Georgia AI Laws for Healthcare Providers: SB 444, SB 540 and What Applies Now

Fewer than the headlines suggest, and none that is in force on the provider side as of September 2026.

Georgia has no general AI act comparable to the Colorado AI Act or Texas TRAIGA. It has no comprehensive consumer privacy law: SB 111 left the Senate as the Georgia Consumer Privacy Protection Act and arrived at the Governor's desk as a rural hospital tax credit bill. It has no consumer health data act. The Office of the Commissioner of Insurance and Safety Fire has not adopted the NAIC AI model bulletin, and the Composite Medical Board has published no AI specific rule or position statement that we could find on medicalboard.georgia.gov in September 2026.

What Georgia does have is two narrow statutes with future effective dates and a set of older rules that AI tools trigger without naming them.

• SB 444, O.C.G.A. 33-46-7.1, effective January 1, 2027: payer side. AI may not issue an adverse determination without a natural person's review involving a clinical peer.
• SB 540, O.C.G.A. 39-5-6, effective July 1, 2027: AI companion chatbots, with disclosure, self harm protocols and a ban on impersonating a licensed clinician.
• SB 80 (2021), chapter 46 of title 33: prior authorization deadlines, clinical criteria publication and peer to peer rights that your prior authorization automation should be built to exercise.
• Rule 360-3-.07 of the Composite Medical Board on practice through electronic means, and the board's general records and unprofessional conduct rules, which govern AI scribe output because the licensee signs it.
• O.C.G.A. 16-11-62 and 16-11-66, Georgia's one party consent recording law, which is what an AI phone agent or ambient recorder actually operates under.

Everything else is federal: the HIPAA Privacy and Security Rules, the FTC Act and Section 1557 non discrimination. Our HIPAA and AI page covers that baseline, and a Georgia programme is that baseline plus the items on this page.

SB 444 is a permission with a limit, and providers should read it as a right to a human decision on every denial from January 1, 2027.

Subsection (b) of new O.C.G.A. 33-46-7.1 says private review agents and utilization review entities may use AI systems, AI and other software tools, provided the tools are part of a utilization review plan that meets chapter 46 and the Commissioner's rules. Subsection (c) then permits AI to automate tasks, reduce administrative burdens, participate in decision making processes and perform other lawful functions, provided that such systems shall not issue an adverse determination to a patient until a natural person qualifying as a private review agent or a utilization review entity conducts a utilization review in which a clinical peer participates. In no event shall AI supersede the judgment of that clinical peer.

Three things follow for a Georgia practice.

• Approvals can be fully automated; denials cannot. The statute only gates adverse determinations. Auto approval driven by AI is expressly lawful, which is consistent with the federal CMS prior authorization rule pushing payers toward electronic, faster decisions.
• A clinical peer is already defined. SB 80 defined clinical peer as a healthcare provider licensed without restriction in the same or similar specialty who typically manages the condition. SB 444 borrows that definition, so a denial signed off by a nurse reviewer alone does not satisfy the new section.
• There is no disclosure duty. Unlike California's SB 1120, the Georgia text does not require the payer to tell you AI was used. If you want to know, ask on the peer to peer call, which SB 80 already guarantees.

Compared with Arizona's HB 2175 and California's SB 1120, Georgia's text is shorter and leaves more to the Commissioner's existing utilization review rules. It does not require AI to be trained on the individual's clinical record, and it does not define how the clinical peer must participate. Watch the OCI for implementing regulations in the second half of 2026 and early 2027; as of September 2026 none had been published on the bulletins page.

Usually not, and the definitions are drawn tightly enough that you can tell.

SB 540 regulates the AI companion chatbot, defined in O.C.G.A. 39-5-6(a)(1) as a system that simulates a sustained human or human like relationship by doing three things: retaining information across sessions to personalise interaction and facilitate ongoing engagement, asking unprompted emotion based questions beyond a direct response, and sustaining an ongoing dialogue about matters personal to the user. The exclusions in subparagraph (B) cover a generative AI system used solely for a business's internal purposes and a customer service chatbot that either does not sustain a relationship across multiple interactions or is not designed to elicit emotional attachment.

