AI Regulation Tracker  /  State law

Maryland insurers must report quarterly whether AI made each coverage denial, under HB 1563

Maryland now requires health insurers to tell the Insurance Commissioner, every quarter, whether an artificial intelligence, algorithm, or other software tool was used to make each coverage denial. The Commissioner can use those filings to open a formal examination.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published July 7, 2026  ·  Last updated July 7, 2026

Maryland has kept a specific question inside its insurance code: when a health plan denies a service, was a machine involved in the decision. House Bill 1563, passed in the 2026 regular session and enacted as Chapter 165, reenacts the statute that carries that question and extends the reporting regime around it. The reporting and examination provisions took effect June 1, 2026, so the duty is live now. For insurers, compliance officers, and the vendors that build denial-automation software, the practical reading is direct. Every quarter, the state expects a count of adverse decisions and a clear statement of whether an artificial intelligence, algorithm, or other software tool produced them.

What Maryland requires each quarter

The operative text sits in Insurance Article Section 15-10A-06. It provides that, on a quarterly basis, each carrier shall submit to the Commissioner, on the form the Commissioner requires, a report that describes specified information aggregated by zip code. That report covers membership counts, clean claims processed, and the carrier's grievance and adverse-decision activity. Within the adverse-decision detail, the statute requires the number of adverse decisions issued by the carrier, whether each involved a prior authorization or step therapy protocol, the type of service at issue, and, in the words of the statute, "whether an artificial intelligence, algorithm, or other software tool was used in making the adverse decision."

That is the sentence that matters for anyone running an automated utilization-review stack. The reporting duty is not a general survey of technology use. It is a per-category accounting tied to the actual adverse decisions the carrier issued, filed on a fixed quarterly cadence, on a form the Commissioner controls, and broken out by geography. The report also captures emergency cases specifically, including how many cases were treated as emergencies and how quickly the carrier decided grievances on them.

Where the AI-usage question came from

The requirement to record AI or software involvement did not originate with HB 1563. Maryland added that language through 2025 legislation, and the Maryland Insurance Administration has described the AI-usage flag and zip-code aggregation as applying to quarterly cycles beginning with the last quarter of 2025. HB 1563 reenacts Section 15-10A-06 with amendments, which means the General Assembly revisited the statute in 2026 and left the AI-usage requirement in place while expanding the reporting around it. The effect is that the automated-decision question now sits inside a section the legislature has confirmed twice in successive sessions rather than a one-time provision that might lapse.

For a compliance team, the origin story is less important than the standing rule. The rule is that the carrier must be able to say, decision by category, whether software was in the loop, and back that answer with records.

The spike trigger and the examination power

Two features give the reporting real weight. First, Section 15-10A-06 contains a growth trigger. If the number of adverse decisions for a type of service has grown by 10 percent or more in the immediately preceding calendar year, or by 25 percent or more over the immediately preceding three calendar years, the carrier must add to its report a description of any changes in medical management contributing to the rise, any other known reasons for the increase, and the actions the carrier took to determine the cause. A carrier cannot simply report a jump in denials and move on. It has to explain it.

Second, the statute gives the Commissioner an enforcement path. It provides that the Commissioner may use the information provided in these reports as the basis for an examination under Title 2, Subtitle 2 of the Insurance Article. That is the formal examination authority that Maryland regulators use to inspect a carrier's books, records, and practices. In plain terms, a carrier's own quarterly filing can be the document that opens an inquiry, and emergency-department denials are exactly the kind of category the data will surface, because the report breaks out emergency cases and their decision timing.

Read together, the two features change the character of the filing. A quarterly report that once functioned as a data return now carries a self-identified escalation path. A carrier that reports a large increase in denials for a service, and reports that automated tooling was used to make those decisions, has handed the regulator both a reason to look and the categories to look through. The statute does not require the Commissioner to act on any single number, and it does not set a denial rate that triggers penalties on its own. What it does is remove the excuse that the regulator lacked visibility. The information is now in the file, in a standardized form, aggregated by zip code, with emergency cases separated out.

What HB 1563 adds, and what it does not do yet

HB 1563 is broader than the reporting section alone. It directs the Commissioner to include, in the annual summary report compiled from carrier filings, data on adverse decisions and grievances related to post-acute services, including admissions to skilled nursing facilities and inpatient rehabilitation facilities. It also orders two studies, one quantifying hospital and post-acute bed capacity and one analyzing transitions from acute to post-acute care, both due to the Governor and named legislative committees on or before January 1, 2027.

The Act's headline coverage protection is on a different clock. New Section 15-504 states that a policy or contract issued in Maryland may not deny a covered emergency-room service solely on the basis that the insured did not experience an emergency medical condition, and the reenacted definitions in Section 15-1A-14 support that rule. Those coverage provisions take effect January 1, 2027 and apply to policies issued, delivered, or renewed on or after that date. So the piece of HB 1563 that changes what carriers must pay for is not live yet. The piece that changes what carriers must report, including the AI-usage question and the examination hook, is.

The practical standard for carriers and vendors

For carriers, the compliance question is not whether to disclose automated decision-making. The statute already requires it. The question is whether the reported figure can be defended. That means keeping an auditable connection between the utilization-review or claims system and the number filed, so that if the Commissioner asks how a decision was classified, the carrier can show the record rather than reconstruct it. It also means treating the growth-trigger narrative as a live compliance product, not a footnote, since a rising denial category now comes with a statutory duty to explain.

For denial-automation vendors, the reporting duty pushes into the product. A carrier client will need to know, for each adverse decision, whether the vendor's model or rules engine was used in making it, and will need that answer in a form that maps to the Commissioner's categories and to zip code. Vendors who can produce that mapping cleanly reduce their clients' filing risk. A vendor whose logs cannot say, decision by decision, whether the tool was in the loop leaves the carrier to estimate, and an estimate is the kind of answer that does not hold up in an examination.

Two practical points follow for both sides. The AI-usage flag is binary in the statute, but the underlying reality is often mixed, with software surfacing a recommendation that a human reviewer approves. Carriers should settle, and document, how they classify those hybrid decisions before the filing rather than case by case afterward, so the reported figure rests on a consistent rule. And because the report is aggregated by zip code, a carrier should expect the data to invite questions about whether automated denials fall unevenly across geographies, a pattern the Commissioner can examine even where each individual decision was defensible. Maryland is among the states building this kind of visibility into how insurers use software to deny care, and the design here, quarterly cadence, per-decision flag, growth trigger, and examination authority, is a template other regulators may look to.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.