State AI utilization review compliance means meeting the state laws that limit what an AI system may decide when a plan or utilization review organization handles prior authorization requests. Iowa's House File 2635 and Colorado's HB26-1139 each bar an AI output from being the sole basis for certain adverse decisions, and this page is for carriers, utilization review organizations, pharmacy benefit managers and managed care entities that use AI. Integral Healthcare Solutions (IHS) updates your utilization management policy set and AI-use procedure for your medical director to review and approve, and your counsel confirms how each law applies to you.
Last reviewed: October 2026.
What is state AI utilization review compliance?
It is the work of showing that your utilization review process, including any AI tool in it, matches what a state statute requires. IHS read two 2026 acts at the primary source and no other state's law, so this page covers those two.
Iowa HF 2635
Section 2 of the act adds subsection 2A to Iowa Code section 514F.8 (enrolled act, page opened October 6, 2026). It lets a utilization review organization use an AI-based algorithm or system for an initial review of a prior authorization request. For a medical necessity request, the text says the organization "shall not use an artificial intelligence-based algorithm or system as the sole basis for the utilization review organization's decision to deny, delay, or downgrade the prior authorization request." Section 1 of the act defines downgrade as changing an expedited or urgent request to a standard determination, or changing a requested service to a lower-level service. Iowa's governor approved the act on May 13, 2026 (transmittal letter, page opened October 6, 2026).
Colorado HB26-1139
Section 2 of the bill adds section 10-16-112.7 to the Colorado Revised Statutes (signed act, page opened October 6, 2026). The bill prints new text in capital letters, and quotes here are in sentence case. Subsection 5(a) says an AI system "may be used to assist with utilization review, including expedited approvals". Subsection 5(b) says a carrier's denial of coverage based in whole or in part on medical necessity "shall not be issued solely on the output of an artificial intelligence system without human review and approval of the denial by a licensed clinician, licensed physician, or other regulated professional that is competent to evaluate the specific clinical issues involved in the health-care services requested by the provider and a review of the health benefit plan's terms of coverage for the health-care service".
Subsection 3 lists what the person using the AI system must ensure, including that:
- The system bases its determination on the individual's clinical history, circumstances and record, not solely on group data, and is not used in any way that discriminates against individuals in violation of other state or federal laws.
- The system "produces and retains documentation, audit logs, and model-governance records" to demonstrate compliance.
- Performance, use and outcomes are periodically reviewed "to maximize accuracy and reliability", and health data is not used beyond its intended or stated purpose.
Subsection 4 calls for written disclosures to the division, the Department of Human Services, or the Department of Health Care Policy and Financing, as applicable. They identify where the AI system is used, "the human oversight process, including the qualifications of the reviewer and whether a human must approve an adverse determination", and the process for maintaining audit information.
When do the requirements start?
Section 4 of the Colorado bill says the act takes effect January 1, 2027, with a referendum clause. If a petition is filed within 90 days after final adjournment, the act does not take effect unless the people approve it at the November 2026 general election. The bill page lists a Signed Act dated June 3, 2026 (page opened October 6, 2026), and the signed act file bears the governor's approval dated June 2, 2026. IHS has not read whether any referendum petition was filed, so your counsel confirms.
The Iowa AI paragraph, as read, states no date of its own. Your counsel confirms the effective date of the AI paragraph.
Who should check whether these laws reach them?
Organizations that use AI in utilization review, and the plans that contract with them, have to ask whether these laws reach them. Colorado's subsection 2 applies, in the text's terms, to three groups:
- A carrier that uses an AI system for utilization review or contracts with a person that does.
- A pharmacy benefit manager or private utilization review organization that contracts with a carrier and uses an AI system to conduct utilization review for the carrier.
- A behavioral health administrative services organization or managed care entity that uses an AI system to conduct utilization review of mental or behavioral health services.
The Iowa paragraph is written about a utilization review organization. Questions that would prompt a review with your counsel:
- You or a vendor that works for you uses or plans to use an AI tool in utilization review.
- Whether Colorado subsection 4 calls for a written disclosure from your organization, which is for your counsel to say.
Whether either law applies to your organization is for your counsel, and this page does not say.
How does IHS help?
IHS updates the utilization management policy set and the AI-use procedure for your medical director to review and approve, and your organization adopts and runs it. This sits beside our work on building a utilization management program and case management and utilization management. The process runs in five steps.
- Gap assessment of your policy set and AI-use procedure against the texts your counsel confirms apply.
- Document and evidence mapping from each requirement to the policy, record or log that supports it.
- Drafting the human-review step, reviewer qualifications, documentation and audit trail sections.
- A mock review of your utilization review file process against the confirmed statute text.
- Readiness support while your medical director and counsel revise and adopt.
What you supply: your utilization management policies, the AI tools and vendors involved, your reviewer roster and your counsel's view of which provisions apply.