A scheduling agent, an intake agent, a post visit instructions bot or an AI phone agent answering the front desk line is a customer service chatbot in this sense. It does not sustain a relationship and is not designed to elicit attachment. It is outside SB 540.

Two provider deployments are inside it. The first is any behavioural health companion or check in bot that remembers the patient between sessions and asks how they are feeling. The second is any wellness or chronic care coaching product that is built to keep patients coming back. If you offer either, from July 1, 2027 you must:

• disclose at the start of each session and at least every three hours that the user is interacting with an AI companion chatbot and not a natural person, hourly if the user is or should be known to be a minor;
• maintain a protocol for detecting expressions of severe harm or eating disorder related self harm, refer to the 988 Suicide and Crisis Lifeline or comparable services and escalate repeated indicators;
• publish a plain language summary of that protocol and, annually, the aggregate number of crisis referrals;
• not cause the chatbot to represent that it is licensed to provide mental health, behavioral health, medical or counseling services unless the operator is lawfully authorised to provide them.

That last clause is the one a licensed provider organisation should read twice. It is a permission as much as a prohibition: a licensed practice is an operator lawfully authorised to provide such services, so it may let the chatbot say it operates under the practice's licence, while a wellness vendor may not. The penalty exposure is real, up to 10,000 dollars per knowing violation, per user, per day, enforced by the Attorney General.

The board has published no AI specific rule or position statement that we could locate on medicalboard.georgia.gov as of September 2026. Its news and press release pages carry a May 2026 IV hydration position statement and nothing on AI. Third party sites describe a 2026 board AI advisory on signature line disclosure; we could not find that document on the board's site and treat the claim as unconfirmed. Do not build a workflow around it.

What does exist is the board's ordinary framework, and it reaches AI output through the licensee's signature.

• Records. The physician is responsible for the medical record they sign. An ambient scribe draft that reaches the chart without review is a records accuracy problem under the board's unprofessional conduct rules in chapter 360-3, whether or not any statute names AI. This is the same conclusion Texas reached in statute with SB 1188; Georgia reaches it through general rules.
• Telemedicine, Rule 360-3-.07. Practice through electronic or other such means is permitted only by Georgia licensed practitioners, a history of the patient must be available to the treating clinician, the encounter must be documented and the practitioner must make diligent efforts to have the patient examined in person annually. The rule does not authorise prescribing controlled substances for pain by electronic means. An AI tool that triages or answers clinical questions for patients without a Georgia licensee in the loop is not telemedicine under this rule; it is unlicensed practice risk.
• Delegation. The board's May 26, 2026 public notice on IV therapy reminded licensees that they remain responsible for complying with all applicable Georgia laws, board rules, professional standards and scope of practice requirements. The same principle applies to delegating drafting to software.

The practical standard to adopt is the one the board will apply in a complaint: the signing clinician read the note, corrected it and can explain it. Our AI policy template for medical practices includes the attestation language that makes that provable.

Georgia is a one party consent state for audio, which makes recording easier than in California or Maryland, and it has no state privacy law, which makes the vendor question a pure HIPAA question.

Recording. O.C.G.A. 16-11-62 makes clandestine interception of a private conversation a felony. O.C.G.A. 16-11-66(a) then provides that nothing in 16-11-62 prohibits a person from intercepting a wire, oral or electronic communication where the person is a party to the communication or one of the parties has given prior consent. The practice is a party to its own calls and its own visits, so an AI phone agent recording the front desk line, or an ambient scribe recording a consultation, is lawful in Georgia without the patient's express consent. The exception is 16-11-66(b): recording a telephone or electronic communication to which a child under 18 is a party requires a superior court order or the prior consent of a parent or guardian. Paediatric practices and any clinic that takes calls from minors should build parental consent into the intake for that reason alone.

Why you should get consent anyway. One party consent is a criminal law floor. Patients from the roughly dozen all party consent states call Georgia clinics, telehealth visits cross state lines, and the professional standard for ambient documentation nationally is verbal consent recorded in the note. Announce the recording, obtain and document consent, and you never have to litigate which law applied.

