On May 21, 2026, the U.S. Department of Health and Human Services (“HHS”) announced the launch of the Audit Enforcement and Risk Oversight initiative (“AERO”). The announcement came not through the Federal Register, not through a notice-and-comment proceeding, but through a press release and formal letters dispatched to all fifty state governors and treasurers. For the nation’s hospitals, the implications are immediate and potentially severe. AERO uses artificial intelligence (“AI”) to re-score and re-characterize at least five years of Single Audit Act compliance data for every entity receiving $1 million or more in annual federal funds. For hospitals — which draw federal money from multiple concurrent streams, including Medicaid Disproportionate Share Hospital (“DSH”) payments, Graduate Medical Education (“GME”) funding, National Institutes of Health (“NIH”) and Health Resources and Services Administration (“HRSA”) grants, and COVID-19 and American Rescue Plan Act (“ARPA”) relief awards — AERO represents one of the most expansive AI-driven enforcement mechanisms deployed by a federal agency. And it was launched without a single public comment.

The administrative law framework governing how agencies exercise power was not designed with this kind of enforcement in mind. The Administrative Procedure Act (“APA”) was built around a foundational assumption that governmental decisions are made by humans, explained by humans, and reviewable by courts because humans can articulate the reasoning behind them. AERO challenges each of those assumptions. However, plaintiffs seeking to challenge this new use of generative AI are not without legal recourse or remedy. In the wake of the Supreme Court’s landmark decision in Loper Bright Enterprises v. Raimondo, 603 U.S. 369, 412-13 (2024), federal agencies are receiving less deference and greater scrutiny, as the law now clearly mandates that courts, not agencies, independently decide whether an agency has acted within the bounds of the law and its granted authority. This article explains that hospitals facing AERO enforcement actions have powerful grounds to challenge HHS’s conduct under the APA — and that the legal landscape, though unsettled, tilts decisively toward challengers who act strategically and early.

I. What AERO Is — and Why Hospitals Are Squarely in the Crosshairs

AERO is a department-wide program integrity initiative administered by HHS’s Office of the Assistant Secretary for Financial Resources. Its stated purpose is to enforce compliance with the Single Audit Act (31 U.S.C. §§ 7501–7506), and the Uniform Guidance (2 C.F.R. Part 200) — the federal framework governing audits of non-federal entities that expend federal awards. HHS is specifically targeting entities with chronic audit noncompliance, noting that hundreds of grantees have failed to submit required audits, with some late by more than two years. The enforcement arsenal is formidable: payment withholding, cost disallowances, suspension or termination of awards, debarment proceedings under 2 C.F.R. Part 180, and withholding of future federal funds.

Hospitals are directly in the crosshairs for reasons that go beyond simple noncompliance. As this initiative targets any non-federal entity receiving $1 million or more annually in federal funds, hospitals — particularly large academic medical centers and safety-net institutions receiving Medicaid DSH and GME payments — are primary enforcement targets. Critically, many hospitals receive pass-through funding through state Medicaid agencies, meaning an AERO finding against a state could flow downstream to the hospital as a subrecipient. Consequently, a hospital that is itself in full compliance may face collateral consequences from a state-level AERO action over which it had no control and in which it had no voice.

The AI component of AERO transforms this from a conventional audit enforcement program into something courts have not yet fully evaluated. Rather than deploying human auditors to review specific findings, AERO is designed to use AI analytical tools to re-evaluate and re-score years of historical Single Audit data, flagging patterns and irregularities through processes that the agency has not publicly explained. If HHS later uses an AI output as a material basis for withholding funds, disallowing costs, suspending or terminating an award, or initiating debarment, an affected grantee may be told what the system flagged without being given enough information to test why or learn how it reached that result.

