AI Regulation Tracker / Regulation signed

Alabama puts a licensed clinician on every AI-assisted denial, delay or modification from October 1

Alabama SB63 lets health plans keep using artificial intelligence in prior authorization, but a licensed physician or other health care professional competent to evaluate the AI's recommendation in light of the specific clinical issues involved must make any decision to deny, delay, or modify care. Plans also owe the Department of Insurance an annual certification and a written disclosure of where AI sits in the review. It takes effect October 1, 2026.

By Anthony Guerriero · Published July 31, 2026 · Last updated July 31, 2026

Alabama puts a licensed clinician on every AI-assisted denial, delay or modification from October 1 regulation briefing

The Leveraged Years AI Regulation Tracker

Regulatory Briefing

Bindingness: Binding Law
Scope: Alabama. Health benefit plan providers, including insurers, health maintenance organizations, nonprofit health care service plans, nonprofit agricultural organizations offering health benefits, internal utilization review departments, and any third-party contractor or agent performing utilization review.
What Changed: SB63 adds limits on the use of artificial intelligence by health benefit plan providers in determinations of coverage, and authorizes the Alabama Department of Insurance to investigate and impose disciplinary action for violations. It sets three obligations: a determination basis requirement, an annual certification, and a mandatory licensed-professional decision on any adverse determination.
Who This Affects: Insurers and their utilization review vendors operating in Alabama. Indirectly, treating physicians and practice administrators whose prior authorization requests are adjudicated in whole or part by an AI system, and the enrollees whose care is delayed or denied.
Current Status: Signed April 17, 2026. Effective October 1, 2026
Effective Date: October 1, 2026 (Section 2 of the enrolled act)
Primary Source: Alabama Legislature, SB63 enrolled text, https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/SB63-enr.pdf
Workflow Impact: Plans must document where AI touches utilization review, build a named clinician into the denial path, and produce an annual attestation. Provider-side practices should expect the required licensed professional to make the determination on any denial, delay, or modification and should record the clinical detail they submit, because subsection (b)(1) makes that information part of what determinations must be based on.
Operational Next Step: Read Section 1(b) and 1(c) of the enrolled text, then map every point in your prior authorization workflow where an automated system contributes to a medical necessity judgment and identify who the licensed decision-maker is at each one.
Last Verified: July 31, 2026

Alabama has joined the group of states that regulate artificial intelligence inside health insurance coverage decisions, and it has done so with a structure that is closer to a documentation-and-accountability regime than a prohibition. Senate Bill 63, carried by Senator Orr and read for the first time on January 13, 2026, passed the Senate as amended on February 19, was amended and passed by the House on April 8, and received Senate concurrence the same day. Governor Kay Ivey signed it on April 17, 2026. Section 2 of the enrolled act sets the effective date at October 1, 2026.

The act is short. Its operative content sits in a single new section with four subsections, and the obligations it creates are specific enough to audit.

What the AI must be looking at

Subsection (b)(1) sets the determination basis. A health benefit plan provider that uses artificial intelligence to make determinations of medical necessity on prior authorization requests must base those determinations on the enrollee's medical history, on any clinical circumstances unique to the enrollee which are presented by the requesting health care provider, and on additional clinical information about the enrollee which may be present in the medical record.

The wording matters for practices on the submitting end. The statute names the requesting provider's presentation of unique clinical circumstances as part of the lawful basis for the decision. A plan that adjudicates on a thin record is exposed in a way it was not before, and a practice that submits a thin record has given the plan less clinical basis to satisfy subsection (b)(1).

The definition of artificial intelligence in subsection (a)(1) is broad. It reaches a machine-based system, including software or physical hardware, that performs tasks based upon data set inputs which require human-like perception, cognition, planning, learning, communication, or physical action, and which is capable of improving performance based upon learned experience without significant human oversight. Utilization review is defined separately at (a)(10) as the determination of prior authorization requests under the plan's own rules, policies, and guidelines.

The annual certification

Subsection (b)(2) requires an annual certification to the Department of Insurance covering three things. First, that the artificial intelligence does not rely on a group dataset to make determinations. Second, that it is fairly and equitably applied, including in accordance with any applicable regulations and guidance issued by the U.S. Department of Health and Human Services. Third, that it does not discriminate, directly or indirectly, against any subscriber group or enrollee in violation of state or federal law.

The first of those three is the one with teeth for model design. A prohibition on relying on a group dataset to make determinations is a direct constraint on the population-level statistical inference that makes automated utilization review cheap in the first place.

