The State AI Law Map: A Multi-State Compliance Strategy for Providers

Because the four state regimes do not regulate the same thing, so a checklist built from one of them does not partially satisfy the others. It satisfies none of them.

California regulates the content of communications and who may make a medical necessity decision. Texas regulates whether the patient was told. Utah regulates disclosure by licensed professionals. Colorado, from 2027, regulates the process around a consequential decision made with automated technology. A practice that disclosed diligently in Texas has done nothing about California's utilization review restriction, and a payer that fixed its utilization review has done nothing about disclosure.

The second reason is churn. Colorado's law has changed twice in under a year: the original SB 24-205 was pushed from February 1, 2026 to June 30, 2026 by amendments signed on August 28, 2025, and then repealed and replaced by SB 26-189, signed on May 14, 2026. Utah has amended its act more than once since 2024. A checklist goes stale. A policy built on a principle survives, and only the citations underneath it need updating. The wider federal and state calendar is tracked in the regulation tracker.

Side by side, with the thing each one actually bites on.

Note what is missing. None of these is a licensing regime for clinical AI, none requires pre-market approval, and none of them displaces HIPAA, which continues to apply everywhere and remains the rule an enforcement action is most likely to be brought under.

Two separate things, from two bills both chaptered on September 28, 2024 and operative from January 1, 2025.

AB 3030 applies when a health facility, clinic, physician's office or group practice uses generative AI to produce patient communications about clinical information. The communication must carry a disclaimer that it was generated by AI, formatted according to the channel: prominently at the beginning of written communications, displayed throughout chat-based interactions, spoken at the start and the end of audio, and displayed throughout video. It must also tell the patient how to reach a human. The exemption is the operationally important part: a communication generated by AI and then read and reviewed by a licensed or certified human provider is not covered.

SB 1120 applies to health care service plans and disability insurers, not to providers. It requires that an AI or algorithmic utilization review tool base its determinations on the individual patient's medical history and clinical circumstances rather than on group datasets alone, that it not replace provider decision-making, and that it be subject to periodic review for accuracy. The binding sentence is that such a tool may not deny, delay or modify health care services based, in whole or in part, on medical necessity. Only a licensed physician or a competent licensed professional may do that.

For a provider organisation the practical reading of AB 3030 is that the review exemption is the whole design. If a clinician reads and approves before it goes out, you are outside the requirement, which is also the workflow you want for clinical safety reasons. That is why we treat clinical inbox triage as a drafting tool with a human signature rather than an autonomous responder. More detail sits on the California page.

Both are disclosure regimes, and the difference is timing and trigger.

Texas HB 149 was signed on June 22, 2025 and took effect on January 1, 2026. Its healthcare provision requires that a licensed, registered or certified provider of healthcare services or treatment make a clear and conspicuous disclosure, in plain language, that the recipient is interacting with an AI system. The disclosure is due no later than the date the service or treatment is first provided, or as soon as reasonably possible in an emergency. It applies even where the AI use is obvious, and dark patterns that obscure the disclosure are prohibited.

Utah's Artificial Intelligence Policy Act, SB 149, was signed on March 13, 2024 and has been amended since. Its structure distinguishes regulated occupations, which include licensed health professionals, from ordinary consumer transactions, and imposes the more demanding disclosure duty on the former. Because the act has been revised more than once, treat the current statutory text and the Utah Office of Artificial Intelligence Policy as the source rather than any secondary summary, including this one. The Utah page carries the current reading.

The practical distinction: Texas is proactive and tied to the start of the service, so it changes your intake paperwork and your phone agent greeting. Utah is occupation-scoped, so it changes who has to disclose rather than when. If you satisfy Texas everywhere, you have generally satisfied Utah, which is the first piece of the strictest-state argument.

Less than the 2024 headlines suggested, and on a later clock.

SB 26-189, Automated Decision-Making Technology, was signed on May 14, 2026 and replaces SB 24-205. It drops the two heaviest obligations of the original act, the mandatory risk management programme and the annual impact assessment. What remains is a transparency and rights framework. Developers of covered automated decision-making technology must supply deployers with technical documentation covering intended uses, categories of training data, known limitations and instructions, must notify deployers of material updates, and must keep compliance records for at least three years. Those developer duties commence on January 1, 2027. Deployers must give consumers clear notice at the point of interaction, and where the system produces an adverse outcome must provide a plain language description of the technology's role within 30 days. Consumers get correction rights and a right to meaningful human review after an adverse decision. Enforcement is centralised with the attorney general, and implementation detail is left to rulemaking.

For healthcare the live question is what counts as a consequential decision. Coverage, eligibility and access to services are the usual answers, which puts payer-side and access-side workflows closer to the line than clinical documentation. An ambient scribe drafting a note is not making a decision. A tool that screens which patients get an appointment might be, and that is worth deciding deliberately rather than discovering. The Colorado page tracks the rulemaking.

Four questions, in order. The order matters because each one removes work from the next.

1. Does the tool communicate with a patient, or does it inform a person who communicates with the patient? If it drafts and a clinician reviews and sends, most of the disclosure regimes fall away and your obligation becomes an internal one about review discipline. Designing for review is cheaper than designing for disclosure.
2. Does the tool make or materially influence a decision about a person? Coverage, access, triage priority and scheduling eligibility are decisions. Documentation is not. If the answer is yes, you are in Colorado's territory and, if you are a payer, California's.
3. Are you a provider or a payer? SB 1120 binds plans. AB 3030 and the Texas provision bind providers. Groups that do both, including risk-bearing organisations, need both policies and usually miss the payer one.
4. In how many states does this run? If the answer is more than one, build once to the strictest requirement and deploy it everywhere. Two policies for one workflow is how disclosure gets missed in the state that needed it.

Applied to the current four states, strictest looks like this: disclose proactively at first contact in plain language, keep a human review step before anything clinical reaches a patient, never let a model make a medical necessity determination, and be able to produce, within 30 days, a plain language explanation of what the system did in any adverse case. A group that does those four things is compliant in all four states and will probably remain so through the next round of amendments.

There is a cost objection to this, and it is worth answering honestly. Building to the strictest state means some of your sites carry a disclosure or a review step their own state does not require. In a large group that is real friction. The counter is that the alternative is a per-state matrix that has to be re-derived every time a legislature moves, and every time you open a location, and that has to be trained into staff who move between sites. The matrix is cheaper on paper and more expensive in practice, because the failure mode is not a fine, it is a clinician in the wrong state following the wrong rule and nobody noticing for a year.

The exception worth carving out is the payer side. If your group takes risk or operates a plan, the California utilization review restriction is a different obligation with a different owner, and folding it into a provider-facing disclosure policy tends to bury it.

Short. One page of policy, three artefacts, one owner.

The policy states which AI systems are in scope, what disclosure each triggers, who reviews clinical output before it reaches a patient, and what the escalation path is. The artefacts are a system inventory, a disclosure register recording the exact wording used in each channel, and a decision log for anything that touched a coverage or access decision. The owner is a named person, not a committee, and the review cadence is quarterly.

The system inventory is the one people skip and later regret. You cannot apply a state disclosure rule to a tool nobody has written down, and in most organisations the list is longer than leadership expects once you include the scheduling assistant, the phone system's voice agent and the intake agent a single clinic bought on a credit card.

Two links worth having open while you write it: the regulations index, which is the current reading of each rule, and the HIPAA-compliant AI tools shortlist, which is where vendor posture is compared. If you would rather not draft it from a blank page, the AI governance and compliance engagement produces exactly this set of artefacts, and the multi-state version is the common case rather than the exception.