AI Regulation Tracker / Law and enforcement
Utah Puts a Human in the Loop for AI in Prior Authorization
Utah's S.B. 319 was signed into law on March 19, 2026 and takes effect January 1, 2027. It makes an insurer disclose when it uses artificial intelligence to review prior authorization requests, and it keeps a person exercising independent medical judgment on any denial for clinical or medical necessity. This is a signed state law, not yet in force.
Utah's S.B. 319 is a prior authorization reform bill, the kind of health insurance housekeeping that usually stays off the AI radar. It sets response deadlines, requires insurers to publish their preauthorization rules and their approval and denial statistics, and locks in minimum authorization windows for chronic and long-term care. Two provisions inside it are worth reading closely if you follow how states are handling automated decisions.
The AI disclosure requirement
The first is transparency. An insurer that runs AI inside its prior authorization workflow can no longer keep that quiet. Under the amended Section 31A-22-650, an insurer must post on its website, in a conspicuous location accessible to the public, in the bill's words, "a notice that the insurer uses artificial intelligence in the insurer's processes for reviewing an authorization request, if applicable." The same section adds a direct-notice duty: the insurer "shall disclose to the department, to each health care provider in the insurer's network, and to each enrollee if the insurer uses artificial intelligence in the insurer's processes for reviewing an authorization request."
Read that plainly. Utah is not telling insurers they cannot use AI to triage or review authorization requests. It is telling them they have to be open about it, to the regulator, to the doctors in their network, and to the patients whose care is on the line. The bill also writes generative AI into its definitions, so this is not limited to older rules-based automation.
The human-judgment requirement
The second provision is the one that puts a person back in the seat for the decision that hurts. When an insurer issues an adverse preauthorization determination, meaning a denial, on clinical or medical necessity grounds, the bill requires that the determination be made by an individual who, again in the enrolled text, "exercises independent medical judgment" and "does not rely solely on recommendations from any other source." The long-title summary says the same thing in plainer language: it "requires an individual reviewing an adverse preauthorization determination to use independent medical judgment and not rely solely on recommendations from any other source."
The phrase "any other source" is doing quiet work. It covers an AI model the same way it covers a vendor script or an internal checklist. A denial cannot be the machine's call alone. A qualified person has to own it, with knowledge of the enrollee's condition or a consult with a specialist who has that knowledge, and that person has to exercise their own judgment rather than rubber-stamp what a tool spit out. That is the human-in-the-loop principle written into statute, aimed squarely at the moment that matters most, the denial.
What this is, and what it is not
Let me be precise, because AI-in-healthcare stories get oversold fast.
This is a binding law. It passed both chambers with strong margins and the governor signed it. But it is not in force yet. The bill carries a special effective date, and the operative language is short and clear: "This bill takes effect on January 1, 2027." So between now and then, nothing about an insurer's Utah obligations has changed on the ground. What has changed is certainty about where the line will sit.
It is also not an AI ban. The bill does not prohibit insurers from using AI in prior authorization, does not cap how much they use it, and does not require any particular technology. It requires two things: tell people you are using AI, and keep a human exercising real judgment on the denials. If you have seen headlines suggesting Utah "banned AI in insurance decisions," that is not what the text says. Disclosure plus accountable human judgment is the actual ceiling here.
Why a Utah insurance bill matters outside Utah
Because Utah is not alone, and the pattern is what travels. States are converging on the same answer to automated coverage decisions: you can use the tools, but you have to disclose them and a licensed human has to stand behind the denial. Arizona moved on this with HB 2175, Georgia with SB 444, and Utah's S.B. 319 is another brick in that wall. The specifics differ, but the shape is consistent, transparency about AI use and a human-in-the-loop guardrail on adverse determinations.
For US CPAs, finance leaders, and compliance teams, even those nowhere near health insurance, that shape is the takeaway. The direction of state AI regulation on high-stakes automated decisions is not "prove your model is perfect." It is "disclose that you are using it and keep an accountable person on the decisions that deny someone something." If your organization uses AI anywhere a customer, employee, or counterparty can be told no by a system, this is the template to plan against: written disclosure, and a named human who exercises independent judgment and does not defer entirely to the tool.
What to do now
Read the finding, not the headline. Utah requires AI disclosure and human judgment on denials in prior authorization. It does not ban AI. If you operate in Utah's health insurance market, the work is straightforward and the clock runs to January 1, 2027: confirm where AI touches your authorization process, stand up the public website notice and the direct notices to the department, network providers, and enrollees, and make sure every clinical-necessity denial is made by an individual with the required knowledge who exercises independent judgment. If you are outside that market, use S.B. 319 as a design pattern for any AI-assisted decision that can go against a person, and build the disclosure and the human sign-off before a regulator asks you to.
Questions professionals are asking
Did Utah ban AI in prior authorization?
No. S.B. 319 does not prohibit insurers from using AI in prior authorization. It requires an insurer to disclose that it uses AI in the authorization review process, and it requires that any adverse determination on clinical or medical necessity be made by an individual who exercises independent medical judgment and does not rely solely on recommendations from any other source.
Is the law in force yet?
Not yet. Governor Cox signed it on March 19, 2026, but the bill has a special effective date and takes effect January 1, 2027. It is binding law, but insurers are not obligated to comply until it becomes operative.
What exactly does the disclosure requirement say?
Under the amended Section 31A-22-650, an insurer must post on its website "a notice that the insurer uses artificial intelligence in the insurer's processes for reviewing an authorization request, if applicable," and must disclose to the state insurance department, to each network provider, and to each enrollee if it uses AI in that process.
Who has to make a denial under the law?
An adverse preauthorization determination on clinical or medical necessity must be made by an individual who has knowledge of the enrollee's condition, or who consults a specialist with that knowledge, and who "exercises independent medical judgment" and "does not rely solely on recommendations from any other source." That includes not deferring the decision entirely to an AI system.
Does this affect finance leaders outside Utah or outside health insurance?
Not as a legal duty. It is a Utah health insurance law. But it is a useful benchmark. Along with Arizona's HB 2175 and Georgia's SB 444, it shows states settling on a common model for AI-assisted decisions that can go against a person: disclose the AI use and keep an accountable human exercising independent judgment on the adverse decision.
RELATED BRIEFINGS
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal, accounting, or audit advice. Confirm how any law or requirement applies to your situation with qualified professionals in the relevant jurisdiction.