On June 20, 2025, Texas enacted SB 815, barring utilization review agents from using an automated decision system to make an adverse determination wholly or partly. By then, other states had enacted restrictions on automated coverage decisions. More followed in 2026.
The shared concern is recognizable: a patient’s access to care should not turn on software replacing the individualized review the applicable law requires. But the states have not adopted one uniform safeguard. Some restrict the system’s role. Others specify the reviewer’s work, require continuing evaluation, or address incentives that can distort review.
California, Arizona, Maryland, Nebraska, Texas, and Colorado illustrate those differences. This is a selective comparison of enacted approaches, not a fifty-state inventory. Their scope, implementation dates, and enforcement mechanisms need separate attention.
The Same Concern Produces Different Legal Boundaries
An automated recommendation can influence a denial without being its sole basis. A human can approve a recommendation without independently evaluating the patient’s circumstances. A tool can also support administrative work without making a medical-necessity determination.
Those distinctions are legally consequential. A prohibition on sole reliance does not use the same language as a prohibition on software making an adverse determination wholly or partly. A requirement for individual review is different again. Reading them all as human-in-the-loop rules obscures what the particular law requires.
The six examples address the denial process at different points. The useful comparison is what each adds: a boundary on automation, a specified human assessment, evidence about the patient, ongoing review, visibility, or constraints on denial incentives.
Texas Restricts Making the Adverse Determination
SB 815 defines adverse determination around medical necessity, appropriateness, and experimental or investigational care. It prohibits a utilization review agent from using an automated decision system to make such a determination wholly or partly. Administrative support and fraud-detection functions remain permitted, and that exception reaches algorithms, artificial intelligence systems, and automated decision systems alike. The commissioner can audit and inspect a utilization review agent’s use of an automated decision system for utilization review at any time.
The Texas Department of Insurance’s June 12, 2026 bulletin separately states a broader supervisory expectation: regulated entities using AI for consequential decisions should have a person review and agree before action. It also addresses governance, testing, and examination readiness. This bulletin expresses expectations under existing authority; it does not replace SB 815’s statutory restriction with a general permission to deny whenever a human signs.
The practical question is what the software contributes to the adverse determination. Calling a denial-generating function administrative support does not establish that the exception applies.
California Combines a Decision Boundary With Continuing Controls
California’s SB 1120 took effect January 1, 2025. The Department of Insurance’s May 5, 2025 guidance explains that decision-support tools cannot deny, delay, or modify services based, in whole or in part, on medical necessity. Medical-necessity determinations belong to licensed professionals competent to evaluate the specific clinical issues.
The framework also addresses patient-specific clinical information, limits sole reliance on group datasets, prohibits displacement of provider decisionmaking, and requires periodic review of tool performance, use, and outcomes. Tools must be available for regulatory inspection, and the written policies and procedures must disclose how the tool is used and what oversight applies. Parallel statutory provisions address health plans regulated by the Department of Managed Health Care: SB 1120 amended Health and Safety Code section 1367.01, adding subdivision (k).
The additional controls matter because assigning the decision to a professional does not establish that the supporting tool works appropriately. Continuing evaluation can reveal recurring errors or uses that exceed what the evidence supports.
Arizona Specifies the Medical Director’s Individual Review
Arizona HB 2175, signed May 12, 2025, specifies that a health care insurer may deny a provider-submitted claim on the basis of medical necessity, or issue a direct denial of a prior authorization of a provider-requested service involving medical necessity, the medical director must individually review the denial, exercise independent medical judgment, and avoid sole reliance on recommendations from any other source. The act defines neither the medical director nor a direct denial, and it supplies no enforcement provision.
The enacted text does not expressly name AI. Its protection reaches the review of recommendations regardless of their source. That makes it relevant to automated recommendations without turning it into a blanket ban on software-assisted claims processing.
