Health AI has 2 rulebooks, and the states are writing the thicker one. Since 2024, state legislatures have passed at least 20 laws on how artificial intelligence may be used in health coverage and care, by our count. The federal rulebook is thinner and works differently. It runs mostly through agency rules for Medicare and guidance for medical software. Alongside it, the White House has pressed to preempt state AI laws, though Congress has not acted.
The 2 rulebooks overlap less than they seem. State insurance laws do not reach Medicare Advantage plans, which follow federal standards. Federal rules for Medicare do not reach commercial plans. Neither reaches the first coverage decision in a self-funded employer plan, the kind that covers a large share of workers with job-based insurance.
Redlake’s view, at the end, is that the rule most states now share should become a national floor.
Key takeaways
- States lead on coverage decisions. At least 11 states now bar insurers from denying care based solely on AI, most of them since 2025.
- The state rules converge. Nearly every state law lets software assist and requires a qualified person to make or review a denial.
- States also regulate clinical AI. Laws in California and Texas require disclosure of AI in patient care, and Illinois bars AI from making therapy decisions.
- Federal rules are narrower. CMS bars AI-only denials of admissions in Medicare Advantage. No federal law sets rules for AI in commercial coverage.
- Preemption has not arrived. An executive order targets state AI laws, but it cannot preempt them on its own. No federal preemption bill had been introduced by mid-September.
- The gaps follow plan type. Self-funded employer plans fall outside both rulebooks for the first coverage decision.
- Redlake supports a national floor. The human denial rule should apply to every plan, and states should keep the power to go further.
The state rulebook
Coverage decisions
Most state activity targets coverage decisions, the prior authorization and utilization review choices that decide whether a plan pays. California went first. Its SB 1120, effective January 1, 2025, bars insurers from using AI as the sole basis for medical necessity denials. A licensed physician or qualified provider must make the final decision, according to the Kansas Legislative Research Department.
Another 10 states followed. The table lists the coverage laws in order of effective date.
| State | Law | Effective | The rule |
|---|---|---|---|
| California | SB 1120 | January 1, 2025 | A licensed physician or qualified provider makes final medical necessity decisions |
| Maryland | HB 820 | October 1, 2025 | AI must rely on the patient’s own record, with quarterly reviews of its performance |
| Texas | SB 815 | January 1, 2026 | AI may not make adverse medical necessity determinations |
| Nebraska | LB 77 | 2026 | AI output may not be the sole basis for a denial, and its use must be disclosed |
| Washington | SB 5395 | June 11, 2026 | Only a licensed professional may deny on medical necessity grounds |
| Arizona | HB 2175 | July 1, 2026 | A clinician must independently review a claim or request before it is denied |
| Iowa | HF 2635 | July 1, 2026 | AI may assist the initial review but may not alone support an adverse decision |
| Alabama | SB 63 | October 1, 2026 | AI may not alone make coverage decisions. Insurers certify their controls each year |
| Georgia | SB 444 | January 1, 2027 | AI may not issue an adverse determination without a qualified person and a clinical peer |
| Colorado | HB26-1139 | January 1, 2027 | A qualified professional reviews every denial |
| Utah | SB 319 | January 1, 2027 | Adverse determinations rest on independent medical judgment |
Compiled from legislative records and published summaries, including our review of 2026 state utilization review laws.
Maryland’s law shows how far the rules have moved beyond a simple ban. Its AI tools must base decisions on the enrollee’s own clinical history rather than group statistics. Carriers must review AI performance at least quarterly and make their tools available for audit by the insurance commissioner, according to Alston & Bird.
Arizona’s law, effective July 1, 2026, states the principle most plainly. “The sole use of any other source to deny a claim or prior authorization is prohibited,” according to the Kansas summary.
Texas goes furthest. Its SB 815 bars the use of AI to make adverse medical necessity determinations at all. Insurers may use AI only for administrative support or fraud detection, according to the Kansas summary. Nebraska adds disclosure. Insurers must tell providers and enrollees when AI is used in utilization review, and they must post that information on their websites.
Claims and downcoding
In 2026, states began applying the same idea after care is delivered. Indiana bars AI as the sole basis for downcoding a claim without a professional’s review of the record. Illinois and Virginia passed laws that put people in charge of downcoding decisions or disputes, as our September 1 review described. Illinois’s law does not take effect until January 2028.
