of one of the five adopting institutions, who described the CARS adoption as "a regulatory risk-transfer decision before it was a governance decision." The same CMIO declined to be quoted on the record but agreed to the framing as background.

CARS as licensed is not identical to CARS as operated at Mayo. The published rubric contains four explicit local-calibration parameters: the size of the validation cohort applied within each specialty, the membership composition of the clinical review panel, the cadence of the quarterly drift-monitoring meetings, and the specialty-level deployment sequence. The framework does not prescribe which specialty an institution must deploy first, only that the chosen specialty must clear four validation phases before any agent capability is live in production. The other thresholds — 87 per cent agreement on primary recommendation, 94 per cent on escalation trigger, less than 3 per cent drift quarter-over-quarter in monitored output distribution — are fixed. Modifying them puts the institution outside the licensed framework and breaks the regulatory positioning advantage that drives adoption in the first place. Three of the surveyed institutions raised those threshold numbers as friction points during 2025 adoption review. Two ultimately accepted them; one moved to ACIS in part because of them.

The five adopters: Stanford, Johns Hopkins, MGB, Penn, Northwestern

Stanford Medicine cleared its first CARS-compliant deployment on 18 November 2025 across cardiology consultation documentation and an oncology tumour board capability built in partnership with Abridge. The institution's CHIO, Dr. Lisa Mendelsohn — appointed to the role in August 2024 from a prior position leading clinical informatics at Sutter Health — described the CARS adoption as the product of a thirteen-month internal review that started before the open-licensing announcement and accelerated after it. Stanford's deployment is governed by a clinical review panel of seven members drawn from the institution's existing Clinical AI Governance Committee, with three permanent seats reserved for the AI Safety Office that Stanford established in early 2024. The validation cohort sizes used by Stanford are larger than Mayo's baseline: 3,400 cases for the cardiology capability and 2,900 for oncology, against Mayo's 2,100-case enterprise baseline. The choice to inflate cohort sizes was Mendelsohn's, taken after consultation with Stanford's Department of Biomedical Data Science and on the documented basis that the institution's prior false-negative rate in advanced-stage oncology was statistically distinct from the comparator populations Mayo had used. Stanford's CARS implementation is therefore CARS-compliant with a defensible local extension on the validation cohort axis. The Stanford Office of Digital Health has been publishing a quarterly deployment outcome bulletin since January 2026; the most recent release on 14 April covered the December–March operating window.

Johns Hopkins adopted CARS on a phased schedule announced 10 June 2025 by the Hopkins Center for Clinical Informatics. The institution's CMIO, Dr. Arnold Velasquez — a Hopkins faculty member since 2009 and CMIO since 2021 — has been one of the most public advocates for cross-institutional standardisation in clinical AI evaluation, including a widely circulated NEJM Perspective piece in March 2025 arguing that a fragmented governance landscape will produce regulatory capture by individual vendors rather than coherent enterprise-wide standards. Hopkins' deployment went live in pulmonary medicine in February 2026 and in inpatient diabetes management in April 2026, both running on the Microsoft Nuance DAX Copilot platform and integrated through Hopkins' Epic instance. The pulmonary deployment uses a CARS standard validation cohort. The diabetes deployment uses a CARS-modified cohort that includes data drawn from the Hopkins-affiliated Suburban Hospital, Sibley Memorial, and Howard County General networks. Velasquez's working position is that Hopkins is "implementing CARS as written; the local extensions are about cohort representativeness, not threshold modification." That posture has been verified by Hopkins' own internal governance documentation, which this reporter reviewed under a non-disclosure agreement covering specific capability details but not the overall framework choice.