II. The APA Framework: Three Grounds for Challenge

Section 706(2) of the APA provides the framework for judicial review of any final agency action. In relevant part, this provision mandates that a reviewing court shall “hold unlawful and set aside agency action, findings, and conclusions found to be (A) arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law; (B) contrary to constitutional right, power, privilege, or immunity; (C) in excess of statutory jurisdiction, authority, or limitations, or short of statutory right; [or] (D) without observance of procedure required by law[.]” 5 U.S.C. §706(2).

As further detailed below, the APA provides several avenues through which a federal fund recipient can challenge adverse government action under this new AI initiative.

A. Arbitrary and Capricious Review: A Fact-Based Challenge to Agency Action

The APA’s core judicial review provision, 5 U.S.C. § 706(2)(A), requires courts to set aside agency action that is “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” Motor Vehicle Manufacturers Ass’n v. State Farm, 463 U.S. 29, 43 (1983), established the governing standard: agencies must “examine the relevant data” and articulate a satisfactory explanation for their action including a “rational connection between the facts found and the choice made.” Agency action may be held to be “arbitrary and capricious” “if the agency has relied on factors which Congress has not intended it to consider, entirely failed to consider an important aspect of the problem, offered an explanation for its decision that runs counter to the evidence before the agency, or is so implausible that it could not be ascribed to a difference in view or the product of agency expertise.” Id.

On the current public record, AERO’s AI-driven methodology may be vulnerable under this standard if HHS cannot demonstrate how the tool’s outputs were generated, validated, reviewed, and connected to the statutory and regulatory criteria governing Single Audits. When an agency relies on an AI system whose conclusions cannot be meaningfully examined — because the system is opaque, technically complex, or contractually shielded by vendor proprietary claims — the agency may be able to show what the tool produced, but not why those outputs reflect the reasoned judgment the APA requires. A reviewing court should require HHS to articulate a rational, non-algorithmic basis for each determination. While an AI flag may support further agency investigation, it cannot substitute for agency reasoning. Id.

The Chenery doctrine reinforces this point. Under SEC v. Chenery Corp., 332 U.S. 194, 196-97 (1947), an agency decision must be judged solely on the reasons the agency articulated at the time it acted— not on post-hoc justifications developed for litigation. If an AERO enforcement action rests on AI-generated findings, but the administrative record contains no contemporaneous explanation of the data, methodology, human review, and reasoning connecting those findings to the sanction, HHS cannot cure that deficiency by constructing a new explanation in court. The decision stands or falls on what the agency said — and can show — at the time it acted.

B. Notice-and-Comment Rulemaking: A Procedural Defect at the Foundation

The APA’s notice-and-comment requirement, 5 U.S.C. § 553, mandates that agencies publish proposed substantive rules, receive public comments, and respond meaningfully to serious objections before a rule takes effect. A substantive rule — one that changes legal obligations or alters existing standards — cannot be issued by press release. See., e.g., Chrysler Corp. v. Brown, 441 U.S. 281, 303 (1979).

AERO was announced through exactly that mechanism. If the AI-driven methodology HHS uses to re-score audit data constitutes a substantive rule — if it changes the standard by which grantees are evaluated, alters the weight given to certain findings, or redefines what constitutes noncompliance — then it requires notice-and-comment rulemaking. Hospitals and other grantees had no opportunity to review the algorithmic criteria, challenge the model’s assumptions, test its accuracy against their actual compliance history, or comment on the methodology before it was applied to five years of their data. That is precisely the kind of procedural shortcut the APA was designed to prevent.

The Supreme Court has recognized that substantive rules promulgated without the required procedures are invalid. Id. Bowen v. Georgetown University Hospital, 488 U.S. 204, 208 (1988), further admonishes that retroactivity is not favored in the law; thus, “administrative rules will not be construed to have retroactive effect unless their language requires this result.”

Although AERO does not claim to create new audit requirements, the initiative uses AI tools to reach back at least five years into Single Audit data to re-score audit compliance through an algorithmic lens that did not exist — and was not subject to notice-and-comment — when that underlying data was initially generated and reviewed. Hospitals that complied with the standards in effect at the time their audits were conducted, that received no adverse findings under those standards, and that took corrective actions that were accepted by their cognizant agency, now face re-evaluation under criteria they never had the opportunity to review or contest.