Patients and clinicians
A second group of laws governs AI in care itself.
| State | Law | Effective | What it requires |
|---|---|---|---|
| California | AB 3030 | January 1, 2025 | Disclaimers on patient messages written by generative AI, unless a licensed provider reviewed them |
| Texas | SB 1188 | September 1, 2025 | Practitioners must review AI-generated records and tell patients when AI is used |
| Texas | HB 149 | January 1, 2026 | Providers must disclose AI used in a patient’s care or treatment |
| California | AB 489 | Signed October 2025 | AI systems may not imply that they are licensed health professionals |
Compiled from the law firm and association summaries cited in this analysis.
California’s AB 3030 was one of the first laws aimed at generative AI in care. It requires a disclaimer when AI writes a message to a patient about clinical information, unless a licensed provider reviews the message first, according to ArentFox Schiff. Our earlier piece on AI disclaimers argued that a label alone does not make a message safe.
Texas pairs disclosure with practice rules. Under SB 1188, a practitioner may use AI for diagnosis and treatment recommendations within the scope of a license, according to Akin. The practitioner must review AI-generated records, and the law requires electronic health records to be kept physically in the United States. California’s AB 489, backed by the California Medical Association, lets licensing boards act against AI systems that present themselves as licensed clinicians.
Mental health
Mental health drew the sharpest limits. Illinois enacted a law in August 2025 that bars AI from making therapeutic decisions without licensed clinician oversight, while allowing administrative uses, according to the Association of Health Care Journalists. Nevada passed a similar ban in June 2025, with civil penalties of $15,000. Utah requires mental health chatbots to make clear that they are not human, and it limits the sale of users’ health information.
Colorado’s 2026 law adds a coverage angle. It bars insurers from covering psychotherapy delivered by AI, according to Becker’s Payer Issues.
Broad AI laws
Colorado also wrote the most ambitious general AI law, then rewrote it. The original Colorado AI Act of 2024 regulated high-risk AI systems used in consequential decisions, including health care. In May 2026, the legislature replaced it with SB 26-189, which Governor Jared Polis signed on May 14, according to Holland & Knight. The new law takes effect January 1, 2027.
The new law gives consumers notice before automated tools influence a consequential decision. After an adverse outcome, it gives them a plain explanation and a right to meaningful human review. The reviewer must have authority to override the system and must not default to its output.
The rewrite matters for health care because of what it leaves out. HIPAA-covered entities are broadly exempt from its core obligations outside employment, and insurers already subject to Colorado’s insurance rules on algorithmic discrimination are deemed compliant. FDA-regulated devices are excluded. The law that drew national attention now reaches health care mainly through the sector rules described above.
What the states agree on, and where they split
The states agree on more than their different statutes suggest.
- Software may help. No state bans AI from utilization review. Several expressly allow it for approvals or initial screening.
- A person decides against the patient. Every coverage law reviewed here requires a qualified person to make or review an adverse decision.
- The patient’s own record governs. Several states, including Maryland and Colorado, require decisions based on the individual’s clinical history rather than group data.
Every state that has written a coverage rule for AI has landed in the same place. Software can say yes. A person must say no.
They split on the details.
- Who counts as the reviewer. Washington requires a licensed professional, and Georgia requires a clinical peer.
- How AI is defined. Some laws say artificial intelligence, and others reach software tools generally.
- What must be disclosed, and to whom. Nebraska requires public disclosure, while Utah requires disclosure to the state and to the people affected.
- How compliance is shown. Alabama requires an annual certification, and Maryland requires quarterly performance reviews.
The splits are mostly about proof. The states share a rule but not a way of showing that a plan followed it. That is the gap our September 1 review proposed to close with a common decision record.
The federal rulebook
Coverage in Medicare
The federal rules for coverage AI apply mainly to Medicare. Under CMS’s 2024 rule, Medicare Advantage plans must base medical necessity decisions on the individual patient’s circumstances. CMS’s February 2024 answers added that “algorithms or artificial intelligence alone cannot be used as the basis to deny admission or downgrade to an observation stay.”
CMS has also put AI to work in traditional Medicare. The WISeR model, which began January 1, 2026, in 6 states, uses technology companies to review prior authorization requests for selected services. Clinicians make any denial, as our analysis of WISeR described. The companies are paid a share of the spending their reviews avert. In July 2026, the Senate rejected a resolution to disapprove the model, according to WEDI.