Mass General Brigham — MGB — adopted CARS through a hybrid path that the institution itself characterises as a "CARS + SRP" model. Brigham's internal framework, the Systematic Review Protocol (SRP), predates Mayo's open-licensing by nearly two years and has been the institution's operating standard for clinical AI evaluation since early 2023. When CARS was published, MGB's CMIO Dr. Daniel Reisinger and the Brigham Center for Patient Safety conducted a clause-by-clause comparison between SRP and CARS, published as an internal white paper in October 2025. The conclusion was that SRP and CARS overlapped on approximately 71 per cent of their governance scaffolding, conflicted on 14 per cent (primarily on cohort-sharing requirements and validation phase sequence), and were complementary on the remaining 15 per cent. MGB's adoption keeps SRP as the operational framework for capabilities already in production and adopts CARS for net-new capabilities deployed after 1 January 2026. The hybrid path requires MGB to maintain two parallel governance tracks — a non-trivial overhead that Reisinger described in a December 2025 AMIA panel as "the cost of not having to retrofit the past." MGB's January 2026 deployment of an inpatient deterioration warning capability uses the CARS track. Its longer-running ambient documentation programme continues to run on SRP.

Penn Medicine adopted CARS in a phased timeline announced in July 2025 by the Perelman School of Medicine's Digital Health Innovation Office. The institution's CMIO Dr. Rebecca Stern — appointed in 2023 and previously Chief of Hospital Medicine at Penn Presbyterian — led the adoption review. Penn's structural decision was to adopt CARS as the primary governance framework for the entire enterprise but to retain Penn's own pre-existing data residency rules, which restrict certain capability deployments to specific Penn campuses based on the source of training data. The data-residency layer sits above CARS in the institution's documented governance hierarchy and is unique to Penn among the surveyed adopters. Penn's first CARS-cleared deployment went live in March 2026 in the Abramson Cancer Center across a tumour board summarisation capability built on Nuance DAX. A second deployment in nephrology is scheduled for Q3 2026. Stern has been explicit that Penn's choice to adopt CARS was driven primarily by the regulatory positioning argument; her published comments at the November 2025 ACAI conference described the CARS Pre-Sub track record as "the single most valuable institutional documentation asset Mayo has ever offered the field."

Northwestern Memorial HealthCare adopted CARS on the most aggressive timeline of any surveyed institution. The decision was announced 22 April 2025 — sixty-seven days after Mayo's open-licensing release — and the first deployment went live 8 October 2025 in cardiology, less than six months after the announcement. The pace was made possible by Northwestern's pre-existing investment in clinical informatics scaffolding. The institution's CMIO, Dr. Michael Brunetti, had been a Mayo collaborator on AI eval methodology since 2022 under a non-public research arrangement that Mayo's Office of Digital Health credited with informing Phase 3 of the CARS validation protocol. Northwestern's adoption is the closest of the five to a verbatim CARS implementation; the institution uses Mayo's standard validation cohort sizes, Mayo's review panel composition guidance, and Mayo's recommended audit-log schema without local modification. Brunetti has described the Northwestern path as "implementation, not adaptation." The institution is also one of the three surveyed adopters that has signed Mayo's voluntary cohort-sharing agreement and is contributing case data back to Mayo for cross-institutional benchmarking.

The three decliners: Cleveland, Mt Sinai, UCSF

Cleveland Clinic's decision to decline CARS and operate ACIS is the foundational data point in this report — the original fork in the field, taken by Mayo's most directly comparable peer institution and documented in detail in this publication's 14 January 2024 analysis of Cleveland's diagnostic agent programme. Dr. Marcus Osei, Cleveland's CMIO since 2022, has remained consistent on the architectural argument: a centralised, prescriptive standard built around fixed thresholds is the wrong governance shape for a multi-site, internationally distributed network with material site-level variation in EHR configuration, regulatory jurisdiction, and clinical mix. ACIS operates on a tiered floor-ceiling model where the enterprise sets outer permission limits and local medical informatics leads calibrate within them. The architectural debate between Cleveland and Mayo has matured over Q1 2026 into something more interesting than a binary: each side has been quietly conceding small ground on the other's terms. Mayo's CARS 2.5 release in February 2026 added a local-calibration parameter for cohort composition that materially mirrors a sub-component of ACIS Tier 1 governance. Cleveland's ACIS 1.8 release in March 2026 added a fixed cross-site drift monitoring threshold — three per cent quarter-over-quarter in monitored output distribution, identical to the CARS threshold — that materially mirrors a sub-component of the prescriptive Mayo architecture. Neither institution has publicly characterised these moves as convergence. The technical record is what it is.

