Over the last few months, four states - Georgia, Iowa, Utah, and Washington - have enacted legislation limiting how health insurers can use artificial intelligence in prior authorization and utilization review decisions. The bills join a growing number of state laws that require human oversight of adverse determinations, with effective dates stretching from mid-2026 to early 2027. A previous analysis covered six earlier state actions, and this latest wave extends the regulatory patchwork further.
Georgia: AI allowed, but denials require human review
Under Senate Bill 444, effective January 1, 2027, insurers may use AI systems to automate tasks, reduce administrative burdens, and participate in decision-making. The law bars an AI system from issuing an adverse determination against a patient until a natural person - a private review agent or utilization review entity - conducts a utilization review with a clinical peer participating. The AI system also must not supersede the clinical peer's judgment. Unlike some other states, Georgia does not impose explicit disclosure requirements on insurers toward members or providers regarding AI use.
Iowa: AI can handle initial review but not final denials
Iowa's House File 2635, effective July 1, 2026, allows utilization review organizations to use AI-based algorithms for an initial review of a prior authorization request. For requests based on medical necessity, AI cannot be the sole basis for denying, delaying, or downgrading the request. Those adverse actions must be made by a qualified reviewer or a clinical peer, depending on the requesting provider. The organization must provide a written explanation for a denial or downgrade, including the reasons and criteria used. It must also give the requesting health care provider, but not the covered person, a written attestation about the qualifications of the reviewing clinician. The law does not include AI-specific reporting or disclosure mandates.
Utah: No sole reliance on AI-generated recommendations
Utah's Senate Bill 319, effective January 1, 2027, amends the state's health care preauthorization statute. Individuals making an adverse preauthorization determination based on clinical or medical necessity must exercise independent medical judgment and are prohibited from relying solely on "recommendations from any other source," which includes AI-generated recommendations. Insurers will also have to disclose to the Utah Insurance Department any use of AI in their authorization request review process. By the same date, they must post on their websites, in detail and in easily understandable language, all preauthorization requirements - including the role of AI in those reviews.
Washington combines human review with transparency and audits
Washington's Senate Bill 5395, which took effect June 11, 2026, imposes some of the strictest limits. Only a licensed physician or licensed health professional acting within their scope can deny a prior authorization request based on medical necessity. Carriers cannot rely solely on AI to make such a denial. A human reviewer must evaluate the requesting provider's recommendation, the enrollee's medical history, and the enrollee's individual clinical circumstances. Further, when AI is used in medical necessity decisions, the review criteria must consider the enrollee's individual medical history - not just group data - and the AI must operate in a fair, nondiscriminatory way, comply with applicable law, and be subject to audit and periodic accuracy reviews by the insurance commissioner.
The law also requires disclosure: if a denial is issued, the carrier must tell both the health plan enrollee and the requesting or referring provider about the credentials, board certifications, and specialties of the human who performed the clinical oversight. Carriers must publicly post any adjustment to prior authorization policies on their websites. Starting with annual reporting, carriers must also report to the insurance commissioner the percentage of total prior authorization denials that were aided by AI.
Legislative activity in other states
Pennsylvania's House Bill 1925 and Oklahoma's House Bill 3675 remain pending. Bills in New Hampshire (House Bill 1406) and Louisiana (Senate Bill 246) have died. The continued state-level activity signals that governing AI in health insurance decisions will remain a focus for lawmakers across the country.
Why this matters for insurance professionals
The new laws force health insurers, health care benefit managers, and utilization review organizations to redesign workflows around human oversight. Even in states where AI can perform initial reviews, final adverse decisions must rest on a clinician's independent judgment. Compliance teams must track varying disclosure and reporting requirements - some states require only provider notification, while others extend to members and insurance departments. Insurers will need to adapt their AI systems to incorporate individual patient data, not just population-level patterns, and prepare for audits. The patchwork of state rules adds operational complexity, especially for carriers operating across multiple jurisdictions. Understanding the intersection of AI deployment and legal obligations is now essential, whether through dedicated resources for AI for Insurance or guidance on AI for Legal compliance.
Your membership also unlocks:
