New Guardrails for AI In Prior Authorization  

Artificial intelligence (AI) is quickly becoming part of many areas of everyday life, including health care. One use of AI by health insurers of note is for prior authorization decision-making. As noted in our recent coverage, prior authorization is a utilization management tool on which Federal and State policymakers and industry leaders have place increasing focus, including through industry commitments and new requirements from the Centers for Medicare & Medicaid Services (CMS) as well as states. 

In the context of these efforts to streamline and improve the balance in the use of prior authorization, payers are looking to AI to make the process more efficient on their end.  

While Federal law has not yet broadly regulated the use of AI in health care, CMS has outlined key guardrails for AI use by Medicare Advantage (MA) plans in the prior authorization process. CMS will allow MA plans to use AI to support prior authorization decisions; however, these tools must consider each individual’s clinical circumstances and the treatment recommendations of their supervising physician, rather than relying on datasets. Although CMS’ current AI-related guidance applies specifically to Medicare Advantage plans, many states are using those principles as a model for broader prior authorization reform. 

States with Effective Legislation 

A growing number of states have enacted or introduced laws governing how AI may be used in commercial health coverage and prior authorization decisions. California became the first state to enact legislation specific to the use of AI in prior authorization and utilization review decisions when the Physicians Make Decisions Act (SB 1120) was signed into law in 2024 and took effect on January 1, 2025. The law established statutory guardrails requiring individualized clinical review, physician oversight, and limits on automated decision-making. Health plans and insurers that use AI are required to comply with applicable State and Federal law and requirements around utilization review and medical necessity standards, ensure AI is fair and non-discriminatory, be transparent and auditable, and protect patient data. AI itself cannot make medical necessity denials, replace clinical judgement, rely solely on group datasets, or cause harm or discriminatory outcomes. Connecticut adopted similar legislation, effective July 1, 2025, prohibiting AI-only adverse determinations for prior authorization. 

Since then, several states, including Alabama, Arizona, Colorado, Georgia, Indiana, Iowa, Maryland, Nebraska, Texas, Utah, and Washington, have adopted similar protections aimed at ensuring that AI supports, rather than replaces, clinical judgment in prior authorization and related coverage decisions. These laws generally require review by a licensed healthcare professional before care is denied, delayed, reduced, or otherwise adversely affected; prohibit insurers from relying solely on AI to make adverse determinations; and add oversight measures such as disclosure, reporting, or monitoring requirements for AI-assisted decisions. Additionally, states require AI tools to comply with applicable Federal and State law and maintain documentation, audit logs, and records to demonstrate compliance and assess performance. Many also require insurers to disclose in an easily accessible and readable format, when AI is used to make a determination on a prior authorization request or downcode a claim.  

What’s to Come 

Massachusetts and Michigan are among the states with active legislation that would further restrict AI-assisted health coverage decisions. Michigan proposes that the department or a contracted health plan shall not deny, modify, or delay a claim under the medical assistance program based on a review using AI. Massachusetts is considering legislation that would require review by a licensed healthcare professional before AI-assisted prior authorization decisions adversely affect care and would prohibit insurers from relying solely on AI to make medical necessity determinations. The proposal would also require individualized clinical review and impose transparency, auditing, monitoring, and patient privacy requirements for AI tools used in utilization review.  Other states considered similar restrictions in 2026, although those bills did not advance before the end of their respective legislative sessions.   

Taken together with CMS’s broader commitment to improving the PA process, these efforts signal that while AI may play a growing role in streamlining prior authorization, policymakers are increasingly focused on ensuring that technology remains transparent, accountable, and subject to meaningful human oversight.