Subsection (c)(4) softens the compliance burden in a way worth reading closely. The requirements of subsections (b) and (c) are satisfied by an attestation from an authorized representative of the plan based on reasonable reliance upon internal policies, procedures, and third-party vendors. A plan may lean on its vendor's representations. It cannot, on the face of the statute, lean on nothing.

A licensed human on every adverse determination

Subsection (b)(3) is the provision that changes daily practice. In addition to the requirements in (b)(1) and (b)(2), a determination to deny, delay, or modify a request for prior authorization based on medical necessity shall always be made by a licensed physician or other health care professional who is competent to evaluate any recommendation or conclusion of artificial intelligence in light of the specific clinical issues involved in the health care service requested.

Two words carry weight. "Always" removes the tiered exception structure some states use. "Competent to evaluate" attaches a subject-matter qualification to the reviewer rather than accepting any licence as sufficient. The statute reaches delay and modification, not only outright denial, which closes the common workaround of downgrading a request rather than refusing it.

Disclosure, monitoring, and patient data

Subsection (c) adds three standing duties. The plan must make prominent written disclosure regarding its use of artificial intelligence in utilization review in its policies and procedures. It must review its AI and the outcomes it generates on a periodic basis to maximize accuracy and reliability. And it must ensure that patient data used in utilization review functions by artificial intelligence is not used beyond its intended and stated purpose, consistent with HIPAA.

The disclosure duty is located in the plan's policies and procedures under subsection (c)(1). Alabama's transparency runs to the regulator and to the documented process first.

How the Department enforces it

Subsection (d) builds a graduated enforcement path. When the Department has reasonable grounds to believe a plan is engaged in conduct violating subsection (b), including making prior authorization determinations adverse to an enrollee without taking into consideration the enrollee's medical history and relevant clinical circumstances, it notifies the plan, which must respond within 30 days. If the response is unsatisfactory, the Department may hold a hearing under Article 1, Chapter 2 of Title 27.

On an adverse finding, the Department may impose a corrective plan on the provider's procedures, policies, and guidelines. For repeat violations, it may additionally impose an administrative fine of not more than $5,000 for a violation that occurred with such frequency as to indicate a general business pattern or practice, and may suspend or revoke the certificate of authority on the same pattern-or-practice standard. The plan must also reimburse the Department for the administrative expenses of investigation and enforcement. Subsection (e) directs the Department to adopt rules to enforce the section, so the operational detail will arrive through rulemaking rather than the statute.

The dollar figure is modest. The certificate of authority exposure is not, and that is the provision that will shape how carefully plans document the licensed reviewer's involvement.

Where Alabama sits among the states

Alabama is one of several states that acted on AI in health coverage in 2026, and the group is not converging on a single model. Washington SB 5395 took effect June 11, 2026 and bars AI as the sole means of denying, delaying, or modifying care. Iowa HF 2635 took effect July 1, 2026. Colorado HB26-1139, signed June 2, 2026, applies from January 1, 2027 and pairs utilization review limits with a bar on reimbursing AI-delivered psychotherapy. Utah SB 319 and Georgia SB 444 also apply from January 1, 2027. Illinois SB3114, the Transparency in Downcoding Act, reaches the adjacent problem of automated downcoding from January 1, 2028.

A plan operating across several of these states cannot run one workflow. The determination-basis language, the certification cadence, and the qualification standard for the human reviewer differ by jurisdiction, and Alabama's "always" plus "competent to evaluate" is at the stricter end on the reviewer question.

Questions this raises

Does Alabama SB63 ban insurers from using AI in prior authorization?

No. It permits AI in utilization review and regulates how it is used. The constraints are on what the AI may base a determination on, what the plan must certify annually, and who must make any decision to deny, delay, or modify care.

Who has to make the final call on a denial?

A licensed physician or other health care professional competent to evaluate the AI's recommendation in light of the specific clinical issues involved in the requested service. Subsection (b)(3) says this determination shall always be made by that person, and it covers delay and modification as well as denial.

What are the penalties?

The Department may first impose a corrective plan. For repeat violations amounting to a general business pattern or practice, it may impose an administrative fine of up to $5,000 and may suspend or revoke the plan's certificate of authority. The plan also reimburses the Department's investigation and enforcement costs.

When do plans have to comply?

October 1, 2026, under Section 2 of the enrolled act. The Department of Insurance is directed to adopt enforcement rules, so further operational detail is expected through rulemaking.