Over the course of 2026, at least seven states have passed new laws restricting how health insurers can use artificial intelligence in coverage and claims decisions, a wave of legislation aimed at a specific fear: that AI systems processing claims at scale are quietly making or steering decisions that determine whether patients get care, without a person meaningfully reviewing the outcome. Georgia, Illinois, and Colorado have emerged as the most closely watched examples, each taking a different regulatory approach to essentially the same underlying problem.
Georgia’s Human-Reviewer Requirement
Georgia’s SB 444, signed into law on May 5, 2026 and set to take effect January 1, 2027, prohibits health insurance coverage decisions from being based solely on the output of an AI system or software tool. Under the law, a qualified human reviewer must be part of every coverage determination, meaning insurers cannot let an algorithm issue a denial or approval without a person in the loop who has the authority and clinical background to overrule it. The law’s supporters have framed it as a floor, not a ceiling: it does not ban insurers from using AI to flag cases or summarize records, but it draws a firm line at letting AI output stand as the final word on a patient’s coverage.
Illinois Targets a More Specific Practice: Downcoding
Illinois took a narrower but more technical approach with its Transparency in Downcoding Act, created under SB 3114, which unanimously cleared the Illinois legislature in late May 2026. The law targets downcoding, the practice of an insurer reducing the billing code, and therefore the payment, for a medical claim below what the treating clinician originally submitted. Under the new law, insurers cannot use any algorithm or automated process that bypasses the information a billing professional submitted in order to downcode a claim; automated tools may still flag a claim for review, but a person must make or review every actual downcoding determination using current American Medical Association coding guidelines. The law also separately bars downcoding based solely on diagnosis codes and prohibits insurers from using downcoding algorithms in ways that disproportionately target clinicians who treat complex or chronic patients. It takes effect January 1, 2028.
Colorado’s Broader Algorithmic Discrimination Law
Colorado got there earlier and more broadly with SB 24-205, enacted in 2024 as the first comprehensive state law regulating high-risk AI systems to prevent algorithmic discrimination, with health-insurance-specific provisions among its most significant applications. Additional oversight tied to the law took effect June 30, 2026, sharpening its focus on AI systems used to determine health insurance eligibility and medical treatment plans specifically. Illinois has since been described by employment-law analysts as the second state, after Colorado, to regulate algorithmic discrimination broadly across private-sector AI use, rather than in a single narrow context like billing codes.
The Industry Backdrop That Prompted the Laws
These laws did not emerge in a vacuum. Insurers have been rapidly expanding AI use in claims processing throughout 2026: UnitedHealth has said it is spending roughly 1.5 billion dollars on AI this year, including a digital prior-authorization tool it says processes claims with a 96% approval rate, while automated systems industry-wide now handle an estimated 50% to 60% of all insurance claims, according to insurance-technology analysts, cutting handling costs by 25% to 40%. That efficiency has come with a cost in physician trust: a widely cited 2024 American Medical Association survey found 61% of physicians believed payer-side AI was contributing to more prior-authorization denials, a sentiment that state lawmakers in Georgia, Illinois, and elsewhere have cited directly when introducing these bills.
Two Sides of the Same Debate
Insurers and their trade groups have generally argued that AI-assisted claims processing speeds up approvals for the vast majority of routine claims and that human-reviewer mandates simply formalize practices insurers say they already largely follow, adding compliance overhead without changing outcomes. Patient advocates and physician groups counter that without a legal mandate, there is no way to verify that a human reviewer’s involvement is anything more than a rubber stamp on an AI-generated recommendation, and that laws like Georgia’s and Illinois’s create an enforceable standard where previously there was only a voluntary one.
What Happens as More States Weigh In
With Colorado’s provisions already active, Georgia’s set to take effect at the start of 2027, and Illinois’s following a year after that, health insurers operating across multiple states will need to build compliance processes that satisfy several different, overlapping requirements simultaneously. Policy trackers expect additional states to introduce similar bills during 2027 legislative sessions, and the outcomes in Georgia and Illinois, once their laws take effect, are likely to shape how aggressively other states legislate against AI-only claims decisions going forward.
