NIST AI RMF, MapMAP 3.5

If you are the provider of a high-risk AI system, design and develop it, including its human-machine interface, so that a natural person can effectively oversee it while it is in use.

Build oversight measures proportionate to the system's risks, autonomy and context of use, either into the system itself before it is placed on the market or put into service, or as measures you identify for the deployer to implement.

Do not take, or let a law enforcement authority take, any decision producing an adverse legal effect on a person based solely on the system's output.

Do not use an automated process, system, or tool, including artificial intelligence, as the sole basis to downcode a health benefits claim based on medical necessity, unless an employee or contractor has first reviewed the covered individual's medical record

Conduct a risk assessment and a human-rights impact assessment before deploying a high-risk system, and maintain human oversight of it.

A user of such a heightened-risk system must operate it per its instructions, keep the data it processes relevant, maintain effective human oversight and resourcing, immediately suspend use and notify the owner once it has grounds to believe use as instructed could cause harm to a protected interest, keep operating logs, and comply with a regulator's suspension order or a final court order to stop using the system.

Keep a health care provider in the determination process; the tool may not replace that role.

Do not let an artificial intelligence-based algorithm be the sole basis of a decision to deny, delay, or modify a health care service based, in whole or in part, on medical necessity.

Provide human management and supervision of your high-impact AI.

Where the app's output feeds a legally significant decision affecting a person's rights or freedoms, the decision may not rest exclusively on the AI-based resource's or system's conclusions.

Have a licensed physician or other health care professional competent to evaluate the artificial intelligence's recommendation make the final determination to deny, delay, or modify a prior-authorization request based on medical necessity.

If you are a health care insurer, do not deny a claim submitted by a provider on the basis of medical necessity without a medical director individually reviewing the denial and exercising independent medical judgment.

The reviewing medical director may not rely solely on recommendations from any other source, including an automated or AI-assisted recommendation, in making that individualized review.

Do not let such a system issue an adverse coverage determination on its own; have a natural person qualifying as a private review agent or utilization review entity conduct the utilization review, with a clinical peer participating, before any adverse determination issues.

Do not let the system supersede the clinical peer's judgment.

If you are a Maine-licensed therapy professional using AI for supplementary support such as session notes, give the client written disclosure and get consent first, and never let AI make an independent therapeutic decision, interact directly with the client in therapeutic communication, or generate a treatment recommendation without your review and approval.

If you are a utilization review organization, do not use automated processing alone, without a clinician review by an appropriate health professional, to make an adverse determination on a health care service, admission, or extension of stay.

Independently review the accuracy of any report, data or other information an AI system compiles, summarizes, analyzes or generates for those administrative purposes.

A QCB-regulated entity deploying a High-Risk AI system must maintain an AI system register, adopt an AI governance policy, conduct risk and bias assessments, and provide human oversight of the system's decisions.

If you are a health care practitioner using AI for diagnostic purposes, including AI-generated recommendations on a diagnosis or course of treatment, stay within the scope of your license, do not use AI in a way state or federal law otherwise restricts, and review all AI-created records consistent with Texas Medical Board standards.

Base an adverse preauthorization determination on clinical or medical necessity on independent medical judgment, not solely on a recommendation from any other source

Disclose when AI-generated content is used in a court submission, and independently verify any AI-generated legal research before relying on it.

Declare, in the prescribed form, whenever any part of a document submitted to a Jamaican court was prepared with the assistance of generative AI, and have that content thoroughly reviewed, verified, and approved before submission.

Do not rely on generative AI output without independently confirming the validity of any case law, statutory provision, or authority it cites.

Review AI-generated visit documentation for accuracy after the visit.

Do not obstruct, disable, or distort the human-oversight mechanisms this Law requires over your AI system.