State review laws in 2026 regulate the reviewer, not just the clock

State review laws in 2026 regulate the reviewer, not just the clock. For most of the last decade, state prior authorization reform meant deadlines. Legislatures told plans how many hours or days they had to decide, and some added gold card exemptions for clinicians with high approval rates. The laws enacted in 2026 go further. They set rules for who may deny a request and what software may do. Some also set how long an approval must last.

At least 10 states enacted utilization review laws in their 2026 sessions, by our count from legislative records and published summaries. Most of them share a single idea. Software may help approve care, but a qualified person must make any denial. Several states applied the same idea to downcoding, the practice of paying a claim at a lower level than the one billed.

The argument made here is that states should regulate the decision record that every review leaves behind.

Key takeaways

• The human denial rule spread. In 2026, 6 states barred denials based solely on artificial intelligence or required a qualified person to make them.
• Downcoding became a review question. Laws in 3 states put people in charge of downcoding decisions or disputes, instead of algorithms.
• Approvals got longer. Virginia will require drug approvals to last at least 6 months at first and 12 months on renewal, starting in 2027.
• Plans must show more of their work. Utah requires public approval and denial statistics, and Maryland’s commissioner can examine emergency department denials.
• The dates are staggered. The 2026 laws take effect between June 2026 and January 2028, and none of them reaches self-funded employer plans.
• States should regulate the record. A common decision record would let every state check its own rules without each plan building a separate system for each state.

The laws enacted in 2026

The table lists the main utilization review laws enacted in the 2026 sessions, in order of effective date.

Compiled from state legislative records and the summaries cited below. Virginia also enacted 2 downcoding bills, SB 164 and HB 484, described below.

Laws from earlier sessions that took effect in 2026

Several states passed laws in 2025 that took effect this year. North Dakota now requires decisions on nonurgent requests within 7 calendar days and urgent requests within 72 hours, according to Becker’s Payer Issues. Nebraska’s law sets similar limits, with a shorter clock for urgent requests from 2028. In Alaska, payers must now tell patients about decisions within 72 hours for routine requests and 24 hours for expedited ones, according to the same report. North Dakota’s timeframes match the federal limits that took effect in January 2026 for Medicare Advantage and Medicaid plans, and Alaska’s are shorter.

That convergence on the clock is part of why the 2026 laws moved on. Once state and federal deadlines line up, the next question is who makes the decision and what record it leaves.

AI can approve, and a person must deny

The most common provision in 2026 was a rule about software. Washington’s law took effect June 11. It says only a licensed physician or health professional may deny a request on medical necessity grounds, according to the Washington Legislature. Software may not be the sole means of a denial.

Other states wrote the same rule in different words.

Compiled from the law firm summaries and legislative records cited in this analysis, including Becker’s Payer Issues (July 2026) and Holland & Knight (May 2026).

Colorado’s law is the most detailed. It applies well beyond insurers, to the other organizations that review care for them. Its AI systems must base determinations on the patient’s own history and circumstances, not on group data alone, according to the Colorado General Assembly. The systems must be reviewed periodically for accuracy. Entities must also tell the state how human oversight of adverse decisions works. The law also bars insurers from covering psychotherapy delivered by AI, according to Becker’s, a sign that it reaches past review into what counts as care.

Alabama adds a certification. Insurers must certify each year to the Department of Insurance that their AI does not rely on group datasets and is monitored for accuracy, according to Holland & Knight. Georgia’s version is the most specific about the reviewer. Its rule requires a clinical peer to take part, and the AI may not override that peer’s judgment, according to Sheppard Mullin.

The state rules echo federal guidance for Medicare Advantage. CMS told plans in its February 2024 answers that “algorithms or artificial intelligence alone cannot be used as the basis to deny admission or downgrade to an observation stay.” The states have now extended a similar rule to the commercial plans they regulate.

Automated approval is where software helps most. A request that meets published criteria can be approved in seconds, and nothing in these laws discourages that. The laws target the other direction, where a wrong answer costs a patient care.

The rule that spread fastest in 2026 is the one the best review programs already follow. Software can say yes. Only a person can say no.

The convergence is striking because the laws came from different directions. Some states amended their insurance codes, and others amended private review agent statutes. Most of them still arrived at the same principle.

Downcoding becomes a review question

Downcoding happens after care, when a plan pays a claim at a lower level of service than the one billed. It is a form of utilization review that most prior authorization laws never touched. In 2026, 3 states addressed it directly.

