Fifty rulebooks and one empty chair#

Picture a mental health chatbot company in San Francisco planning a national launch. In California, its product must tell users they are talking to a machine and must follow a protocol when someone mentions suicide. In Illinois, it cannot offer anything that looks like therapy at all unless a licensed professional is delivering it, and each violation can cost up to $10,000 (Illinois Public Act 104-0054). In Utah, a different AI company has been allowed, inside a state-run sandbox, to renew prescriptions for chronic conditions (Utah Department of Commerce).

Same technology. Three very different legal answers.

That is roughly where American health AI stands at the end of October 2026. Congress has not passed a general federal AI law. State legislatures have filled the space at speed: more than 280 health AI bills were introduced in 2026, and 40 of them were enacted across 24 states by the third quarter (Manatt Health, Q3 2026). Meanwhile the White House has been trying to rein those states in.

For anyone building, studying or buying health AI, this patchwork is not an abstract policy debate. It decides what your product must disclose, who must sign off on its outputs, and in some places whether it can exist. Here is how the pieces fit together, what the evidence says about why states are acting, and where the cracks are.

The basics: who regulates what in American health AI#

A few terms first, because the vocabulary does a lot of work in this story.

Federal versus state law. The US has two layers of government that both make laws. Federal law applies everywhere; state law applies only inside one state. When the two conflict, federal law usually wins. Lawyers call that preemption: a federal rule that overrides, or "pre-empts", state rules on the same subject.

The FDA's slice. The Food and Drug Administration regulates medical devices, and some software counts as a device when it is meant to diagnose or treat disease. The agency keeps a public list of AI-enabled devices it has authorised, though it stresses the list is "not a comprehensive resource" (FDA). FDA AI regulation therefore covers a radiology algorithm that flags strokes, but it does not cover most general chatbots, insurers' claims software or hospital scheduling tools.

The gaps. That leaves a lot of health-adjacent AI with no dedicated federal referee. Consider the algorithms insurers use for utilisation review, the process of deciding whether a treatment is medically necessary and will be paid for. A 2026 analysis in the Journal of Law, Medicine & Ethics argued that AI tools used by large insurers in Medicare Advantage prior authorisation have received "little attention" compared with clinical devices, and called for coordinated oversight by federal agencies and state insurance commissioners (Sirbu, 2026).

Why states can act at all. American states have traditionally licensed doctors, nurses and therapists, and they regulate insurance. Those powers give them natural hooks for health AI. If a chatbot claims to be a psychiatrist, that may look like unlicensed practice. If an insurer's model denies care, that falls under insurance law.

Other jargon you will meet:

  • Chatbot / companion chatbot: software that holds a conversation in natural language, sometimes designed to act as a friend or confidant.
  • Regulatory sandbox: a controlled arrangement in which a regulator temporarily relaxes certain rules for a company, in exchange for monitoring and safeguards.
  • Downcoding: when an insurer pays a claim at a lower billing level than the clinician submitted.
  • Human in the loop: a requirement that a qualified person reviews or approves what the AI produces before it affects a patient.

How Washington ended up on the sidelines#

The federal vacuum is partly by design. In July 2025 the administration published an AI action plan that, as health policy researcher David Blumenthal noted in NEJM AI, "discourages regulation, singling out health care as a field in which regulation is inhibiting innovation" (Blumenthal, 2025).

There have been attempts to stop the states too. A proposed 10-year AI moratorium on state AI laws was attached to the 2025 budget bill, later trimmed to five years, and then stripped out when the Senate voted 99 to 1 against it on 30 June 2025 (States Newsroom via News From the States).

The White House then tried a different route. Executive Order 14365, signed on 11 December 2025, told the Attorney General to set up an "AI Litigation Task Force" whose "sole responsibility shall be to challenge State AI laws" that conflict with federal policy. It also asked the Commerce Department to publish a list of "onerous" state laws within 90 days and to make states with such laws ineligible for some broadband grant money (Federal Register, EO 14365). Note the exemptions written into that order: its legislative proposal was not to pre-empt state laws on "child safety protections", state procurement, or data-centre infrastructure.