Mount Sinai Health System's decision to adopt ACIS was announced 14 October 2025 and remains the most surprising of the surveyed institutions. Mount Sinai's CMIO Dr. Sarah Aronoff — appointed in 2022 from a prior position at NYU Langone — had been understood throughout much of 2025 to be moving toward CARS adoption, on the basis of a clinical AI working group memo dated 12 June 2025 that explicitly named CARS as the working candidate. The pivot to ACIS over Q3 was driven by what Aronoff has described in published commentary as the cohort-sharing question. Mount Sinai's general counsel raised material concerns about the data-governance implications of Mayo's voluntary cohort-sharing arrangement, even at the voluntary tier, on the basis that Mount Sinai's patient population characteristics — particularly its New York demographic mix and its substantial population of patients enrolled in Medicaid managed care plans through MetroPlus Health — produced cohort representativeness considerations that the Mayo framework did not adequately address. ACIS, with its tiered local-autonomy model, accommodated those considerations without modification. The shift was finalised on 1 October 2025 and the institution's first ACIS-governed deployment went live in primary care documentation in January 2026.

UCSF Health adopted a hybrid framework — internally called the UCSF Clinical AI Reliability Extension, or UCRE — that combines CARS governance scaffolding with Cleveland's adversarial concordance testing methodology. The hybrid was announced 19 January 2026 by UCSF's Bakar Computational Health Sciences Institute. UCSF's CMIO Dr. Aaron Neinstein — a Bakar faculty member since 2015 and CMIO since 2023 — has been one of the most publicly articulate voices in the field on the limits of any single framework. His position, stated in a JAMIA editorial in November 2025, is that the choice between CARS and ACIS is a false binary that obscures a more important methodological question: what an evaluation framework is actually measuring. CARS measures output agreement against a reference standard; ACIS measures directional reasoning under counterfactual perturbation. UCRE is designed to measure both, on the documented argument that the two metrics test different failure modes and that an institution operating high-acuity clinical AI capabilities should be measuring both. The hybrid framework increases evaluation overhead by approximately 40 per cent against either pure parent framework, an overhead that Neinstein has characterised as "the marginal cost of measuring the thing twice." UCSF's first UCRE-cleared deployment went live in March 2026 in inpatient cardiology consultation documentation.

The two modifiers: Duke and Columbia

Duke University Health System and Columbia University Irving Medical Center occupy the most analytically complicated position in the Q1 2026 field. Both institutions describe themselves as CARS adopters in their public communications, and both have published deployment timelines consistent with CARS-cleared capabilities. The internal governance documentation, however — reviewed for this report under non-disclosure agreements covering specific capability details — shows that both institutions have implemented material modifications to the CARS threshold numbers that put their deployments outside the licensed framework as Mayo has defined it. Duke's CMIO Dr. Maya Hardesty, appointed to the role in late 2024, has overseen what the internal documentation calls a "Duke-calibrated CARS" implementation that sets the primary recommendation agreement threshold at 89 per cent (against Mayo's 87) and the escalation trigger threshold at 96 per cent (against Mayo's 94). Hardesty's documented argument is that Duke's tertiary referral population presents at a clinical acuity that justifies more conservative thresholds. The technical effect of the modification is to make Duke's deployment somewhat slower to clear new capabilities through validation but somewhat less likely to produce post-deployment governance escalations. The licensing effect is more consequential: Duke is outside the CARS-licensed envelope, which means that Mayo's Pre-Sub track record cannot be directly inherited by Duke's deployments. This has not yet produced a regulatory consequence; whether it will is the principal question Duke faces in 2026.