The retroactive application of an unpromulgated methodology to review delinquent audit submissions and prior audit findings raises novel questions under 5 U.S.C. § 553 that federal courts have yet to resolve. This unsettled legal landscape presents an opportunity to challenge the program on that basis.

C. Procedural Due Process: The Constitutional Floor

Hospitals receiving federal awards may also have standing to raise due process challenges to the AERO initiative, provided they can establish a legitimate claim of entitlement to these funds under the law. Board of Regents of State Colleges v. Roth, 408 U.S. 564, 577 (1972). In assessing whether certain administrative procedures violate mandatory procedural safeguards, courts generally consider three factors: (1) the private interest affected by the state action; (2) the risk of an erroneous deprivation of that interest given the procedures used, as well as the probable value of additional or substitute safeguards; and, (3) the Government’s interest, including the fiscal and administrative burdens that the additional or substitute procedural requirement would entail. Mathews v. Eldridge, 424 U.S. 319, 335 (1976). For a hospital facing withholding of Medicaid DSH or GME payments — revenue streams that may sustain its operations — the private interest is substantial. The risk of erroneous deprivation by an opaque AI system operating on unknown parameters with five-year-old data is not theoretical; it is a structural problem that fails to provide the transparency that due process requires. And the government’s interest in administrative efficiency, while legitimate, does not outweigh these competing considerations.

Hospitals are well positioned to assert that HHS cannot withhold payments, suspend awards, or initiate debarment proceedings without first providing a grantee notice of AERO’s AI methodology, an opportunity to confront the specific basis for each new audit finding reached, and meaningful review of any findings by a credentialed human official. Grantees are entitled to understand not just what the AI tool concluded, but how it reached those conclusions. Failure to provide such information may violate a hospital’s due process right to confront adverse evidence.

III. Judicial Review Post-Loper Bright: Courts Must Exercise Independent Judgment

In Loper Bright, the Supreme Court overruled Chevron U.S.A. Inc. v. Natural Resources Defense Council, Inc., 467 U.S. 837, 842-44 (1984), and held that the APA requires courts to exercise independent judgment in deciding whether an agency has acted within its statutory authority or correctly followed the law. Statutory ambiguity no longer supplies a reason to defer to the agency’s interpretation. Agency views may still receive respect to the extent they are persuasive under Skidmore v. Swift & Co., 323 U.S. 134, 140 (1944), and courts must respect genuine delegations of discretionary authority, but the reviewing court must determine the best interpretation of the law when it reviews any agency action.

Importantly, the Supreme Court’s holding in Loper Bright removes a significant doctrinal barrier that challengers of agency action once faced and increases the likelihood that APA challenges will receive meaningful review in federal court.

IV. Using Current Trump Administration Standards as Evidence

Perhaps the most powerful evidence available to challenge the AERO initiative is that which the government has handed to challengers itself. Specifically, the Trump administration has issued two Executive Orders (13960 and 14179), and two Office of Management and Budget (“OMB”) Memoranda (M-25-21 and M-25-22), outlining the appropriate framework for using AI in the federal government, and HHS has adopted that framework through its Artificial Intelligence Strategy, as well as its Compliance Plan for OMB Memorandum M-25-21.

Executive Order 13960, Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government, 85 Fed. Reg. 78,939, 78,940-43 (Dec. 8, 2020), directs agencies to ensure that AI is lawful; purposeful and performance-driven; accurate, reliable, and effective; understandable; responsible and traceable; regularly monitored; transparent; and accountable. It applies to agency-developed and third-party AI used to advance agency missions or support decision-making, and it requires inventories of nonclassified, nonsensitive AI use cases. These requirements supply an additional means to challenge the agency’s AERO initiative. Are material inputs and outputs well documented and traceable? Are the system’s operations sufficiently understandable to subject-matter experts and users? Is the AI tool regularly tested, and are responsible human officials identifiable?