How much has that achieved? Less than the headlines suggested. Manatt reported in mid-2026 that the Commerce evaluation, due on 11 March 2026, had still not been published (Manatt Health, Q2 2026). The White House's March 2026 legislative framework for Congress was a four-page, nonbinding document. It proposed pre-empting state rules on AI development while preserving state police powers and child-protection laws, and it offered no health-specific legislation, leaning instead on existing agencies such as the FDA and the Centers for Medicare & Medicaid Services (CMS) (Holland & Knight).

In Congress, the bipartisan FRONTIER Act introduced in July 2026 would impose duties on the biggest frontier model developers and pre-empt state rules aimed at developers, while explicitly preserving state authority over how AI is used (Manatt Health, Q3 2026). That distinction between building AI and using it matters enormously for health care, because nearly every state health AI law regulates use.

What the states have actually passed#

The volume is striking, but the pattern is more telling. Most of the activity falls into a few buckets.

State health AI bills introduced versus enacted in 2026, by category Grouped bar chart. Chatbots: 88 introduced, 12 enacted. Clinical use: 46 introduced, 7 enacted. Payer use: 45 introduced, 6 enacted. Liability: about 20 introduced, 0 enacted. Data from Manatt Health Q2 2026. State health AI bills in 2026: introduced vs enacted 20 40 60 80 0 Number of bills 88 12 Chatbots 46 7 Clinical use 45 6 Payer use ~20 0 Liability Introduced Enacted
Figure 1. Health AI bills introduced and enacted in US state legislatures in the first half of 2026, by category. Source: Manatt Health, Q2 2026. Liability figure is approximate.

Chatbots that might meet people in crisis#

Chatbots are the busiest category. By mid-2026, 88 chatbot bills had been introduced and 11 states had enacted 12 chatbot laws. Most require clear disclosure that the user is talking to AI, and 10 of the 12 require the system to detect self-harm, suicidal thoughts or mental health crises and respond, for instance by referring users to the 988 crisis line. Six states (Colorado, Georgia, Nebraska, Hawaii, Iowa and Idaho) now bar chatbots from presenting themselves as mental health providers (Manatt Health, Q2 2026).

California went further in September. Its SB 1119 adds age-assurance, auditing and parental-control requirements, and a separate law treats some deployers of consumer health chatbots as health care providers under the state's medical confidentiality statute from January 2027 (Manatt Health, Q3 2026).

Insurers using algorithms to say no#

The second bucket targets payers. Forty-five payer AI bills were introduced in 2026, and six states enacted laws. Alabama, Minnesota, Colorado and Georgia now bar prior-authorisation denials made by AI alone without human review, while Indiana and Illinois have tackled algorithmic downcoding (Manatt Health, Q2 2026). Washington's SB 5395 says only a licensed physician or health professional may deny care on medical-necessity grounds, and AI cannot be the sole means to deny, delay or modify care (Becker's Payer Issues).

Clinicians and AI in the therapy room#

The third bucket governs clinical use. Twenty-seven states introduced 46 clinical AI bills; six enacted seven laws. Colorado and Maine now limit licensed therapists to administrative or supplementary AI support, and several states require written notice and consent before AI records or transcribes a session (Manatt Health, Q2 2026). Texas took a lighter, disclosure-based approach: since September 2025 practitioners can use AI for diagnostic support if they review the AI-generated records and tell patients (Akin Gump). California's earlier AB 3030 requires a disclaimer on AI-generated clinical messages to patients unless a licensed clinician has read and reviewed them (Future of Privacy Forum).

Liability is the quiet bucket. Around 20 bills tried to clarify who pays when AI contributes to harm, and none had passed as of mid-2026 (Manatt Health, Q2 2026).