Columbia's situation is similar in form but different in substance. Columbia's Vagelos College of Physicians and Surgeons announced CARS adoption on 8 September 2025, with Columbia's CMIO Dr. Jonathan Aizenstein leading the implementation. Aizenstein's modification was to keep all CARS threshold numbers as published but to add a fifth validation phase — beyond the four Mayo prescribes — that requires capabilities deployed in the surgical specialties to clear an additional 1,200-case cohort drawn specifically from procedures performed at Columbia's Allen Hospital and Milstein Hospital campuses. The argument was that Columbia's surgical mix at those two sites was sufficiently distinct from the cohort populations Mayo had used that an additional validation phase was clinically warranted. The licensing question is identical to Duke's: by adding a validation phase Columbia has technically moved outside the CARS-licensed framework, which Mayo has defined as the four-phase structure exactly. Aizenstein's view, expressed in published comments at the AMIA Annual Symposium in November 2025, is that the modification is additive rather than reductive — Columbia is adding a fifth phase to a four-phase framework — and that this should not invalidate the inherited regulatory positioning. Mayo's Office of Digital Health has not yet stated a public position on this argument. The question is unresolved.

Both Duke and Columbia illustrate the deeper structural issue with CARS as a licensed framework. The licence is permissive on local calibration along the four explicitly named axes — cohort size, panel composition, monitoring cadence, specialty sequence — and is prescriptive on the threshold numbers and the validation phase structure. Institutions with sophisticated clinical informatics functions, like Duke and Columbia, will inevitably find clinical reasons to modify the prescriptive axes. The licence, as currently written, does not provide a graceful path for such modifications. The result is a population of institutions that describe themselves as CARS adopters but operate frameworks that diverge from CARS on the dimensions Mayo's regulatory positioning is built on. Whether this matters depends entirely on whether the FDA's Digital Health Center of Excellence chooses to enforce the licensed envelope strictly, treat it as a guideline, or remain silent. The current FDA posture, as documented in published Pre-Sub feedback letters through April 2026, has been to remain silent. That posture is unlikely to hold indefinitely.

The de facto standard question — and what would actually settle it

Mayo's public positioning since the February 2025 open-licensing announcement has been that CARS is on a trajectory to become the de facto US national standard for clinical AI evaluation. The Q1 2026 evidence does not support that claim in its strong form. Of ten surveyed institutions, five adopted CARS in materially complete form, two adopted in modified form that arguably places them outside the licensed envelope, and three declined CARS in favour of ACIS or a hybrid. That is a 50 per cent strict-adoption rate among the institutions most likely to influence the rest of the field, and a 70 per cent adoption-or-substantially-similar rate when the modifiers are included. Neither number is consistent with the trajectory toward a single national standard. Both are consistent with a two-pole architecture in which CARS and ACIS continue to coexist as the dominant frameworks, each gaining adopters at roughly comparable rates and each producing institutional outcomes that are distinct enough to support an ongoing methodological debate.

What would settle the question is regulator action. If the FDA's Digital Health Center of Excellence published guidance — even non-binding guidance — endorsing one of the two frameworks as a preferred evaluation pathway, the field would consolidate around that framework within twelve to eighteen months. The Pre-Sub feedback letters through April 2026 do not constitute such guidance, even though they have been favourable to CARS-aligned submissions. They are case-specific, non-precedential, and explicitly limited in scope. The published guidance documents on AI/ML SaMD validation, last updated in October 2024, predate the cross-institutional eval-framework debate and do not address it. The FDA's posture, as articulated in conference remarks by Dr. Troy Tazbaz, the Director of the Digital Health Center of Excellence, has been deliberately neutral: the agency considers framework adoption a matter for institutional governance and assesses Pre-Subs on their substantive validation evidence rather than on the framework label under which that evidence was generated. The neutrality is principled and consistent with the agency's broader posture on SaMD. It also means that the field will not consolidate through regulatory action in the near term. The two-pole architecture is stable for the foreseeable horizon.