Indiana’s law, effective July 1, bars insurers from using AI as the sole basis for downcoding without a health care professional’s review of the medical record, according to Holland & Knight. Illinois enacted the Transparency in Downcoding Act in July. It requires that people rather than algorithms review claims. When a claim is downcoded, the physician must receive notice with a clinical explanation, according to the Illinois House Democrats. The law takes effect January 1, 2028.

Virginia enacted 2 downcoding bills, SB 164 and HB 484. They bar downcoding without a stated reason and require that people decide disputes, according to the Virginia Mercury. The AMA noted in a June update that more than a dozen states had introduced downcoding bills this year.

The gap between enactment and effect is real. In late August, WBEZ reported that Blue Cross and Blue Shield of Illinois had begun paying certain evaluation and management claims at lower levels from July 1, 2026. Mental health and pediatric practices reported the sharpest effects, according to WBEZ. Because the Illinois law does not take effect until 2028, its protections do not apply in the meantime. Providers can appeal each reduced claim, but many told WBEZ the volume made that impractical.

The logic matches the denial rule. A downcoded claim is a partial denial made after the fact. If a machine should not deny a service before it happens, it is hard to argue that a machine should cut the payment after it happens without a person looking.

Approvals that last, and data that is public

Longer approvals

Virginia’s HB 736 takes on a different problem, the approval that expires too soon. For prescription drugs, an initial approval must last at least 6 months and a continued approval at least 12 months, according to NFP. An insurer may revoke an approval only when added safety or efficacy monitoring is clinically appropriate or recommended by a regulator. The law applies to contracts entered into or renewed from January 1, 2027.

Utah’s SB 319 sets minimum validity periods for approvals of chronic or long-term care, according to Becker’s. Both laws reflect the argument our piece on approvals that last the course of treatment made. An approval should match the shape of the care, not the convenience of the review cycle. For drugs, our analysis of drug prior authorization found that federal rules still leave most of these questions to the states.

Public statistics and examinations

Utah’s law also requires insurers to post their prior authorization requirements publicly, along with approval and denial statistics. Insurers must also disclose their use of AI in reviews, to regulators and to the people affected, according to Holland & Knight.

Statistics help only if they are comparable. A denial rate means little unless plans count requests and denials the same way. That is another argument for the common record proposed below.

Maryland took a narrower path aimed at emergency care. Its HB 1563 became Chapter 165 when it was signed on April 28. It lets the Maryland Insurance Commissioner examine carrier decisions on emergency department claims, according to the Maryland General Assembly. Holland & Knight reports that carriers must also report adverse decisions quarterly, including whether AI was used.

Washington’s law requires carriers to post updates to their prior authorization policies in a central place on their websites, according to Becker’s. The insurance commissioner may also audit carrier practices.

These provisions extend the logic of the federal metrics that payers first posted in March 2026, as our review of the first metrics described. Federal reporting covers Medicare Advantage and Medicaid plans. The state laws reach the commercial plans that federal reporting does not.

What the patchwork costs

Each law is reasonable on its own. Together, they create work that has little to do with patients. A plan that operates in several states must track different definitions of who may deny and different rules on AI disclosure. It must also track effective dates that run from June 2026 to January 2028.

Compiled from the first table in this analysis.

The definitions differ in ways that matter. Washington requires a licensed professional, and Georgia requires a clinical peer. Colorado requires a competent regulated professional who can evaluate the clinical issue and the plan’s coverage terms. A plan with a single national review process has to satisfy the strictest version everywhere or run separate processes by state.

The laws also differ on what counts as AI. Some refer to artificial intelligence, and others reach software tools more broadly. A rules engine that applies a written criterion is software. Whether it counts as AI under each law is not always clear, and plans will read the definitions cautiously.

None of these laws reaches self-funded employer plans, which ERISA governs. Illinois’s downcoding law says so expressly. A worker in a fully insured plan in Colorado gets a human review of every AI-assisted denial by state law. A worker in a self-funded plan down the street does not, unless the employer chooses it.

There is also a measurement gap. Most of the laws say what a plan must not do. Few say how a regulator will know whether a plan complied. A ban on AI-only denials is only as strong as a regulator’s ability to see who made each denial and what the software contributed.

A common decision record

The fix is to regulate the record that every review leaves behind, not only the conduct. If every utilization review produced the same basic record, each state could check its own rules against it. Plans would build one record rather than a different attestation for each state.