Five states, five philosophies#

It helps to see how differently states think about the same problem. The table below compares five of them.

StateFlagship health AI measureCore approachWhat it requires in practiceStatus
IllinoisWellness and Oversight for Psychological Resources Act (Public Act 104-0054)ProhibitionNo AI therapy for the public unless delivered by a licensed professional; AI limited to admin and supplementary support; fines up to $10,000 per violationIn force since August 2025 (ILGA)
CaliforniaAB 3030, SB 243, SB 1119, SB 503Layered transparency and safety dutiesAI disclaimers on clinical messages, chatbot crisis protocols, bias monitoring for clinical decision supportSeveral provisions take effect from January 2027 (Manatt Q3)
TexasTRAIGA (HB 149) and SB 1188Disclosure plus clinician reviewProviders disclose AI use; practitioners review AI-generated recordsSB 1188 from Sept 2025; HB 149 from Jan 2026 (Akin Gump)
ColoradoSB 26-189 (replacing the 2024 Colorado AI Act)Narrowed anti-discrimination lawBroad exemption for HIPAA-covered entities; FDA-regulated devices excluded; Attorney General enforcement onlySigned May 2026, effective Jan 2027 (Holland & Knight)
UtahOffice of AI Policy regulatory sandboxPermission with monitoringCase-by-case agreements, such as AI prescription renewals, under safety evaluationAgreements signed through 2026 (Utah Commerce)

The Colorado AI Act story is worth pausing on. Colorado passed the country's first broad anti-discrimination AI law in 2024. It was named in the December 2025 executive order, challenged in federal court, and in May 2026 repealed and replaced before it ever took effect. The replacement drops the original "reasonable care" duty, mandatory risk-management programmes and annual impact assessments (Holland & Knight). Whether you see that as sensible pruning or a retreat under pressure depends on where you sit.

The Utah AI law model runs the other way. Rather than banning or restricting, Utah's Office of AI Policy signs "regulatory mitigation agreements" that let companies try things existing rules would not allow. Its first, with Doctronic, covers routine prescription renewals for chronic conditions (Utah Commerce). It has not been frictionless. In April 2026 the state's medical licensing board called for the pilot to be suspended; the state declined, noting that a physician reviews each AI renewal in the first phase (Manatt Health, Q2 2026).

Why legislators are nervous: the evidence behind the rules#

State AI laws did not appear out of nowhere. Several research findings line up closely with what legislators chose to regulate.

On chatbots and suicide, a RAND-led study in Psychiatric Services posed 30 suicide-related questions to three popular chatbots 100 times each, generating 9,000 responses. The bots handled the extremes reasonably well: none gave direct answers to the very-high-risk questions. In the intermediate range, though, they "did not meaningfully distinguish" risk levels (McBain et al., 2025). Intermediate risk is where clinical judgement matters most. A separate audit of five language models across more than 2,000 crisis-related messages found that a "nonnegligible proportion" of responses were inappropriate or harmful, especially for self-harm and suicidal ideation, and that all models struggled with indirect or ambiguous signals (Arnaiz-Rodríguez et al., 2025).

Those findings map almost one-to-one onto the crisis-protocol requirements now written into a dozen state chatbot laws.

On algorithmic bias, the classic example remains a 2019 Science paper showing that a widely used commercial algorithm for managing patient populations systematically underestimated the needs of Black patients, because it used past health spending as a stand-in for health need (Obermeyer et al., 2019). California's new SB 503, which requires developers and deployers of AI clinical decision support to identify and monitor bias risks, tackles exactly this failure mode (Manatt Health, Q3 2026).

To be fair to the technology, the same literature also shows promise. In the McBain team's companion study in the Journal of Medical Internet Research, two of three large models rated responses to suicidal ideation at or above the level of trained mental health professionals, though all three were biased towards judging responses as more appropriate than expert suicidologists did (McBain et al., 2025, JMIR). The evidence supports guardrails. It does not support blanket bans, nor blind deployment.