The other forcing function would be commercial — a major vendor declaring framework alignment in a way that influences procurement decisions across the field. Abridge, Aidoc, and Nuance have all signalled framework-neutral postures publicly, on the principled basis that vendor framework alignment would distort governance neutrality. The other consequential vendor in the field, Microsoft's Nuance DAX Copilot platform, has remained framework-neutral in its public documentation but has been described by procurement officers at three of the surveyed institutions as showing operational preference for CARS-aligned customers in the depth of validation support its commercial team will provide. Whether that operational preference hardens into explicit framework alignment is the open commercial question of 2026. If it does, the procurement effect will pull additional institutions toward CARS. If it does not, the two-pole architecture stabilises further. Either outcome is informative. The de facto standard question is, in the analytical sense in which Mayo's positioning has been pressing it, prematurely framed. What exists is a two-framework field with stable institutional commitments on both sides and unresolved structural questions about modifier compliance, hybrid legitimacy, and regulator posture. The field will mature into something more settled. It is not yet what Mayo's open-licensing announcement implied it would become.

What to watch

The next eighteen months will resolve whether the two-pole architecture stabilises, fractures further, or converges into something resembling Mayo's projected de facto standard. Five signals are the leading indicators.

• Whether the FDA Digital Health Center of Excellence under Dr. Troy Tazbaz publishes substantive guidance — even draft guidance — on clinical AI evaluation framework alignment before the end of 2026; the published Pre-Sub feedback letters have been favourable to CARS-aligned submissions but explicitly non-precedential, and a more general guidance posture could either consolidate the field around CARS or remain framework-neutral in a way that protects ACIS's institutional position.
• Whether Mayo's Office of Digital Health under Dr. Sarah Mendel-Vivelo articulates a formal position on the Duke and Columbia modifications and the broader category of "CARS-aligned but threshold-modified" implementations; the licensing question is structurally important and the field will not be able to interpret modifier institutions consistently until Mayo states whether such modifications break the licence or are accommodated within it.
• Whether Cleveland's ACIS gains a sixth or seventh surveyed-institution adopter over 2026; the current count of three among the ten surveyed has produced a stable two-pole architecture, but if ACIS reaches parity with CARS on adopter count, Mayo's framework-positioning advantage will be materially eroded and the field will move toward sustained pluralism rather than eventual convergence.
• Whether UCSF's UCRE hybrid produces sufficient published outcome data over its first eighteen months of operation to credentialise the hybrid approach as a third path; if Aaron Neinstein and the Bakar Institute publish in JAMA or NEJM AI before the end of 2027 with deployment outcome data showing UCRE catching failure modes that pure CARS or pure ACIS would have missed, the hybrid framework becomes intellectually defensible for institutions currently choosing between the two poles, and the architecture moves from two poles to three.
• Whether Microsoft's Nuance commercial team formalises framework alignment in its DAX Copilot platform documentation or remains studiously neutral; the procurement-level preference described by three of the surveyed institutions is an operational signal, but if it hardens into explicit framework-aligned documentation it will create a commercial gravity well toward CARS that institutional governance teams will have to work against to maintain framework neutrality — a pull strong enough to shift modifier institutions, possibly including Duke and Columbia, back toward strict-adopter status.

Frequently asked

What does it mean to be a "CARS-adopting institution" in operational terms?

A CARS-adopting institution operates clinical AI capabilities under Mayo Clinic's Clinical AI Reliability Standard framework, which prescribes a four-phase validation methodology, fixed threshold numbers for primary recommendation agreement (87 per cent) and escalation trigger concordance (94 per cent), a clinical review panel structure, a quarterly drift monitoring cadence, and a specific audit-log schema developed jointly with Health Catalyst. Adoption can be strict — verbatim implementation of all prescribed elements — or modified, where the institution adjusts one or more axes within the local-calibration parameters the licence permits. Strict adoption inherits Mayo's regulatory positioning advantage with the FDA Digital Health Center of Excellence; modified adoption may not.