The record would need a short list of fields.

• Who decided. The reviewer’s role and credential, and whether the reviewer was a clinical peer.
• What the software did. Whether an automated tool was used, and whether it recommended approval or flagged the request for a person.
• The criteria applied. The published policy and version the decision relied on.
• The clock. When the request arrived and when the decision issued.
• The outcome and its reasons. The decision, with the specific reason for any denial or downcode.

With a record like this, a regulator could test Washington’s rule and Georgia’s rule against the same data. A state that adds a new requirement next year would add a field, not a new reporting system. The federal metrics and the state statistics could come from the same source.

The idea is not new to insurance regulators. The NAIC adopted a model bulletin on insurers’ use of AI systems in December 2023, and many states have adopted it. Our analysis of federal preemption found that state insurance rules on AI are likely to survive any federal action aimed at general AI laws. A shared record would make those rules easier to enforce wherever they apply.

What plans can do now

Plans do not need to wait for states to agree. A plan that builds the record now can meet each state’s rule as it takes effect.

1. Route every adverse recommendation to a person. If the software can only approve or refer, the strictest state rule is met everywhere.
2. Log what the software did. Record which tool was used and what it recommended for every request it touched.
3. Record the reviewer’s credential. Keep the reviewer’s role and specialty with each decision, so a clinical peer requirement can be shown.
4. Treat downcoding like a denial. Apply the same human review and the same notice to a downcode as to a denial.

There are fair objections. A common record would require states to agree on definitions, and states guard their insurance codes closely. Plans would also worry that a detailed record invites litigation. But plans already keep most of these fields for accreditation and appeals. The question is whether the record is kept in a form that regulators can read.

Where Redlake stands

Redlake builds tools that health plans use in utilization review. Our first rule is that a machine can say yes, but only a person can say no. Some version of that rule became law in 6 states in 2026, and we think more will follow. We welcome it. A review program that already sends every adverse recommendation to a clinician meets the core of each of these laws.

Our second rule is that every recommendation shows its reasons. That rule is what makes the human denial laws enforceable, because a reviewer can only exercise independent judgment if the reasons are visible. Our third rule is that every decision can be reconstructed. That is the decision record this analysis proposes, kept the same way in every state.

We think the next round of state laws should spend less effort on what software may not do and more on what every review must record. A clear record protects patients and gives regulators something to check. It also protects plans that follow the rules.

About this analysis

Method. The laws covered are utilization review laws enacted in 2026 sessions, drawn from state legislative records and published summaries, counting laws enacted by late August 2026.

Data notes. Signing dates and effective dates come from legislative records where available and otherwise from the summaries cited. Some summaries describe laws in less detail than the statutes, and our tables reflect only what we could confirm. The count of states is a floor, not a census. The common decision record is this analysis’s proposal.

Sources. Washington Legislature bill summary for SB 5395. Colorado General Assembly page for HB26-1139. Maryland General Assembly page for HB 1563. Becker’s Payer Issues (April and July 2026). Holland & Knight (May 2026). Sheppard Mullin (July 2026). NFP on Virginia HB 736 (April 2026). Virginia Mercury (May 2026). Illinois House Democrats on SB 3114 (July 2026). AMA state advocacy update (June 2026). WBEZ (August 2026). CMS answers on the 2024 Medicare Advantage rule (February 2024).

Frequently asked questions

Which states barred AI-only denials in 2026?

In 2026, 6 states enacted laws that bar denials based solely on AI or require a qualified person to make adverse decisions. Washington’s law took effect first, in June 2026. Colorado’s is the most detailed.

What is downcoding?

Downcoding is paying a claim at a lower level of service than the one billed. Laws passed in 3 states in 2026 require that people make or review downcoding decisions.

What should a utilization review decision record include?

At minimum, it should show who decided and what any software contributed. It should also show the criteria applied and the specific reasons for the outcome.

Do these state laws apply to employer plans?

They apply to fully insured plans regulated by each state. They do not apply to self-funded employer plans, which ERISA governs.

When do the 2026 laws take effect?

The earliest took effect in June 2026, and several take effect on January 1, 2027. Illinois’s downcoding law takes effect January 1, 2028.

How long must Virginia drug approvals last?

An initial approval for a prescription drug must last at least 6 months, and a continued approval at least 12 months. The rule applies to contracts from January 1, 2027, with limited exceptions for safety monitoring.