Utah Limits AI Role in Health Insurance Preauthorization

Utah Governor Spencer Cox signed SB 319 into law on March 19, 2026, making Utah the latest state to restrict how health insurers use AI in preauthorization decisions. The law takes effect on January 1, 2027, and adds Utah to a growing list of states that require human clinical judgment for adverse preauthorization determinations.

The bill amends Utah’s health insurance preauthorization statute in several ways. Insurers must now disclose whether they use artificial intelligence in the review process for authorization requests. They must post preauthorization requirements and procedures conspicuously on their websites. For adverse determinations based on clinical or medical necessity, the reviewer must exercise independent medical judgment and cannot rely solely on recommendations from any other source, including AI. The law also sets maximum timeframes for authorization decisions and establishes minimum validity periods for authorizations covering chronic or long-term care conditions.

The Utah approach is similar to laws enacted in Arizona, Georgia, Iowa, Maryland, Nebraska, and Texas, but it adds a reporting requirement that goes further than some of its neighbors. Insurers must report to the Utah Insurance Department any use of AI in authorization request review. That reporting creates a new compliance obligation for carriers that may use AI tools for initial triage, document review, or recommendation generation but still rely on a clinician for the final decision.

For health insurers, the practical impact is that utilization management workflows in Utah must be redesigned to separate AI-assisted analysis from the final adverse determination. The reviewer must be able to demonstrate independent judgment, and the carrier must be able to document that the AI tool was not the sole basis for the denial. The website disclosure and reporting requirements also mean that carriers can no longer treat AI use in preauthorization as a quiet operational detail.

The broader trend is that state legislatures are converging on a common set of expectations for AI in health insurance: disclosure, human review, and limits on fully automated adverse decisions. Carriers operating in multiple states should expect a patchwork of specific requirements rather than a single federal standard. The carriers that build a reusable workflow around independent clinical review and AI disclosure will be better positioned than those that customize each state separately.

The Utah law also adds a reporting layer that some neighboring states do not require. Insurers must report AI use to the Utah Insurance Department, which means they need an internal inventory of where AI is used in the preauthorization process and a way to keep that inventory current. This is exactly the kind of documentation that the NAIC AI Systems Evaluation Tool asks for in Exhibit A. Carriers that have already built an AI inventory for NAIC preparation will find Utah compliance easier; carriers that have not will need to create one. They should also designate an owner for that inventory, because an outdated list is worse than no list at all.

For more on how state laws are reshaping AI use in health insurance, see our guide to AI in health insurance.