When Epic's AI Becomes the Default: Vendor Lock-In Through a GCC Lens

On 14 August 2026, STAT reported that the US Federal Trade Commission was examining Epic Systems for potential antitrust violations. Reuters separately reported that investigators had sought information from other health technology companies about how Epic grants or withholds access to data.

The FTC has made no public finding against Epic, and the inquiry may end without a case. Epic responded on 18 August that it leads on interoperability and does not engage in anticompetitive behaviour. An investigation should not be converted into a verdict by a LinkedIn feed, a process the internet can usually complete before breakfast.

The episode does provide a useful moment for those of us working in digital health from the Middle East. My feed includes many thoughtful colleagues in the United States and wider North America, yet their conversations about informatics repeatedly orbit Epic. Innovation is assessed through what Epic has built, which companies it will integrate, what data it will expose and where its roadmap is heading.

After 13 years in digital health, I see the risk as architectural. A vendor can become so embedded in the clinical, operational and commercial life of a health system that its product boundaries begin to shape the industry's boundaries. AI takes that dependency into a more consequential layer. The GCC still has room to keep its own centre of gravity.

Epic Earned Its Position

Any serious analysis should begin by recognising why Epic has become so influential. It built an integrated system, developed a disciplined implementation model and persuaded major institutions that one coherent environment could reduce the friction created by disconnected products. According to STAT, about 82% of Americans have at least one record stored in Epic, and the company supports records associated with 57% of US inpatient hospital beds.

Epic also has successful users in our region. Dubai Health received Epic's highest Gold Stars rating in 2025 and reported using more than 95% of the programme's recognised features. The system connects records across Dubai Health hospitals and centres. This is a substantial institutional achievement, and Epic's strengths in workflow, implementation and usability deserve credit.

Vendor lock-in can arise without misconduct and alongside a strong product. It grows through the accumulation of switching costs. Clinical templates, revenue-cycle rules, staff skills, interfaces, reporting logic and years of local configuration gradually become inseparable from the platform. A migration then requires more than moving data. It requires rebuilding how the institution works.

A March 2026 analysis in PLOS Digital Health describes how high switching costs, proprietary architecture and same-vendor network effects can reinforce this dependence. The paper also recognises the efficiencies that integrated systems create and the disruption that poorly designed remedies could cause. That balance matters. Integration is valuable. The strategic issue is who controls the terms under which integration occurs.

AI Deepens the Dependency

Epic's AI direction is broad and coherent. Its current portfolio includes Art for clinicians, Emmie for patients and Penny for revenue-cycle and operational work. AI Charting listens during visits, drafts notes and queues orders. Chart summaries draw information from the medical record. Emmie works through MyChart, while Penny operates inside billing and administrative processes. In August, Epic added Ergo Visit, which draws on the EHR, MyChart and Cosmos to prepare clinicians for appointments and help assemble documentation and orders.

Epic is also developing its own family of generative predictive models. In February, the company said Curiosity had been trained on Cosmos, a dataset containing more than 300 million deidentified patient records. The models learn from diagnoses, medicines and laboratory results to project possible patient trajectories. Alongside that work, Epic's long partnership with Microsoft has placed Azure OpenAI services inside Epic workflows.

This architecture has an obvious advantage: the AI already sits where clinicians work and where the relevant context lives. It also changes the nature of lock-in. Prompts, local evaluations, user corrections, monitoring thresholds, workflow automations and institutional knowledge begin accumulating around the vendor's intelligence layer. Even a technically complete export of the patient record may leave much of that operational learning behind. Software lock-in becomes intelligence lock-in.

A July 2026 Redesign Health survey makes the purchasing effect unusually clear. Among 112 senior executives at US health systems already using Epic, 71% described their organisations as “Epic-first”, 70% said their emphasis on Epic modules had grown during the previous three to five years, and 80% expected Epic to become an even greater priority. A combined 91% had complete or significant confidence that Epic's AI would become as good as the best external alternatives. Nearly half accepted that an Epic product could be “good enough” when the friction of deploying another vendor was considered.

The sample consists entirely of Epic customers, so it cannot describe the whole market. It does describe the commercial environment facing an independent health AI company. Product quality is only one part of the contest. Access to workflow, data, procurement attention and implementation capacity already favours the incumbent.

Evidence for Epic's newer generative tools is still developing. A January 2026 study of an Epic-integrated chart review tool examined feedback from ten physicians using GPT-4 through a single standardised prompt. The researchers could not disclose the full software code because it was proprietary to Epic. This was a small, early evaluation, so it supports careful local testing more than any sweeping judgement.