The cost of a patchwork, and who pays it#

Supporters of AI preemption make a reasonable point. A start-up selling one product into 50 markets faces 50 sets of definitions, effective dates and enforcement bodies. Effective dates alone are a maze: among the chatbot laws, Hawaii's applied from July 2026, Colorado, Washington, Oregon and Rhode Island's from January 2027, and Georgia, Idaho and Iowa's from July 2027 (Manatt Health, Q2 2026). Compliance teams at large health systems can absorb that. A four-person company often cannot.

The counter-argument is just as practical. States are where clinicians are licensed and insurers supervised, and federal health agencies have mostly chosen pilots, discussion papers and payment experiments over binding AI rules. The FDA's August 2026 generative AI discussion paper, for example, is explicitly "not guidance" (Manatt Health, Q3 2026). Strip away state laws now and, for much of health AI, there would be nothing left in their place.

The split between developers and deployers offers a possible truce. Both the White House framework and the FRONTIER Act aim mainly at rules for building models, while leaving states room to regulate how AI is used (Holland & Knight; Manatt Health, Q3 2026). If that line holds, most state health AI laws would survive, since they govern clinicians, insurers and consumer-facing services rather than model training.

us states health ai laws 2

What to watch next, and what to do now#

A few dates and threads deserve a place in your diary.

First, California's wave. Its health chatbot confidentiality law and SB 503 take effect on 1 January 2027, and most core provisions of SB 1119 follow on 1 July 2027 (Manatt Health, Q3 2026). Because California is such a large market, its rules often become the national default in practice.

Second, Utah's sandbox. Doctronic's agreement was due to expire at the end of October 2026, with renewal expected, and other agreements covering AI physiotherapy, medication refills and acne treatment are lined up (Manatt Health, Q3 2026). Utah is effectively running a live experiment in permissive regulation, and it will generate rare real-world safety data.

Third, the federal fight. Watch whether the Justice Department's task force brings any case against a health-specific state law, and whether Congress moves a frontier AI bill with a preemption clause.

For builders and researchers, a pragmatic approach looks like this:

  1. Design to the strictest common denominator. AI disclosure, crisis detection with human escalation, and clinician sign-off appear across so many state laws that building them in from the start is cheaper than retrofitting.
  2. Map your use, not your model. State health AI laws mostly bite on what the system does: therapy, coverage decisions, patient messages. Classify each feature accordingly.
  3. Keep evidence of safety. Utah's sandbox asks for evidence of non-inferior care quality and safety (Manatt Health, Q3 2026). Expect other regulators to ask for the same.
  4. Track effective dates, not signing dates. Many 2026 laws bite in 2027 or 2028.

The US may eventually get a single federal rulebook for AI. For health care, though, the rules that matter most right now are being written in Springfield, Sacramento, Austin, Denver and Salt Lake City. Anyone working in health AI should be reading them.

Frequently asked questions#

Does the US have a federal AI law?

No. Congress has not passed a comprehensive federal AI law. Federal oversight relies on existing agencies such as the FDA and CMS, executive orders, and voluntary frameworks, while bills such as the FRONTIER Act remain proposals (Manatt Health, Q3 2026).

How many state AI laws cover health care?

By the third quarter of 2026, more than 280 health AI bills had been introduced in state legislatures that year, and 40 had been enacted across 24 states (Manatt Health, Q3 2026).

Can an AI chatbot legally act as a therapist in the US?

It depends on the state. Illinois bars AI therapy for the public unless a licensed professional provides it (ILGA), and six more states bar chatbots from presenting themselves as mental health providers (Manatt Health, Q2 2026).

Can my insurer use AI to deny a claim?

Insurers can use AI in reviews, but a growing number of states, including Alabama, Minnesota, Colorado, Georgia and Washington, prohibit denials based on AI alone without review by a qualified human (Manatt Health, Q2 2026; Becker's Payer Issues).

