At least 9 states now bar AI-only coverage denials

At least 9 states now bar AI-only coverage denials. Starting with California in 2024, state legislatures have converged on a simple principle for health insurers that use artificial intelligence in utilization review. Software may help, but a qualified person must make any adverse decision. That decision must rest on the patient’s own circumstances. Several more states acted in 2025, and 5 enacted laws of their own between March and mid-May 2026.

The agreement on principle is striking, especially in a year when federal agencies have moved away from prescriptive AI rules. The laws differ in how much they say about what a human review must involve, and most leave the hardest questions to regulators and to the plans themselves. The central one is what makes a review real, from how long a reviewer must spend to what record proves that a person, not a model, made the decision.

The laws are described as of mid-May 2026, with what they leave open, and then set against federal rules and the practical work of compliance.

Key takeaways

• A common rule is forming. At least 9 states prohibit adverse coverage decisions based solely on AI or require a licensed clinician to make them.
• 2026 was a busy year. Between March and May, 5 more states enacted laws.
• Individual circumstances matter. Several laws require that AI-assisted decisions rest on the enrollee’s own history and clinical facts, not group data alone.
• Approvals are treated differently. The laws restrict AI in adverse decisions, leaving room for automated approvals and administrative uses.
• The laws reach state-regulated plans. Self-funded employer plans and Medicare Advantage are generally governed by federal rules instead.
• Federal pressure on state AI laws is rising. A December 2025 executive order directed federal challenges to state AI laws, and health care laws were not among its listed exceptions.

The state laws

The Kansas Legislative Research Department’s 2026 briefing summarized the laws in place at the start of the year, and state legislatures added more in the spring.

Compiled from state legislative records and from summaries by the Kansas Legislative Research Department (March 2026) and Holland & Knight (July 2025). Descriptions summarize each law’s central provision and omit details.

The table shows 2 features worth noting. First, the laws come from states with very different political leanings, from California and Washington to Texas and Alabama, and the principle that a person should make a denial has not divided along party lines. Second, the 2026 laws arrived quickly. All 5 were enacted between mid-March and mid-May, and bills were pending in other states when this piece was written.

Colorado is often listed with these states for a different reason. Its insurance regulators adopted rules requiring insurers to govern and test their AI models and their use of external consumer data, which address AI in insurance broadly rather than utilization review specifically.

What the laws have in common

Read side by side, the laws share 5 elements, though no single law contains all of them.

A person makes the adverse decision. Every law in the table either prohibits AI from being the sole basis for a denial or requires a physician or other licensed clinician to make it. Arizona goes furthest on who that person is, requiring a medical director licensed in Arizona to review each medical necessity denial individually and to sign the written denial personally, according to the law’s summary.

The decision rests on the individual. California and Maryland, among others, require that AI-assisted decisions consider the enrollee’s own medical history and clinical circumstances. California’s law also bars tools from basing decisions solely on group data sets.

Regulators can look inside. Several states, Texas and California among them, make AI tools used in utilization review subject to inspection or audit by state regulators. Under Texas’s law, AI use in utilization review may be audited or inspected at any time.

Patients and providers are told. Nebraska and Utah require disclosure of AI use, and Nebraska requires it to be posted on the payer’s website. Texas requires that a notice of an adverse determination describe the source of the screening criteria and review procedures used.

Other uses remain allowed. The laws generally leave room for AI in administrative work and in approvals. Iowa’s law says so explicitly for initial review, and Texas allows AI for administrative support and fraud detection. The restriction falls on the adverse decision.

That last element reflects an asymmetry that makes sense. An automated approval gives a patient the care a clinician requested. An automated denial withholds it, so the requirement for human judgment sits where a wrong answer costs the patient.

The laws place the burden of human judgment where the consequence of a wrong answer falls on the patient.

What the laws leave open

The principle is settled. The practice is not. Several questions will determine whether the laws change how decisions are made or only how they are documented.

The meaning of solely. A law that bars denials based solely on AI is satisfied, on its face, if a person is involved. It does not say how. A reviewer who accepts a tool’s recommendation after a glance has technically made the decision. Texas’s phrasing, which bars automated systems from making an adverse determination in whole or in part, is stricter, but it raises its own question of how much a tool can contribute before it is making part of the decision.

What makes review real. Most of the laws do not specify what a reviewer must see or how a plan should show that the reviewer exercised independent judgment. Arizona’s requirement of individual review and a personal signature is the most concrete. Elsewhere, the content of review is left to regulators and plans.

Who is covered. State insurance laws reach fully insured commercial plans and, in many cases, state Medicaid managed care. They generally do not reach self-funded employer plans, which ERISA governs, or Medicare Advantage, for which federal standards largely preempt state rules. Many patients will not be protected by these laws at all, and the plans that cover them will be governed by a mix of federal rules.

Delegated vendors. Many plans delegate utilization review to vendors that supply both the tools and the reviewers. The laws apply to the insurer or utilization review agent, but enforcement will depend on how regulators treat delegated arrangements and whether vendor contracts give plans enough visibility to show compliance.

Regulators’ capacity to check. Inspection rights matter only if regulators have the technical capacity to use them. State insurance departments will need people who can evaluate how a tool is used in review, not only what it was designed to do.

The federal backdrop

The state laws are filling a space that federal rules address only in part.