Coverage in Medicaid
Medicaid managed care already has a federal version of the human denial rule, though it predates the AI debate. Any decision to deny a service authorization request, or to approve less than was requested, must be made by an individual with appropriate expertise in the enrollee’s needs, under 42 CFR § 438.210(b). The rule does not mention AI. It does not need to, because it already says who must decide.
States add their own terms through managed care contracts, and some apply their insurance laws to Medicaid plans as well. The result varies by state, but the federal floor is clear.
Medicare Advantage and state law
Medicare Advantage plans are also largely shielded from state AI laws. Federal Medicare Advantage standards supersede state law, other than licensing and solvency laws, under 42 CFR § 422.402. A state’s ban on AI-only denials applies to the commercial plans it regulates. It generally does not apply to a Medicare Advantage plan in the same state.
Clinical software
For clinical AI, the federal work is split among several offices.
- FDA regulates software that functions as a medical device. Its revised guidance on clinical decision support, issued in January 2026, widened the range of tools outside its active oversight, as our review of the guidance described.
- ASTP, the federal health IT office, has required certified health IT to show source information about decision support tools since 2025. It proposed in December 2025 to remove those requirements, and the proposal was still pending in mid-September.
- The Office for Civil Rights enforces Section 1557. Since May 2025, it has required covered entities to make reasonable efforts to identify and reduce discrimination risks in patient care decision support tools, as our analysis of the rule described.
The direction of travel is toward lighter federal oversight of clinical software. FDA’s 2026 guidance and ASTP’s proposal both reduce requirements. The Section 1557 duty remains, but it asks for reasonable efforts rather than specific tests. None of these clinical rules governs coverage decisions, and none of the coverage rules governs clinical advice.
Preemption
The broadest federal move targets the states themselves. Executive Order 14365, signed December 11, 2025, created a Justice Department task force to challenge state AI laws. It also directed the Commerce Department to identify state laws it considers onerous, according to White & Case. The firm noted that the order would likely not independently displace state AI laws. Only Congress or a court can do that. The order also called for a federal legislative framework that would leave some state laws in place, including child safety protections.
Congress has not acted. The Senate voted 99-1 in July 2025 to strip a 10-year moratorium on state AI laws from the budget bill, according to TechCrunch. A House discussion draft released June 4, 2026 would preempt state laws “specifically regulating the development of” AI models for 3 years, according to DLA Piper. It would not reach state laws of general applicability, and it had not been introduced as a bill by mid-September.
The draft’s focus is telling. It targets how AI models are built, not how insurers use them. State rules on AI in coverage decisions regulate use, so they would likely survive it. Even a broader federal law would face a particular obstacle in health insurance. The McCarran-Ferguson Act leaves insurance to the states unless a federal law specifically relates to the business of insurance, as our analysis of federal preemption explained.
How the 2 rulebooks fit together
Set side by side, the 2 rulebooks leave gaps that follow the type of plan rather than the type of AI.
| Plan type | State AI coverage laws | Federal AI coverage rules |
|---|---|---|
| Fully insured commercial plan | Apply | None specific to AI |
| Self-funded employer plan | Do not apply | None specific to AI |
| Medicare Advantage | Generally do not apply | CMS rules and guidance |
| Traditional Medicare | Do not apply | WISeR model rules in 6 states |
| Medicaid managed care | Depend on state law and contracts | Denials made by an individual with appropriate expertise |
Compiled from the laws and regulations cited in this analysis.
The table shows where the gap is. A worker in a fully insured plan in Washington is protected by state law from an AI-only denial. A Medicare Advantage enrollee is protected by CMS’s rules. A worker in a self-funded plan in the same state has neither protection for the first decision.
The gap matters in practice because self-funded plans often use the same review vendors and software as insured plans. A tool configured to meet Washington’s rule for an insured client may run under different settings for a self-funded client down the street. The patient sees the same letterhead and gets a different set of protections.
Federal law does reach self-funded plans on appeal. ERISA’s claims rules require a plan to consult a health care professional with appropriate training when an appeal turns on medical judgment, under 29 CFR § 2560.503-1. They say nothing about AI in the first decision. Our review of AI coverage litigation found that courts have filled some of that space by holding plans to their own promises.
Clinical AI has a different gap. FDA’s oversight narrowed in 2026, and ASTP proposed to drop its transparency requirements. The states that regulate clinical AI have focused on disclosure and on mental health. The clinical tools in between, which advise clinicians without making decisions, face little direct oversight at either level.
What to watch in the rest of 2026
- ASTP’s final rule. Watch whether the decision support transparency requirements survive.
