Why now
The law now wants a licensed human
on the AI decision.
Medicare's WISeR model, seven state laws passed in 2026, and the FDA's discussion paper converge on one sentence: AI may draft or screen, but a licensed human makes and signs the consequential decision. Here are the statutes, the dates, and the primary sources. Verified before publishing; corrections welcome.
Medicare · the model
CMS WISeR: six vendors, six states, every denial reviewed by a human clinician.
The Wasteful and Inappropriate Service Reduction model runs January 1, 2026 through December 31, 2031. It is the first Innovation Center model whose only participants are technology companies, using AI to run prior authorization for services CMS links to overuse — skin and tissue substitutes, electrical nerve stimulators, knee arthroscopy for osteoarthritis, and more. Two lines from CMS's own page and FAQ carry the whole requirement:
“All recommendations for non-payment are determined by appropriately licensed clinicians who will apply standardized, transparent and evidence-based procedures to their review.”
CMS WISeR model page →“Non-affirmations will require the review of a human clinician and cannot be performed solely by technology.”
CMS WISeR FAQ (January 2026) →| Participant | MAC jurisdiction | State |
|---|---|---|
| Cohere Health, Inc. | JH Novitas | Texas |
| Genzeon Corporation | JL Novitas | New Jersey |
| Humata Health, Inc. | JH Novitas | Oklahoma |
| Innovaccer Inc. | J15 CGS | Ohio |
| Virtix Health LLC | JF Noridian | Washington |
| Zyter Inc. | JF Noridian | Arizona |
Source: CMS WISeR model page, participant table as published. Each participant must staff the licensed clinicians who make every non-affirmation — what we supply to them.
States · the statutes
Eight laws, one rule: AI may not be the sole basis for the adverse decision.
These bind insurers and utilization-review organizations, not vendors directly — with one exception, Indiana, which also bars providers from submitting AI-prepared claims without human review. A vendor selling into a plan in these states supplies the clinician the plan must have. Each row links to the primary source or a law-firm review of the enacted text.
Washington · SB 5395
Signed March 2026; in effect June 2026Only a licensed physician or health professional acting within scope may deny prior authorization on medical necessity; AI may not be the sole basis. Plans may use AI to process and approve.
Source: Session law (PDF) →Indiana · HB 1271
In force July 1, 2026Insurers may not use AI as the sole basis to downcode or deny without a health-care professional reviewing the record. Providers may not use AI to submit claims without human review — the only 2026 law that binds both sides.
Source: Holland & Knight review →Iowa · HF 2635
In force July 1, 2026Utilization-review organizations may use AI for initial review; AI may not be the sole basis for a decision to deny, delay, or downgrade a medically necessary service.
Source: Iowa Legislature bill history →Alabama · SB 63
In force October 1, 2026Coverage determinations may not be made solely by AI; insurers must disclose AI use, base determinations on the individual’s clinical circumstances, and certify annually that the AI does not rely on group data alone.
Source: LegiScan →Colorado · HB 26-1139
In force January 1, 2027Use of artificial intelligence in health care: a licensed clinician competent in the relevant clinical area reviews AI-based adverse determinations, on the individual’s history. Signed June 2, 2026.
Source: Colorado General Assembly →Georgia · SB 444
In force January 1, 2027Private review agents may not rely solely on AI for coverage decisions; a human reviews.
Source: Becker’s Payer roundup →Utah · SB 319
In force January 1, 2027Anyone making an adverse preauthorization determination on medical necessity must exercise independent medical judgment; insurers must disclose AI use in review and publish approval and denial statistics.
Source: Utah Legislature →California · SB 1120
In force January 1, 2025The Physicians Make Decisions Act: a licensed physician makes medical-necessity denials; AI may not be the sole basis. The earliest of these laws.
Source: California Legislative Information →Not legal advice. Statute summaries are ours; the dates are the effective dates in the linked sources as of September 2026. A federal bill (H.R. 238, the Healthy Technology Act) would move in the other direction by letting qualifying AI systems prescribe; it is introduced, not law.
FDA · the discussion paper
The regulator drew the same line.
In August 2026 the FDA's Center for Devices and Radiological Health published “Considerations for the Regulation of Generative AI-Enabled Medical Devices” (Docket FDA-2026-N-7874) — a discussion paper and request for feedback, not draft or final guidance, with comments due October 19, 2026. Its two-axis risk map places clinician-supervised, action-directing output in the lowest-burden band and fully autonomous action-taking in the highest; and it points to the clinical-decision-support exclusion when a clinician can independently review the basis for a recommendation. Whether any product is a device is the FDA's determination, not ours.
What this means if you build the AI
The human is a requirement
If your output feeds a coverage decision in these states or under WISeR, a licensed human must make and sign the adverse call. Your product either supplies that human or your customer must.
The record is the product
A signature nobody can verify is a claim. A hash-anchored receipt with the NPI, the timestamp, and the document is evidence. The plan’s auditor can check it without you.
Specialty match is in the statute
Colorado requires a clinician competent in the relevant clinical area; WISeR requires relevant clinical expertise. A generic reviewer does not satisfy either. The gate here fails closed outside a covered specialty.