Why now
The law now wants a licensed human
on the AI decision.
Medicare's WISeR model, seven state laws passed in 2026, and the FDA's discussion paper converge on one sentence: AI may draft or screen, but a licensed human makes and signs the consequential decision. Here are the statutes, the dates, and the primary sources. Verified before publishing; corrections welcome.
Medicare · the model
CMS WISeR: six vendors, six states, every denial reviewed by a human clinician.
The Wasteful and Inappropriate Service Reduction model runs January 1, 2026 through December 31, 2031. It is the first Innovation Center model whose only participants are technology companies, using AI to run prior authorization for services CMS links to overuse — skin and tissue substitutes, electrical nerve stimulators, knee arthroscopy for osteoarthritis, and more. Two lines from CMS's own page and FAQ carry the whole requirement:
“All recommendations for non-payment are determined by appropriately licensed clinicians who will apply standardized, transparent and evidence-based procedures to their review.”
CMS WISeR model page →“Non-affirmations will require the review of a human clinician and cannot be performed solely by technology.”
CMS WISeR FAQ (January 2026) →| Participant | MAC jurisdiction | State |
|---|---|---|
| Cohere Health, Inc. | JH Novitas | Texas |
| Genzeon Corporation | JL Novitas | New Jersey |
| Humata Health, Inc. | JH Novitas | Oklahoma |
| Innovaccer Inc. | J15 CGS | Ohio |
| Virtix Health LLC | JF Noridian | Washington |
| Zyter Inc. | JF Noridian | Arizona |
Source: CMS WISeR model page, participant table as published. Each participant must staff the licensed clinicians who make every non-affirmation — what we supply to them.
States · the statutes
Eight laws, one rule: AI may not be the sole basis for the adverse decision.
These bind insurers and utilization-review organizations, not vendors directly — with one exception, Indiana, which also bars providers from submitting AI-prepared claims without human review. A vendor selling into a plan in these states supplies the clinician the plan must have. Each row links to the primary source or a law-firm review of the enacted text.
Washington · SB 5395
Signed March 2026; in effect June 2026Only a licensed physician or health professional acting within scope may deny prior authorization on medical necessity; AI may not be the sole basis. Plans may use AI to process and approve.
Source: Session law (PDF) →Indiana · HB 1271
In force July 1, 2026Insurers may not use AI as the sole basis to downcode a claim without a health-care professional reviewing the record. Providers may not use AI to submit claims without human review. Unusually, it binds providers as well as insurers.
Source: Holland & Knight review →Iowa · HF 2635
In force July 1, 2026Utilization-review organizations may use AI for initial review; AI may not be the sole basis for a decision to deny, delay, or downgrade a medically necessary service.
Source: Iowa Legislature bill history →Alabama · SB 63
In force October 1, 2026Coverage determinations may not be made solely by AI; insurers must disclose AI use, base determinations on the individual’s clinical circumstances, and certify annually that the AI does not rely on group data alone.
Source: LegiScan →Colorado · HB 26-1139
In force January 1, 2027Use of artificial intelligence in health care: a licensed clinician competent in the relevant clinical area reviews AI-based adverse determinations, on the individual’s history. Signed June 2, 2026.
Source: Colorado General Assembly →Georgia · SB 444
In force January 1, 2027Private review agents may not rely solely on AI for coverage decisions; a human reviews.
Source: Becker’s Payer roundup →Utah · SB 319
In force January 1, 2027Anyone making an adverse preauthorization determination on medical necessity must exercise independent medical judgment; insurers must disclose AI use in review and publish approval and denial statistics.
Source: Utah Legislature →California · SB 1120
In force January 1, 2025The Physicians Make Decisions Act: a licensed physician makes medical-necessity denials; AI may not be the sole basis. The earliest of these laws.
Source: California Legislative Information →Not legal advice. Statute summaries are ours; the dates are the effective dates in the linked sources as of September 2026. A federal bill (H.R. 238, the Healthy Technology Act) would move in the other direction by letting qualifying AI systems prescribe; it is introduced, not law.
Federal · the payment models
The same requirement, arriving from the opposite direction.
The statutes above work by prohibition — AI may not be the sole basis for an adverse decision. Federal payment models are now producing the same outcome by condition of payment: you do not get paid unless a named clinician is accountable. A vendor that can bind an output to a real NPI serves both, and the second one is not enforced by a regulator after the fact — it is enforced by the payment itself.
CMS ACCESS Model
Live 5 Jul 2026 · 10 yearsAdvancing Chronic Care with Effective, Scalable Solutions. Pays outcome-aligned rather than per activity, across four clinical tracks including chronic musculoskeletal pain. Participating organizations must designate a physician Clinical Director responsible for clinical oversight and compliance, and CMS will publish participants’ risk-adjusted outcomes in a public directory.
Source: cms.gov Innovation Center model page →ARPA-H ADVOCATE
$62.7M · 4 yearsBuilds toward a first-of-its-kind FDA authorization package for clinical agentic AI, due within 24 months of award. The architecture separates the acting agent from an independent supervisory agent, with an outside laboratory evaluating both — putting the named human at escalation and accountability rather than at accuracy. ⛔ Nothing here is FDA-authorized; authorization is the goal.