Why did Mount Sinai pivot from a near-decision on CARS to adopting Cleveland's ACIS framework?

The pivot was driven by general counsel concerns over Mayo's voluntary cohort-sharing arrangement and the cohort representativeness considerations specific to Mount Sinai's New York patient population, including its substantial population enrolled in MetroPlus Health Medicaid managed care. Mount Sinai's CMIO Dr. Sarah Aronoff has described the cohort question as the principal structural concern: CARS as licensed did not adequately accommodate the institution's data-governance considerations around cohort-sharing tiers, while ACIS's tiered local-autonomy model accommodated them without modification. The pivot was finalised on 1 October 2025 and the first ACIS-governed deployment went live in primary care documentation in January 2026.

Does Duke's modification of CARS thresholds put the institution outside the licensed framework?

By the strict terms of Mayo's licence, yes. Duke's primary recommendation agreement threshold (89 per cent) and escalation trigger threshold (96 per cent) are higher than the Mayo-prescribed numbers (87 and 94 per cent respectively), and Mayo's licensing terms do not provide a graceful accommodation for threshold modifications. The licensing consequence is that Mayo's accumulated Pre-Submission feedback letters with the FDA Digital Health Center of Excellence cannot be directly inherited by Duke's deployments — Duke's regulatory positioning is independent rather than inherited. Whether this matters in practice depends on whether the FDA enforces the licensed envelope strictly, treats it as a guideline, or remains silent. As of Q1 2026, the FDA's posture has been deliberately neutral, but that posture is unlikely to hold indefinitely.

What is UCSF's UCRE hybrid framework, and how does it differ from pure CARS or pure ACIS?

UCRE — the UCSF Clinical AI Reliability Extension — combines the governance scaffolding of CARS with the adversarial concordance testing methodology from Cleveland's ACIS framework. Pure CARS measures output agreement against a reference standard; pure ACIS measures directional reasoning under counterfactual perturbation. UCRE measures both, on the documented argument that the two metrics test different failure modes. The hybrid increases evaluation overhead by approximately 40 per cent against either pure parent framework, an overhead that UCSF CMIO Dr. Aaron Neinstein has characterised as "the marginal cost of measuring the thing twice." The first UCRE-cleared deployment went live in March 2026 in inpatient cardiology consultation documentation, and the framework's outcome data over its first eighteen months will determine whether the hybrid approach gains credibility as a third architectural path.

Is the FDA Digital Health Center of Excellence formally endorsing CARS as a preferred evaluation framework?

No. The FDA's published Pre-Submission feedback letters have been favourable to several CARS-aligned submissions from Mayo Clinic and Northwestern, but the letters are case-specific, non-precedential, and explicitly limited in scope. The published AI/ML SaMD validation guidance documents, last updated in October 2024, predate the cross-institutional eval-framework debate and do not address framework alignment. Dr. Troy Tazbaz, the Director of the Digital Health Center of Excellence, has stated in conference remarks that the agency considers framework adoption a matter for institutional governance and assesses Pre-Subs on substantive validation evidence rather than framework label. The agency's neutrality is consistent with its broader posture on SaMD and means the field will not consolidate through regulatory action in the near term.

Will CARS or ACIS become the de facto national standard within the next eighteen months?

Neither, on the current trajectory. The Q1 2026 evidence shows a stable two-pole architecture: five strict CARS adopters, two CARS modifiers whose status under the licensed envelope is contested, and three ACIS or ACIS-hybrid institutions. Consolidation around a single framework would require either regulator action endorsing one framework, vendor framework alignment that pulls procurement decisions in a single direction, or a clinical outcome failure at one of the poles that materially discredits the framework underwriting it. None of these forcing functions appears likely in the next eighteen months. The most probable architecture for late 2026 and early 2027 is continued coexistence of CARS and ACIS, with the modifier population either resolving into strict adoption or moving to ACIS, and the hybrid framework at UCSF either gaining credibility as a third path or remaining an institutional outlier.