The limit: IHS does not give legal advice, does not decide whether a law applies to you, and does not contact or file anything with a regulator. Your organization adopts and runs the procedures and files any disclosure.
What to have ready
This is IHS's planning list, built from the two texts above, not a regulator's checklist.
- A list of every AI tool used in your utilization review process, with the vendor contract for each.
- A process map showing where each tool is used in intake, prior authorization, medical necessity review and appeal (Colorado subsection 4).
- Your utilization management policies on prior authorization, expedited review, medical necessity and denials.
- Any written rule on who approves an adverse determination and whether a human must.
- Your reviewer roster with licenses and areas of clinical competence (Colorado subsection 5(b)).
- The logs and model-governance records each tool produces, and where they are kept (Colorado subsection 3).
- Any periodic review of each tool's performance and use, and a statement of the purpose for which it uses health data (Colorado subsection 3).
- Your counsel's written view on which provisions of HF 2635 and HB26-1139 reach your organization and from what date.
- The name of the person who would file any disclosure.
Printable version of this checklist (PDF)
Bring what you have to the free introductory call.
How it compares
| Comparison | What to know |
|---|---|
| Iowa and Colorado | The Iowa text is about an AI output as the sole basis for a decision to deny, delay or downgrade a medical necessity prior authorization request. The Colorado text is about a denial not issued solely on an AI output without human review and approval by a licensed clinician or other regulated professional, and it adds governance records and written disclosures. |
| Build into the existing policy set or write a stand-alone AI-use procedure | IHS's reading, October 2026: the first keeps one document set for reviewers, and the second makes the AI controls easy to find. Your medical director and counsel decide. |
| Federal prior authorization rule | CMS-0057-F is a separate federal rule. See CMS-0057-F prior authorization alignment. |
| AI governance program | A broader program on how an organization governs AI. See AI governance in healthcare. |
What it costs
The Iowa paragraph and the Colorado section we read set no applicant fee, so this page lists no authority fee. Verify current requirements with your state insurance regulator and your counsel. IHS scopes each engagement after a free introductory call.
What this is not
- This is not legal advice. IHS is a consulting firm, not a law firm, and IHS gives no opinion on whether a law applies to your organization. That question belongs to your counsel.
- IHS does not contact or speak for your organization to any regulator or state agency. IHS drafts, and your organization files.
- This page is about policies and procedures, not software, and it does not assess any AI tool.
Frequently asked questions
What do the Iowa and Colorado laws say when AI is used in utilization review or prior authorization?
Iowa's HF 2635 allows an AI-based algorithm or system to provide an initial review of a prior authorization request, but not as the sole basis for denying, delaying or downgrading a request based on medical necessity. Colorado's HB26-1139 says a carrier's denial based in whole or in part on medical necessity cannot be issued solely on an AI system's output without review and approval by a licensed clinician, licensed physician or other regulated professional. Your counsel confirms how each applies.
Who is covered by these laws?
Colorado's subsection 2 names carriers that use an AI system for utilization review or work through a person that does, pharmacy benefit managers and private utilization review organizations that contract with a carrier and use an AI system for the review, and behavioral health administrative services organizations and managed care entities that use an AI system for utilization review of mental or behavioral health services. Iowa's paragraph is written about a utilization review organization. Your counsel decides whether your organization falls within either text.
When do the requirements start?
Colorado's act says it takes effect January 1, 2027, subject to a referendum clause, and the bill page lists a Signed Act dated June 3, 2026. IHS has not read whether a referendum petition was filed. Iowa's governor approved HF 2635 on May 13, 2026, and its AI paragraph states no date of its own. Your counsel confirms both.
What documentation and audit records does Colorado call for?
Subsection 3 says the person must ensure the AI system "produces and retains documentation, audit logs, and model-governance records" to demonstrate compliance, and that its performance, use and outcomes are periodically reviewed. IHS drafts the procedure that says what is kept, by whom and where.
What does the human reviewer have to be, and what does Iowa say?
Colorado's subsection 5(b) names a licensed clinician, licensed physician or other regulated professional who is competent to evaluate the specific clinical issues involved. The Iowa sentence IHS read states no reviewer qualification. It says an AI system may not be the sole basis for a decision to deny, delay or downgrade a medical necessity prior authorization request.
What does the Colorado written disclosure cover?
Subsection 4 covers where the AI system is used, the human oversight process including reviewer qualifications, and the process for maintaining audit information. Your organization files any disclosure.
How is this different from the federal CMS prior authorization rule?
CMS-0057-F is a separate federal rule, and IHS covers it on its own page. This page does not summarize it. Your counsel advises how state and federal requirements fit together for your organization.
Does this apply to my organization?
That is a question for your counsel, and IHS gives no opinion on it. IHS is a consulting firm, not a law firm. IHS can organize the documents your counsel will want to read.