Executive Order 14179, Removing Barriers to American Leadership in Artificial Intelligence, 90 Fed. Reg. 8,741, 8,742 (Jan. 31, 2025), directs OMB to revise prior-administration AI policies to promote innovation and remove unnecessary barriers. M-25-21 implements that direction while retaining minimum safeguards for “high-impact AI.” See OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (Apr. 3, 2025). M-25-21 defines AI as “high-impact” when the output serves as a principal basis for a decision or action having a legal, material, binding, or significant effect on rights or safety, even when human oversight exists. Id. at 14. The memorandum also presumes high-impact status for AI used as a principal basis for granting or denying government benefits, fraud detection, and adjudicating penalties. Id. at 21.

If an AERO score materially drives payment withholding, cost disallowance, suspension, termination, or debarment, a plaintiff should assert that AERO’s use is high-impact, subjecting it to the minimum safeguard requirements outlined in M-25-21. These minimum requirements include pre-deployment testing, a documented AI impact assessment, independent review, ongoing performance and adverse-impact monitoring, operator training, appropriate human oversight and fail-safes, timely human review and an opportunity to appeal when appropriate, and a means for end users and the public to provide feedback. Id. at 15-17. A noncompliant high-impact AI function must be safely discontinued unless a properly documented waiver applies. Id. While these controls do not prohibit AI-assisted enforcement, they do require HHS to deploy it in an accountable and reviewable manner. Id.

HHS has incorporated these requirements into its current Artificial Intelligence Strategy and its Compliance Plan for M-25-21. Specifically, HHS’s Compliance Plan states that, by April 3, 2026, HHS divisions would apply M-25-21’s minimum risk-management practices to high-impact AI or stop the applicable tool until compliance was achieved. See HHS Compliance Plan for OMB M-25-21 at 8 (2025). Because AERO was announced after the April 3rd deadline, the administrative record should reveal HHS’s high-impact determination, impact assessment, independent-review comments, testing and monitoring materials, inventory entry, or any waiver for the AERO program.

OMB Memorandum M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government (Apr. 3, 2025), is equally important if HHS acquired any AERO component from a contractor or vendor. It directs agencies to obtain documentation needed to comply with M-25-21, test and evaluate proposed systems, include contract terms for ongoing monitoring and independent evaluation, and require testing results detailed enough to be independently verified or reproduced where practicable. Id. at 9-10. Vendor confidentiality therefore should not leave HHS unable to validate or explain an output on which it relies. Id.

While these authorities do not create a freestanding private right of action,¹ they can be used to identify the procedures and risk controls the Government itself considers necessary for reliable use of high-impact AI, help define what materials belong in the administrative record, and may reinforce arbitrary-and-capricious or other APA based arguments. If HHS has adopted mandatory internal procedures governing AERO, but failed to follow these procedures, it also may implicate the principle that agencies ordinarily must follow their own rules to avoid the risk that their actions will later be invalidated if challenged in court. See United States ex rel. Accardi v. Shaughnessy, 347 U.S. 260, 267-68 (1954); Morton v. Ruiz, 415 U.S. 199, 235 (1974). The core claims, however, should remain anchored in the APA, the Constitution, and the governing statutes and regulations.

The strategic implication of these executive directives is significant. While current Trump Administration policy promotes rapid AI adoption, it does not endorse unreviewable AI. Rather, the government’s own framework pairs innovation with testing, traceability, responsible human oversight, monitoring, and review for consequential uses. Hospitals should use these standards to challenge the government’s own evidence and any agency rationale for actions based on AI (rather than human) review.