Source: arpa-h.gov program and award pages →Read 10 September 2026. Not legal, billing, or coding advice; model terms and dates change and should be verified against CMS before anyone acts on them. ⛔ A human in the loop buys accountability, not accuracy — we do not claim that review makes AI output more correct. The assembled argument is at solvinghealth.com/model.
FDA · the discussion paper
The regulator drew the same line.
In August 2026 the FDA's Center for Devices and Radiological Health published “Considerations for the Regulation of Generative AI-Enabled Medical Devices” (Docket FDA-2026-N-7874) — a discussion paper and request for feedback, not draft or final guidance, with comments due October 19, 2026. Its two-axis risk map places clinician-supervised, action-directing output in the lowest-burden band and fully autonomous action-taking in the highest; and it points to the clinical-decision-support exclusion when a clinician can independently review the basis for a recommendation. Whether any product is a device is the FDA's determination, not ours.
Evidence · the studies and the coder
The evidence drew the same line.
The first prospective study of a patient-facing diagnostic AI reported no safety stops. Read the method: a physician watched every conversation live, with written criteria for stopping it. The safety result belongs to that arrangement, not to the model alone. The AMA's own coders now sort every AI service by how much of the work the physician still does. The two facts point the same way the statutes do.
AMIE in The Lancet (8 October 2026)
98 patients · zero safety stops · a physician on every conversation
A prospective, single-centre feasibility study at Beth Israel Deaconess: 114 adults enrolled, 98 completed a text conversation with Google’s AMIE before an urgent primary care visit (April to November 2025). AMIE’s ranked differential held the final diagnosis within its first seven candidates in 90% of cases (88 of 98) and within its first three in 75%. Primary care physicians scored higher on practical and cost-effective plans, and 75% of those who read the AI summary said it helped them prepare. A supervising physician monitored every conversation in real time under predefined stop criteria; none was needed.
Source: The Lancet, PIIS0140-6736(26)01535-7 · arXiv 2603.08448 · NCT06911398 →The authors, in Nature Medicine (14 September 2026)
“Hard, but non-negotiable”
The same team’s commentary on why prospective evidence for conversational medical AI cannot be skipped: trust must be earned in real clinical settings, where the hardest lessons concern the humans and systems around the AI, not the technology itself. Removing the supervision that produced a safety result is a new intervention with no evidence of its own.
Source: Nature Medicine, s41591-026-04639-5 →CPT 2027 and Appendix S (effective 1 January 2027)
43 AI-related codes · three tiers by physician work
The AMA’s 2027 code set adds 299 codes, ten of them for AI-related services, bringing the AI total to 43, and updates Appendix S, the taxonomy that sorts every AI service as assistive, augmentative or autonomous by how much of the work the machine does and how much the physician still interprets. The coder, not the regulator, now records where the human sits in each service.
Source: AMA press release, CPT 2027 code set · CPT Appendix S →Penda Health, Nairobi (2025)
39,849 visits · 16% fewer diagnostic errors · the clinician decides
An LLM safety net running behind the clinician’s own documentation across 15 clinics, interrupting only on a material risk: 16% fewer diagnostic errors and 13% fewer treatment errors than unassisted peers, in a quality-improvement comparison (not randomized). The tool never acts; the clinician does.
Source: OpenAI and Penda Health · arXiv 2507.16947 →AMIE for complex cardiology, Nature Medicine (6 February 2026)
Randomized · 9 cardiologists · 107 real cases
General cardiologists managed suspected genetic cardiomyopathy with or without AMIE. Blinded subspecialists found clinically significant errors in 24.3% of unassisted assessments and 13.1% of assisted ones, and missing content in 37.4% versus 17.8%. The model assisted a named physician who signed the plan; it did not replace one.
Source: Nature Medicine, s41591-025-04190-9 →PreA, Nature Medicine (19 January 2026)
Randomized · 2,069 patients · the visit got shorter, not unsupervised
A co-designed chatbot took the history before a specialist visit at two Chinese centres. Specialist consultation time fell 28.7% (4.41 to 3.14 minutes) and physician-rated care coordination rose from 1.73 to 3.69 of 5. The structured, scaffolded model beat an unstructured model fine-tuned on local records. Structure and a human at the end did the work.
Source: Nature Medicine 32, 934–942 (2026), s41591-025-04176-7 →Read 12 October 2026 from the journal pages, the preprints and the AMA. One feasibility study at one centre is not a licence; the authors say larger trials are needed. ⛔ A human in the loop buys accountability, not accuracy — the Lancet result is a safety result under supervision, and we do not claim review makes AI output more correct.
What this means if you build the AI
The human is a requirement
If your output feeds a coverage decision in these states or under WISeR, a licensed human must make and sign the adverse call. Your product either supplies that human or your customer must.
The record is the product
A signature nobody can verify is a claim. A hashed record with the NPI, the timestamp, and the document is evidence. The plan’s auditor can check it without you.
Specialty match is in the statute
Colorado requires a clinician competent in the relevant clinical area; WISeR requires relevant clinical expertise. A generic reviewer does not satisfy either. The gate here fails closed outside a covered specialty.