The history of the Epic Sepsis Model gives that principle some weight. A 2021 external validation in JAMA Internal Medicine, covering 38,455 hospitalisations at one academic centre, reported an area under the curve of 0.63, below Epic's internally reported range of 0.76 to 0.83. The study found that the model missed 67% of sepsis cases while generating alerts in 18% of hospitalisations. That older predictive model is different from today's generative portfolio. Its lesson remains current: convenient integration cannot substitute for transparent, local and independent validation.

The GCC Has Chosen a Different Centre

The UAE and Saudi Arabia are placing sovereign data, compute, models and national capability at the centre of their AI strategies. In May, the UAE Cabinet approved a national policy for digital healthcare and AI built around an integrated national health system, smart infrastructure, national skills, security, ethics and data governance. In June, the new UAE Artificial Intelligence and Data Authority received a mandate to operate national data platforms, manage government data, set AI and data standards and build national capability.

This direction is already visible in infrastructure. The UAE's FedNet sovereign cloud stores and processes government data under UAE law and provides GPU capacity for developing AI solutions. Saudi Arabia made 2026 its Year of Artificial Intelligence, with SDAIA leading national strategy, infrastructure and capability development. The Kingdom's National Information Center operates the National Data Bank, government cloud, secure network and national analytics platforms.

Health information exchange adds another layer of regional freedom. Riayati integrates with Abu Dhabi's Malaffi and Dubai's NABIDH, allowing the longitudinal record to cross institutional and vendor boundaries. By June 2025, NABIDH connected 1,888 facilities using 91 electronic medical record systems. This multi-system design gives the UAE a foundation on which institutional EHRs can be participants in a national architecture.

Against that agenda, the fit with an Epic-first AI model is incomplete. The UAE and Saudi Arabia actively partner with leading global technology companies, and those partnerships remain central to their ambitions. Sovereignty concerns effective control over where sensitive data is processed, which models may be used, how systems are evaluated, whether Arabic and locally developed models can connect, and how a supplier can be changed without losing the intelligence built around years of care.

Sovereignty Is More Than Data Residency

A server located inside the country answers one part of the question. A sovereign health AI architecture also needs authority over model selection, inference routes, audit logs, evaluation datasets, upgrade timing and exit. If an institution can retain its records while remaining unable to move its prompts, safety evidence, workflow agents or feedback history, its practical freedom is limited.

The exchange layer can protect that freedom when its rules are public and operational. Qualified products should reach appropriate longitudinal context through governed APIs, clear consent, conformance testing and monitored purposes of use. Hospitals can then choose Epic, Oracle Health, InterSystems or a regional system for clinical workflow while the shared architecture preserves access for safe specialist products and national AI services.

Public ownership alone provides no automatic cure. An HIE can reproduce dependency if one operator controls specifications, onboarding or secondary use without review. Participation criteria, security decisions, refusals and appeal paths need to be visible. A standard mentioned in a policy document has modest value when each implementation still requires a private negotiation and several months of diplomatic email.

The Questions GCC Buyers Should Ask

Procurement now needs to examine the intelligence layer with the same seriousness once reserved for the database. Where are prompts and inference processed? Can the organisation select or replace the underlying model? Can a locally developed Arabic model connect to the same workflow? Who owns evaluation data, user feedback and safety-monitoring results? Can those assets be exported in usable form?

Boards should also require evidence that an AI capability works across the populations, languages and care settings it will serve. Vendor studies can begin that assessment. Independent local validation, continuous monitoring and transparent failure reporting should decide whether deployment continues. Model performance will drift, clinical practice will change and a confident demo remains a remarkably poor substitute for governance.

Exit provisions belong in the original contract. Suppliers should demonstrate data, configuration, prompt, audit and evaluation portability before implementation. Fees, transition support and timeframes should be explicit. Exit terms negotiated after ten years of customisation tend to resemble a hostage negotiation with better stationery.

In my own product and advisory work, I would want a GCC health board to decide where each capability should live before asking which supplier sells it. Patient identity, consent, longitudinal exchange, AI assurance and audit need accountable shared governance. Institutional systems can then compete on clinical workflow, service and outcomes within those rules.

The #Ramyfications Worth Holding Onto.

Epic is a capable company, and its AI strategy shows a clear understanding of where healthcare intelligence becomes useful: inside the record, the workflow and the patient relationship. The same integration that creates value also raises switching costs and gives one roadmap unusual influence over what a health system can imagine and buy.

The GCC has a brief architectural advantage. Its health information exchanges, sovereign cloud investments, national AI institutions and comparatively new infrastructure allow the region to keep data and intelligence larger than any individual vendor.

Epic and other global suppliers can contribute substantially within that model. The governing principle should remain simple: vendors may power important parts of the system, while public institutions retain control of the architecture, the intelligence and the freedom to change course.