V. What Hospitals Must Do Now

The legal landscape around AERO is genuinely unsettled — AERO launched on May 21, 2026, and no court has considered the legality of the program under the APA. This unsettled landscape cuts both ways: the absence of precedent creates risk, but it also creates the opportunity to shape the law on these issues. There is growing political and legal momentum around AI accountability in federal enforcement, and hospitals challenging AERO through APA litigation would be doing so in an environment increasingly receptive to scrutiny of algorithmic government decision-making.

For hospitals receiving AERO correspondence, six immediate priorities should govern any response:

First, preserve the administrative record. Every prior audit submission, every HHS correspondence accepting a corrective action plan, every prior finding and resolution — preserve it all. APA review is confined to the administrative record that exists at the time of the agency’s decision. Courts cannot consider evidence developed after the fact; what you don’t preserve, you cannot use.

Second, formally demand methodology disclosure. Before responding to any AERO finding, send a written request demanding the specific AI methodology, data inputs, weighting criteria, comparators, and validation studies HHS used to generate the finding. This demand serves multiple purposes: it creates a record of HHS’s refusal or failure to disclose; it may elicit information that undermines the finding on its merits; and it directly invokes the due process right to confront adverse evidence.

Third, file FOIA requests early. The Freedom of Information Act (“FOIA”) is a powerful tool for AERO challenges. File FOIA requests now for AERO’s AI methodology, training data, validation studies, bias assessments, and any government or internal investigations into the program’s accuracy. Often, a FOIA response will yield more information than a methodology disclosure demand alone will yield and may supply the factual foundation for a substantive challenge to this methodology.

Fourth, retain independent auditing expertise. An AI-generated re-scoring of historical audit data is not self-evidently correct. Independent auditors with expertise in Single Audit Act and Uniform Guidance compliance can assess whether the AI’s characterization of historical data is accurate, identify methodological flaws, and generate the expert foundation for an administrative or judicial challenge.

Fifth, insist on human review. Resist any pressure to concede findings without documented review and approval by a credentialed HHS official. An AI recommendation or finding that has not been independently reviewed by a qualified human — and confirmed on that basis — does not satisfy the agency’s own published standards, the APA’s reasoned explanation requirement, or the constitutional due process floor.

Sixth, respond substantively and build for litigation from day one. HHS has stated its willingness to work collaboratively with grantees. That collaborative posture should be taken seriously — but engagement should be strategic. Every substantive response to an AERO finding should be documented in writing, making clear the legal and factual basis for the hospital’s position and preserving the record for litigation. Counsel experienced in APA litigation should be involved from the first response to frame arguments in terms that will resonate in court.

VI. The Larger Picture

AERO is not an isolated regulatory development. It is the most recent example of a trend that has been accelerating across the federal government: the deployment of AI as the operative engine of enforcement, without the procedural safeguards — rulemaking, transparency, human accountability, bias testing — that the law requires. CMS’s Wasteful and Inappropriate Service Reduction (“WISeR”) initiative, which launched in January 2026 for Medicare prior authorization, deploys AI through private contractors who are paid on contingency based on what they allege to save the government. In each case, the legal framework is the same: the APA, the due process clause, and the government’s own published standards establish clear requirements that provide the means for challenging the unchecked or unsupported use of AI in agency decision-making.

Administrative law was built on the assumption that human beings make governmental decisions. Artificial intelligence challenges that assumption at its foundation. The courts have not yet fully reckoned with what algorithmic governance means for the doctrine of arbitrary and capricious review, the notice-and-comment framework, and the constitutional requirement of meaningful process. AERO will give them the opportunity. Hospitals that engage proactively — preserving records, demanding transparency, building administrative records, and pursuing challenges through both agency proceedings and federal court — will be best positioned to shape that law in their favor.

The legal landscape is unsettled. That is precisely why acting now matters.

Endnote

1. Executive Orders (“EO”) 13960 and 14179 and M-25-21 each contain disclaimers concerning judicially enforceable rights. See EO 13960, 85 Fed. Reg. 78939, 78,943; EO 14179, 90 Fed. Reg. 8,741, 8,742; OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (Apr. 3, 2025), n.4.