- The Justice Department task force. Watch for any challenge to a state health AI law.
- The House discussion draft. Watch whether it is introduced, and whether its scope reaches insurance.
- State bills for 2027. Watch for laws that extend AI rules to downcoding and to Medicaid contracts.
- WISeR results. Watch for CMS data on approval rates and appeals in the model’s first year.
Where Redlake stands
Redlake builds tools that health plans use in utilization review. We wrote our own rules for AI before most of these laws existed, and we hold to them whatever the law requires. A machine can say yes, but only a person can say no. Every recommendation shows its reasons. Every decision can be reconstructed.
Those rules lead us to 5 positions on the questions this analysis describes.
- The human denial rule should be a national floor. No plan should deny or reduce care based solely on AI, including the self-funded employer plans that state law cannot reach. Congress or the Labor Department could extend the rule through ERISA’s claims regulations. Medicaid’s managed care rule already shows how simple the language can be.
- States should keep the power to go further. A federal floor should not become a ceiling. State insurance regulators have written the most detailed rules so far, and broad preemption would erase them without replacing them.
- Regulate the record, not only the conduct. Every adverse decision should carry a record of who decided and what any software contributed. That record lets regulators enforce whichever rules apply, as our September 1 review argued.
- Tell patients when AI was involved. A patient who receives a denial should learn whether software played a part. The notice should also name the role of the person who decided and say how to reach them.
- Measure how often AI-assisted decisions are overturned. Plans should report how often decisions that involved AI are reversed on appeal. A tool whose decisions are often reversed is a tool that needs review.
Coverage AI and clinical AI deserve different rules. A coverage tool’s worst failure is a wrongful denial, and the remedy is a person who decides. A clinical tool’s worst failure is wrong advice, and the remedy is validation that clinicians can see. Laws that treat them the same will regulate one of them badly.
Regulators should still ask the same 2 things of every tool, however it is labeled. They should ask what it recommended, and whether a person checked it before a patient lost care. A plan that can answer both for every decision is a plan that can be trusted with software.
We welcome the human denial rule wherever it is written, and we would welcome it most as a single national standard. The goal is not less AI in health care. It is AI that can be checked, used by people who answer for its results.
About this analysis
Method. The laws covered are state laws on AI in health coverage and care enacted from 2024 through mid-September 2026, and the federal rules and executive actions that bear on them, taken from primary legal sources and published summaries.
Data notes. Our count of state laws is a floor rather than a census. Some summaries describe laws in less detail than the statutes. Effective dates come from legislative records where available and otherwise from the summaries cited. The positions in the final section are Redlake’s.
Sources. Kansas Legislative Research Department briefing (March 2026). Alston & Bird on Maryland HB 820 (September 2025). ArentFox Schiff on California AB 3030 (October 2024). Akin on Texas SB 1188 and HB 149. California Medical Association on AB 489 (October 2025). Association of Health Care Journalists (August 2025). Becker’s Payer Issues (July 2026). Holland & Knight on Colorado SB 26-189 (May 2026). CMS answers on the 2024 Medicare Advantage rule (February 2024). WEDI federal update (July 2026). White & Case on Executive Order 14365 (January 2026). TechCrunch (July 2025). DLA Piper on the House discussion draft (June 2026). Federal regulations at 42 CFR § 422.402 and 29 CFR § 2560.503-1.
Frequently asked questions
Which states ban AI-only coverage denials?
At least 11 states had enacted such laws by mid-September 2026, starting with California’s SB 1120, which took effect in 2025. The first table in this analysis lists each law with its effective date.
Do state rules on automated denials reach MA plans?
Generally not. Federal Medicare Advantage standards supersede state law other than licensing and solvency laws. CMS’s own rules and guidance govern AI in Medicare Advantage decisions.
Can the executive order preempt state AI laws?
Not on its own. An executive order can direct agencies and litigation, but preemption requires a federal law or a court ruling.
Does Medicaid require a person to make denials?
Yes, in managed care. Federal rules require any denial, or any approval for less than was requested, to be made by an individual with appropriate expertise in the enrollee’s needs.
What does federal law say about AI in commercial insurance?
No federal law sets rules for AI in commercial coverage decisions. Fully insured plans follow state law, and self-funded plans follow ERISA’s general claims rules.
What does Redlake support on artificial intelligence?
Redlake supports a national floor that bars AI-only denials in every plan, with states free to go further. We also support a common decision record and disclosure to patients when AI is involved in a decision about their care.