Privacy. With SB 111 gutted, there is no Georgia equivalent of the Virginia VCDPA or Maryland MODPA, no consumer health data act like Washington's, and no state duty layered on top of HIPAA for AI vendors. The vendor contract is the whole control: a business associate agreement, a prohibition on training on your PHI without a separate agreement, defined retention of audio and transcripts, and breach notice terms tighter than the HIPAA sixty days. Georgia's breach notification statute at O.C.G.A. 10-1-912 applies to unencrypted computerised personal information and is a second reason to insist on encryption at rest for recordings. Use the AI vendor breach exposure tool to size that risk before signing.

SB 80 of 2021, the Ensuring Transparency in Prior Authorization Act, has been in force since January 1, 2022 and is the statute your automation should be configured to enforce. It amended chapter 46 of title 33, the private review agent chapter that SB 444 now extends.

From January 1, 2027 SB 444 adds the clinical peer gate on AI denials. The combination gives a Georgia practice a clean playbook: submit with the published criteria cited, start the statutory clock, and on any denial demand the peer to peer and ask on the call whether an AI system generated the determination and which natural person with clinical peer status reviewed it. Our prior authorization cost calculator shows what those hours are worth, and the prior authorization software comparison lists which vendors expose the deadlines and criteria as fields rather than burying them.

Georgia is the lightest of the large states, and the gap is structural rather than a matter of timing.

The practical consequence is that a multi state organisation should not build to Georgia. Build to the strictest cell in each row, which our state AI laws map tracks, and Georgia is satisfied automatically. A Georgia only practice should still borrow three things from the stricter states because they are cheap and defensible: a patient facing AI use notice, a clinician attestation gate on AI drafted notes, and a written AI inventory. The healthcare AI law checker will show which of those become mandatory the moment you see a patient from Texas or California by telehealth.

Seven items, in order of urgency. None requires a new statute to have taken effect.

1. Confirm the vendor contract does the work Georgia law does not. Business associate agreement, no training on PHI, defined audio and transcript retention, encryption at rest, breach notice well inside HIPAA's sixty days. There is no Georgia privacy statute to fall back on. Our vendor questions for HIPAA list is the starting script.
2. Put an attestation gate on every AI drafted note. The Composite Medical Board disciplines the signer, not the software. No draft should be filed unsigned, and the signature should mean the clinician read it.
3. Announce and document recording, and add parental consent for minors. One party consent covers the adult case; O.C.G.A. 16-11-66(b) does not cover calls with a child under 18 without a parent's prior consent.
4. Classify every patient facing bot against the SB 540 definition now. Write down for each agent whether it retains information across sessions, asks unprompted emotional questions and sustains personal dialogue. If any does, plan the disclosure cadence and the 988 protocol for July 1, 2027 and, if you are a licensed provider, decide whether it will state that it operates under your licence.
5. Configure prior authorization automation to SB 80 and, from January 2027, SB 444. Cite published criteria, run the 7 day and 72 hour clocks, request peer to peer on every denial and record whether a clinical peer reviewed any AI generated determination.
6. Publish a plain language AI use notice anyway. Georgia does not require it, but every neighbouring regime does, the cost is one page, and it removes the surprise element from complaints.
7. Keep an AI inventory with model versions, data flows and owners. It is the artefact every future Georgia rule will ask for, the SR 789 study committee is drafting those rules now, and it is the first thing a Section 1557 or HIPAA investigator requests.

Discipline, mostly. Georgia's light statute book is the reason to review harder, not softer: nothing in state law will stop a vendor selling you a tool with weak consent handling, a training clause buried in an order form or a chatbot that drifts into companion territory, and nothing will tell you that Texas or California law now applies because a patient dialled in from Austin.

An independent review does four things a vendor's own compliance page will not. It maps each deployment against the Georgia rules above and against the stricter states your patients come from. It reads the contract for the clauses Georgia law leaves to negotiation. It tests whether the clinician attestation gate and the recording announcement actually happen in the workflow rather than in the policy. And it produces the inventory and evidence trail that SB 444, SB 540 and whatever the 2027 session brings will require.

Clunic takes no vendor commissions. Our AI governance and compliance engagement builds the single programme that covers Georgia and the states around it, and it usually starts with the estate inventory from an AI readiness audit. If you are about to sign with a scribe, phone agent or prior authorization vendor in Georgia, book a call before the signature rather than after the first complaint.