State legislatures are rapidly moving beyond broad artificial intelligence governance to regulate one of the most important applications of AI: health insurance coverage decisions.
Lawmakers are increasingly allowing insurance companies to use AI to streamline pre-approval and utilization reviews, but are drawing a firm line at allowing algorithms to make ultimate medical necessity decisions without meaningful human oversight, according to a new analysis from Shepard Mullin’s Health Law Blog.
The latest review, released on July 2, was based on a survey of legislative activity conducted in April and found that this trend is accelerating, with four more states enacting new laws or sweeping restrictions, and some previous proposals moving forward or stalling. Taken together, these analyzes suggest that an emerging consensus is emerging that AI can assist insurers with administrative functions, but it should not replace the clinical judgment of qualified medical professionals.
Georgia’s new law, which goes into effect on January 1, 2027, explicitly allows insurance companies and utilization review agencies to use AI systems to automate tasks and participate in decision-making. However, Senate Bill 444 prohibits AI from making an adverse decision until a qualified human reviewer conducts a utilization review that includes a clinician. The law also states that AI cannot replace clinician judgment, but stops short of requiring insurers to disclose the use of AI to members and health care providers.
Iowa similarly allows AI with pre-approval starting July 1, 2026, but only for initial review. House File 2635 prohibits AI from serving as the sole basis for denying, delaying, or downgrading requests involving medical necessity. Qualified reviewers or clinical peers should make these decisions and participate in consultation and appeals.
Utah Senate Bill 319, which goes into effect on January 1, 2027, similarly allows insurance companies to use AI during utilization management, while requiring independent medical judgment for individuals making decisions against prior authorization. The law prohibits relying solely on recommendations from another source, and includes AI-generated recommendations. Utah also stands out by requiring insurance companies to publicly disclose their use of artificial intelligence to the state insurance department and on their websites.
Washington adopted perhaps the most comprehensive framework of newly enacted legislation. Senate Bill 5395, effective June 11, 2026, governs health plans for health care workers, health benefit managers, and public employees. Only a licensed physician or other licensed health care professional can deny a prior authorization request based on medical necessity, and AI cannot be the sole basis for that decision. Human reviewers must evaluate each registrant’s clinical history, healthcare provider recommendations, and individual circumstances. The law also requires that AI systems operate fairly, comply with applicable privacy laws, are regularly reviewed for accuracy, and continue to be audited by state insurance commissioners.
An earlier Shepherd analysis published in April documented the first wave of legislative proposals that laid the groundwork for many of these new laws. The Pennsylvania Legislature proposed requiring insurers to submit annual reports on AI compliance and disclosing their use of AI to health care providers and members, while prohibiting algorithms from overriding clinician judgment. Oklahoma advanced a more permissive proposal that would require human review but not necessarily independent human judgment.
Indiana enacted regulations prohibiting the use of AI as the sole basis for downcoding insurance claims based on medical necessity and imposed similar obligations on health care providers who use AI to prepare claims. Alabama adopted disclosure, certification, and impartiality requirements, while Louisiana and New Hampshire considered measures emphasizing physician oversight and documentation before these bills were ultimately defeated. The analysis also noted that Arizona, Maryland, Nebraska, and Texas have enacted AI-related health insurance laws in 2025.
Taken together, the analysis suggests that while states are taking different approaches to disclosure, reporting, and auditing requirements, they are converging on common regulatory principles. This means that while AI has the potential to improve utilization review efficiency, final decisions affecting patient access to care must be based on independent human clinical judgment and not just algorithmic recommendations.