For implementation, the distinction is between approving a recommendation and assessing the particular case. The review process should enable the medical director to examine the facts that matter to the medical-necessity decision. This is a practical implication of the individual-review requirement, not a separate statutory review checklist.
Maryland Adds a Quarterly Check on the Supporting Tools
Maryland HB 820, signed May 20, 2025 applies to specified carriers using an artificial intelligence, algorithm, or other software tool for utilization review, including through contractors, and to qualifying PBMs and private review agents acting for carriers. Algorithm and other software tool are left undefined, so a deterministic rules engine is covered as surely as a learning system. The tools may not deny, delay, or modify healthcare services.
The law requires individual clinical information, preservation of the healthcare provider’s role, written use and oversight procedures, and access for commissioner inspection. It also requires performance, use, and outcomes to be reviewed and revised if necessary, at least quarterly, to maximize accuracy and reliability. Separately, the act amends the carrier’s existing quarterly report to the Commissioner to state whether such a tool was used in making the adverse decision. That reporting duty and the internal review duty are different obligations that happen to share a cadence.
That adds a recurring obligation beyond the individual decision. A tool could receive human review in every case and still produce a pattern of misleading recommendations. The quarterly process provides an opportunity to identify that pattern and change the tool or its use.
Nebraska Addresses Disclosure and the Incentives Behind Denials
Nebraska LB 77, approved June 4, 2025, prohibits an artificial intelligence-based algorithm from being the sole basis of a utilization review agent’s decision to deny, delay, or modify services based, in whole or in part, on medical necessity.
It requires disclosure of algorithm use to the insurance department, network providers, enrollees, and the public through the agent’s website. The department can audit automated utilization-management systems.
The law also prohibits compensating utilization review agents based on denial volume and tying a medical reviewer’s incentives or penalties to the volume of denials that reviewer issues or upholds, which reaches the appeal stage as well as the initial decision. This addresses a different risk: the organization can undermine clinical assessment through its compensation structure even when the software and review procedures appear acceptable.
Those incentive restrictions deserve attention alongside the AI provision. Meaningful review depends partly on whether the reviewer is rewarded or penalized for the answer.
Colorado Requires Disclosure of Where AI Enters the Process
Colorado HB 26-1139, signed June 2, 2026, establishes requirements beginning January 1, 2027. Its utilization-review provisions reach several specified participants, including carriers, PBMs, private review organizations, and certain managed-care and behavioral-health entities.
The enacted framework permits an artificial intelligence system to assist with utilization review, including expedited approvals, but bars a carrier’s denial of coverage based in whole or in part on medical necessity from issuing solely on that system’s output without human review and approval by a competent licensed or regulated professional. The scope list and that prohibition are not coextensive: the prohibition is written against a carrier’s denial, and it reaches denials rather than delays or modifications. It also addresses individual clinical circumstances, periodic accuracy and reliability review, and disclosures to the relevant agencies about AI functions, human oversight, and audit information. Neither the review nor the disclosure carries a stated interval or filing deadline.
That disclosure asks organizations to identify where AI operates in the process. A general statement that the insurer uses AI cannot explain whether it summarizes records, proposes a decision, or supplies the effective reason for a denial.
Plan Coverage and the Type of Decision Remain Essential
None of these examples establishes a national prohibition on automated claims handling. As KFF’s comparison explains, utilization review and medical necessity are central to these laws, while administrative payment decisions can fall outside the same provisions. Some laws address prior authorization differently from retrospective claims review.
Before applying a rule, identify the plan, the regulated entity or review agent, the state’s jurisdiction, the decision at issue, and the applicable date. State-regulated insurance, self-funded employer arrangements, Medicare Advantage, and Medicaid arrangements require separate coverage and preemption analyses. The same insurer’s name can appear across products governed differently.
A denial based on missing enrollment information is different from a conclusion that a proposed service is not medically necessary. The first can raise serious compliance issues without falling within a particular medical-necessity AI restriction.
