States Expand Guardrails on AI Use in Health Insurance Decisions

State legislatures are rapidly moving beyond broad artificial intelligence governance to regulate one of AI’s most consequential applications: health insurance coverage determinations. According to a new analysis from Sheppard Mullin’s Healthcare Law Blog, lawmakers are increasingly permitting insurers to use AI to streamline prior authorization and utilization review while drawing a firm line against allowing algorithms to make final medical necessity decisions without meaningful human oversight. The latest review, published July 2, builds on an earlier April survey of legislative activity and finds the trend has accelerated, with four additional states enacting new laws or comprehensive restrictions and several earlier proposals advancing or stalling. Together, the analyses suggest an emerging consensus that AI can assist insurers in administrative functions, but should not replace the clinical judgment of licensed healthcare professionals. Georgia’s new law, effective Jan. 1, 2027, expressly authorizes insurers and utilization review entities to use AI systems to automate tasks and participate in decision-making. However, Senate Bill 444 prohibits AI from issuing an adverse determination until a qualified human reviewer conducts a utilization review involving a clinical peer. The legislation also specifies that AI cannot supersede that clinical peer’s judgment, although it stops short of requiring insurers to disclose AI use to members or providers. Iowa likewise permits AI in prior authorization beginning July 1, 2026, but only for initial reviews. House File 2635 bars AI from serving as the sole basis for denying, delaying or downgrading requests involving medical necessity. Qualified reviewers or clinical peers must make those decisions and participate in consultations and appeals. Utah’s Senate Bill 319, which takes effect Jan. 1, 2027, similarly allows insurers to use AI during utilization management while requiring individuals making adverse preauthorization determinations to exercise independent medical judgment. The law prohibits reliance solely on recommendations from another source, a provision that encompasses AI-generated recommendations. Utah also distinguishes itself by requiring insurers to disclose their use of artificial intelligence both to the state Insurance Department and publicly on their websites. Washington adopted perhaps the most comprehensive framework among the newly enacted laws. Effective June 11, 2026, Senate Bill 5395 governs health carriers, health benefit managers and public employee health plans. Only licensed physicians or other licensed health professionals may deny prior authorization requests based on medical necessity, and AI cannot be the sole basis for those decisions. Human reviewers must evaluate each enrollee’s clinical history, provider recommendations and individual circumstances. The law also requires AI systems to operate fairly, comply with applicable privacy laws, undergo periodic review for accuracy, and remain subject to audit by the state insurance commissioner. The earlier Sheppard analysis, published in April, documented a first wave of legislative proposals that laid the groundwork for many of these newer laws. Pennsylvania lawmakers proposed requiring insurers to file annual AI compliance statements and disclose AI use to providers and members while prohibiting algorithms from overriding clinicians’ judgment. Oklahoma advanced a more permissive proposal that would require human review but not necessarily independent human judgment. Indiana enacted restrictions preventing AI from serving as the sole basis for downcoding claims based on medical necessity and imposed parallel obligations on providers using AI to prepare claims. Alabama adopted disclosure, certification and fairness requirements, while Louisiana and New Hampshire considered measures emphasizing physician oversight and documentation before those bills ultimately failed. The analysis also noted that Arizona, Maryland, Nebraska and Texas had enacted AI-related health insurance legislation in 2025. Taken together, the analyses suggest that while states are taking different approaches to disclosure, reporting and auditing requirements, they are converging on a common regulatory principle: AI may improve efficiency in utilization review, but final decisions affecting patient access to care must remain grounded in independent human clinical judgment rather than algorithmic recommendations alone.