As of mid-2026, four more states have enacted laws restricting how artificial intelligence can be used in health insurance determinations, joining a wave of legislation that requires human clinicians to remain directly involved in prior authorizations and utilization review. Georgia, Iowa, Utah, and Washington each set explicit boundaries: AI can assist, but it cannot independently issue adverse coverage decisions. The laws add new compliance obligations for insurers, from mandatory disclosures to audit requirements.
These measures follow a trend we tracked earlier this year, when six states passed similar bills in the first quarter. The new rules create an increasingly complex compliance map for health plans that rely on algorithms to speed up coverage reviews. As states continue to regulate the use of AI for Insurance, prior authorization workflows will need to evolve.
Georgia
Effective January 1, 2027, Georgia Senate Bill 444 allows insurers to use AI systems to automate tasks and assist in decision-making, but draws a hard line on adverse determinations. AI may not issue an adverse decision until a private review agent or utilization review entity completes a review in which a clinical peer participates. The clinical peer's judgment must not be superseded by the AI system - a restriction similar to Pennsylvania's approach. Insurers using AI must incorporate it into a utilization review plan that complies with state law; the bill does not impose explicit disclosure obligations to members or providers.
Iowa
Iowa House File 2635, effective July 1, 2026, permits utilization review organizations to use AI for the initial review of a prior authorization request. For a denial, delay, or downgrade based on medical necessity, AI cannot be the sole basis. A qualified reviewer or clinical peer must make the decision, and appeals must involve similarly qualified individuals. Organizations must provide written explanations for denials or downgrades, including the criteria used, and must give the requesting provider - but not the covered person - a written attestation of the reviewer's qualifications. The law imposes no separate AI-specific reporting or disclosure requirements.
Utah
Utah Senate Bill 319, signed March 19, 2026, and effective January 1, 2027, amends the state's preauthorization statute to require individuals making adverse determinations based on clinical necessity to exercise independent medical judgment. The bill prohibits reliance solely on "recommendations from any other source" - a phrase that includes AI-generated recommendations. Insurers must also disclose to the Utah Insurance Department any use of AI in the authorization review process. They must post on their websites, in easily understandable language, all preauthorization requirements, including any AI involvement.
Washington
Washington's Senate Bill 5395, effective June 11, 2026, takes one of the most detailed approaches. Only a licensed physician or licensed health professional acting within their scope may deny a prior authorization request based on medical necessity. Insurers must not rely solely on AI; a human reviewer must evaluate the requesting provider's recommendation, the enrollee's medical history, and the enrollee's individual clinical circumstances.
When AI is used, the review criteria must account for individual data, not just group data, and the AI must operate in compliance with law, in a fair and nondiscriminatory manner, and be subject to audit and periodic accuracy reviews. Denials trigger a disclosure duty: the carrier must reveal the credentials, board certifications, and specialties of the reviewing clinician to both the enrollee and the requesting provider - broader than Iowa's, though it does not apply to downgrades. Carriers must also post any adjustments to prior authorization policies on their websites and, beginning with annual reporting, disclose to the state insurance commissioner the percentage of total prior authorization denials that were aided by AI.
Legislative updates
Bills in Pennsylvania and Oklahoma remain pending. Legislation in New Hampshire and Louisiana has died.
Why this matters for insurance professionals
These laws collectively signal that insurers must design prior authorization workflows with human clinical oversight as a non-negotiable element when AI is involved. The patchwork of state rules means national carriers will need to tailor compliance strategies to each jurisdiction's specific requirements - especially around who must be notified and when. For utilization review teams and compliance officers, building audit-ready processes that document human review and individual clinical evaluation will become a critical part of meeting the new standards.
Your membership also unlocks:
