Six days to produce your AI inventory

Three of the country’s largest health insurers have until Tuesday to hand Congress a list of every predictive tool they use in coverage decisions. Whatever they produce sets the format the rest of the industry gets asked for next.

This week’s story: what UnitedHealth, Humana, and CVS have to hand over by Tuesday

Two senators, one from each party, want to see the machinery. Richard Blumenthal and Josh Hawley wrote to UnitedHealthcare, Humana, and CVS Health on July 14, asking how each decides post-acute care coverage and specifically what software touches determinations of medical necessity, payment, and authorization. Each company was asked to restate in writing that no final Medicare Advantage denial is issued by technology alone, and to hand over a list of the predictive tools it runs. Answers are due July 28.

None of this carries subpoena power. Blumenthal writes from the minority as the investigations subcommittee’s ranking member, which on its own would make a slow-walk cheap. Hawley’s signature is what raises the price. Between them the letters move AI-assisted prior authorization off the vendor-management agenda and onto an oversight docket, where the test is not whether a model performs but whether a denial it shaped holds up when read aloud.

The document itself is the part to watch. Three of the largest carriers in the country have two weeks to produce a predictive-tool inventory, and whatever they settle on becomes the reference point when an examiner or a plaintiff’s counsel asks for yours. Courts got there first: a federal magistrate has already ordered UnitedHealth to open its files on nH Predict, down to the minutes of its AI review board. July 28 tests whether Congress can pull the same records by asking.

Set that beside the vote two days later. On July 16 the Senate declined, 46 to 50, even to take up a resolution that would have ended CMS’s WISeR Model, leaving AI-assisted prior authorization running in traditional Medicare across six states. Private plans are being told to show their work. The public program is scaling up with less disclosure attached. A carrier in both markets does not get to average the two.

Full breakdown of the inquiry, including what a defensible file looks like: Senators Press UnitedHealth, Humana, CVS on AI-Driven Medicare Advantage Care Denials. On the WISeR vote and what closes next: Senate Blocks Effort to End AI Prior Authorization in Traditional Medicare.

What to do this week

• Build the predictive-tool inventory before anyone asks for it: every AI touchpoint in prior authorization and utilization management, named, with an owner
• For each one, make sure the file names a reviewer, the criteria they worked from, and the reason the decision landed where it did. Missing any of the three, the file answers “the model recommended it” by default, and that does not survive being read into a hearing record
• Line that inventory up against the disclosures you have already filed with state regulators. Where the two describe different systems, the difference is the exposure
• If you write both traditional Medicare and Medicare Advantage, hold the whole book to the Medicare Advantage standard. Two standards running at once is not a reason to document to the looser one

On the Docket

• July 22, 2026, 12:00 PM ET: The NAIC’s Big Data and Artificial Intelligence Working Group takes up governance trends with an actuarial panel, plus where the AI Systems Evaluation Tool pilot now stands. Relevant to anyone tracking the model framework. NAIC committee page
• July 28, 2026: UnitedHealthcare, Humana, and CVS Health responses due to Senators Blumenthal and Hawley. Health insurers using algorithms anywhere in utilization management.
• Fall 2026: NAIC targets adoption of the AI Systems Evaluation Tool. Carriers preparing for a standardized evaluation regime.
• Jan 1, 2027: Illinois’s frontier AI statute begins operating, with the audit requirement it is best known for held back to January 2028. Matters to any insurer whose stack sits on a frontier vendor.
• Jan 1, 2027: Minnesota’s prohibition kicks in, signed May 27: no adverse determination reached on automation alone, and the sign-off has to come from an appropriate health professional.

This week in brief

Governance

The White House launched Gold Eagle, a clearinghouse that brings AI developers together with critical-infrastructure operators to share vulnerabilities discovered by advanced AI systems. Treasury leads it, which puts the department at the center of financial-sector policy in charge of how AI-found flaws get disclosed. Cyber underwriters should expect historical loss patterns to get less stable. White House announcement

Britain brought the UK cloud arms of Amazon, Microsoft, Google, and Oracle inside the financial regulators’ perimeter on July 13, with the Bank of England, the PRA, and the FCA overseeing the resilience of the critical services they supply rather than reaching them through the firms that depend on them. A vendor oversight program that stops at the model now has a layer underneath it to account for. Bank of England

Texas issued Commissioner’s Bulletin B-0003-26, and it reaches further than the headline does: every regulated entity, and every “advanced analytical and computational” technology standing behind a decision that touches a consumer, not AI alone. Those decisions have to comply with existing insurance law, a person should review the consequential ones before action is taken, and the same expectations extend to any third party working with a regulated entity. Pull the pre-deployment testing evidence first, since it is the piece that cannot be reconstructed after the fact. Texas Department of Insurance

Business Lines

ISO’s generative AI exclusions carry a 01 26 edition date and are reported effective from January 2026, and the seam is the definition rather than the title. The forms define generative AI as a system that creates content, which describes producing text and images and does not obviously describe taking actions. The Insurer reported on July 10 that ISO is weighing exclusions aimed specifically at agentic systems. Pull the endorsement schedule and read the wording, not the form name. Verisk

Sysdig published its analysis of JADEPUFFER, an intrusion its researchers believe a language model drove from first scan to extortion demand with no operator present. The way in was mundane: an internet-facing Langflow instance left unpatched against a published CVE. That is the part an underwriter can put a number on. Sysdig

NHTSA wants measurable standards for how a self-driving car behaves, replacing crash-by-crash enforcement with competencies a manufacturer can pass or fail. Those competencies get settled in the public comment NHTSA plans to seek first, not in the final rule, and they are what an AV fleet account will be asked to evidence later. That round has not opened yet; anyone underwriting commercial auto for AV operators wants to be ready to file the day it does. Insurance Journal

One data point

31 seconds. That is how long JADEPUFFER took to correct its own failure mid-campaign, according to Sysdig’s reconstruction. Response plans assume a human on the other side: a lull between stages, a mistake that gives away intent, a window in which to negotiate. Thirty-one seconds is faster than a pager.

That’s the week. Reply to the email this issue arrived in if you want us to dig into any of these further, we read every reply.

Correction, July 28, 2026: six entries have been rewritten after a line-by-line read against the reports behind them, four in the brief and two on the docket. On the docket: the Illinois audit duty begins in 2028 rather than 2027, and Minnesota’s bar is not limited to AI. Designation is not authorisation, and what the three UK regulators took on jointly is the resilience of the critical services those cloud units supply, which is narrower than the entry as sent. The Texas bulletin binds every regulated entity, and the technologies it names go well past AI. The ISO endorsements carry a 01 26 edition date and are reported effective that January; the July 2025 filing proposed the date rather than recording it. And there was no NHTSA docket to read, because the comment request has yet to open. Subscribers received the July 22 email as it was written, and it has not been recalled.

– The Editor, InsureAI Wire