For Medicare Advantage, CMS’s rules require that coverage decisions reflect the individual enrollee’s circumstances and that adverse medical necessity decisions be reviewed by a physician or other appropriate professional. In February 2024, CMS said plans may use algorithms, but decisions must be based on the individual patient’s circumstances, including medical history and the treating physician’s recommendations. Tools that rely on larger data sets rather than the individual would not comply. CMS declined to finalize broader guardrails for AI in its contract year 2026 rule, and, as we noted in April, did not revisit them for 2027.

At the same time, federal policy on state AI regulation has been contested. In July 2025, the Senate voted 99 to 1 to strip a proposed 10-year moratorium on state AI laws from the budget reconciliation bill. Then in December 2025, the President signed an executive order directing the Attorney General to create an AI Litigation Task Force to challenge state AI laws. The order also told the Commerce Department to evaluate state laws within 90 days and allowed some federal funds to be conditioned on how states regulate AI. According to Maynard Nexsen’s analysis, the order’s listed exceptions, such as child safety, do not include health care. Existing state laws remain enforceable unless a court enjoins them or Congress preempts them.

Whether state laws on AI in coverage decisions become targets is uncertain. They regulate insurance, which states have long regulated, and they impose obligations on how insurers decide claims rather than on how AI systems are built. Those features may make them harder to challenge than broader state AI laws. But the possibility adds uncertainty for plans that operate in many states.

What compliance looks like

For a plan operating in several of these states, the practical requirements converge on a design that would be sensible even without the laws.

• Route every potential denial to a qualified person. A tool may recommend or prioritize. An adverse medical necessity decision should require an affirmative decision by a reviewer with the license and expertise the state requires.
• Show the reviewer the basis. The reviewer should see the facts from the record that met or missed each criterion, with enough detail to disagree with the tool. A score is not a basis.
• Record what the reviewer did. The record should show who reviewed the case and what they were shown. It should also capture the reasons for the decision, in the reviewer’s own words where possible.
• Keep approvals fast. Automated approvals for requests that clearly meet criteria are consistent with every law in the table, and they reduce the volume that reviewers must handle carefully.
• Track licensure by state. Where a state requires in-state licensure for the reviewing physician, the routing system needs to know the member’s state and the reviewer’s licenses.
• Write disclosures that inform. Notices that describe the criteria used and the role of any automated tool satisfy disclosure requirements and help members and providers understand decisions.
• Prepare for inspection. Regulators with audit rights will ask how a tool’s recommendations are validated and how often reviewers disagree with them. Plans should be able to answer with data.

Where Redlake stands

We build tools health plans use in utilization review, and our first rule is the one these laws are converging on. A clinician makes every denial. A machine can say yes, but only a person can say no. We adopted that rule because it is right, not because a statute required it, and we are glad to see legislatures across the political spectrum reach the same conclusion.

We also think the laws’ hardest question, what makes human review real, should be answered by design rather than left to interpretation. Every recommendation we provide shows its reasons, in the form of the criteria applied and the facts from the record that met or missed them, and every decision can be reconstructed, including what the reviewer saw. As we argued in April, plans should also measure how often reviewers disagree with recommendations, because a reviewer who never disagrees may not be reviewing.

The laws set a floor. Plans that build review processes a regulator or a court would recognize as genuine will not need to worry about where the floor is.

What to watch in 2026

• More states. Whether bills pending in other states, including Colorado and Illinois, become law, and whether the remaining large states follow.
• Rulemaking and guidance. How insurance regulators define independent review and what records they expect.
• Arizona’s start. How plans implement Arizona’s individual review and signature requirements when the law takes effect in July.
• Federal action. Whether the Commerce Department’s evaluation or the AI Litigation Task Force targets state laws on AI in coverage, and whether Congress acts on preemption.
• Medicare Advantage. Whether CMS returns to AI guardrails for coverage decisions, which would bring federal rules closer to the state consensus.

About this analysis

Basis. The state summaries draw on the Kansas Legislative Research Department’s 2026 briefing and on state legislative records, including Washington’s record for SB 5395. Law firm analyses informed the descriptions of the Texas and Arizona laws and of the December 2025 executive order.

Data notes. The table summarizes each law’s central provision. Many laws contain exceptions and definitions not described here, and effective dates vary. The count of at least 9 states includes laws that bar AI-only denials or require a clinician to make adverse determinations, and excludes Maryland and Colorado, whose provisions address AI in other ways. None of this is legal advice.

Sources. Kansas Legislative Research Department (March 2026). Holland & Knight (July 2025). Maynard Nexsen (December 2025). Washington State Legislature, SB 5395 (2026). State legislative records for the other 2026 laws in the table.

Frequently asked questions

Which states prohibit AI-only denials of care?

As of mid-May 2026, at least 9 states have laws that bar denials based solely on AI or require a licensed clinician to make adverse determinations. California acted first, in 2024, and Georgia and Iowa enacted the most recent laws in May 2026.

Can insurers still use AI in prior authorization?

Yes. The laws generally allow AI to approve requests and to support administrative work. They bar AI from being the sole basis for an adverse decision.

Do these laws apply to Medicare Advantage or employer plans?

Generally not. State insurance laws do not reach self-funded employer plans governed by ERISA, and federal rules largely govern Medicare Advantage. CMS’s own rules require individualized decisions and clinician review of adverse medical necessity decisions in Medicare Advantage.

Could federal action override these laws?

Possibly. A December 2025 executive order directed federal challenges to state AI laws and did not list health care among its exceptions. State laws remain in force unless a court blocks them or Congress preempts them.