Did the Trump executive order cancel state AI laws?

No. Executive Order 14365 directs federal agencies to challenge state AI laws and attach conditions to some grants, but an executive order cannot repeal state law by itself. It also exempts child safety protections from its preemption proposal (Federal Register).

What happened to the Colorado AI Act?

Colorado repealed and replaced it in May 2026 with SB 26-189, which takes effect in January 2027, removes several original duties and broadly exempts HIPAA-covered health care entities for most uses (Holland & Knight).

Do Texas doctors have to tell patients they use AI?

Yes. Texas law requires health care providers to disclose AI use in a patient's care, and practitioners using AI for diagnostic support must review the AI-generated records (Akin Gump).

Is the FDA regulating health chatbots?

Only when software meets the definition of a medical device. Most general-purpose chatbots fall outside that scope, which is one reason states have stepped in. The FDA published a discussion paper on generative AI in August 2026, but it is not binding guidance (Manatt Health, Q3 2026).

References#

Peer-reviewed research

  1. McBain RK, Cantor JH, Zhang LA, et al. Evaluation of Alignment Between Large Language Models and Expert Clinicians in Suicide Risk Assessment. Psychiatric Services. 2025;76(11):944-950. https://doi.org/10.1176/appi.ps.20250086
  2. McBain RK, Cantor JH, Zhang LA, et al. Competency of Large Language Models in Evaluating Appropriate Responses to Suicidal Ideation: Comparative Study. Journal of Medical Internet Research. 2025. Consensus record
  3. Arnaiz-Rodríguez A, Baidal M, Derner E, et al. Between Help and Harm: An Evaluation Study of Mental Health Crisis Handling by Large Language Models. JMIR Mental Health. 2025. Consensus record
  4. Obermeyer Z, Powers B, Vogeli C, Mullainathan S. Dissecting racial bias in an algorithm used to manage the health of populations. Science. 2019;366(6464):447-453. https://doi.org/10.1126/science.aax2342
  5. Sirbu R. Artificial Intelligence in Health Insurance: An Interagency Framework for Federal and State Oversight. Journal of Law, Medicine & Ethics. 2026;54(3):387-396. https://doi.org/10.1017/jme.2026.10269
  6. Blumenthal D. The Trump Administration's Recent Policy Proposals Regarding Artificial Intelligence. NEJM AI. 2025;2(10). (Editorial) https://doi.org/10.1056/AIpc2500892

Official government sources

  1. Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence. Federal Register 90(239), 16 December 2025. govinfo.gov
  2. Illinois General Assembly. Public Act 104-0054, Wellness and Oversight for Psychological Resources Act. ilga.gov
  3. Utah Department of Commerce. Utah and Doctronic Announce Partnership for AI Prescription Medication Renewals. 6 January 2026. commerce.utah.gov
  4. US Food and Drug Administration. List of Artificial Intelligence-Enabled Medical Devices. fda.gov

Policy trackers and legal analyses (used where primary statutory summaries were needed)

  1. Manatt Health. Q3 Health AI Tracker: Federal Agencies, California and Utah's Sandbox Take Center Stage. 2026. manatt.com
  2. Manatt Health. Q2 2026 AI Policy and Health Care. 2026. manatt.com
  3. Holland & Knight. Colorado Governor Signs SB 189. May 2026. hklaw.com
  4. Holland & Knight. White House Releases a National Policy Framework for Artificial Intelligence. March 2026. hklaw.com
  5. Akin Gump. Texas Enacts a Pair of AI Governance Laws, HB 149 and SB 1188. 2025. akingump.com
  6. Future of Privacy Forum. California AB 3030 chart. October 2024. fpf.org
  7. Becker's Payer Issues. 7 AI health insurance state laws passed in 2026. beckerspayer.com
  8. States Newsroom (via News From the States). Senate votes 99-1 to remove AI moratorium from megabill. 1 July 2025. newsfromthestates.com

You may like these posts

See all