Law / United States / 
Alabama
SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization
Ala. SB 63, 2026 Regular Session
In force since .
An AI sector rules rule binding private bodies.
- Enforcement body
- Alabama Department of Insurance
- How the hook was established
- express
- What makes it apply
- Market targeting
- Obligation class
- Governance, Disclosure, Reporting
- Audit expectation
- periodic
- Who audits it
- Self
What it requires
- If you are a health benefit plan provider using artificial intelligence to make medical-necessity determinations on prior-authorization requests, base each determination on the enrollee's own medical history, the clinical circumstances the treating provider presents, and other clinical information in the enrollee's record, not a group dataset.NIST AI RMFMAP 2.3
- Certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.NIST AI RMFGOVERN 1.1NIST AI RMFMEASURE 2.11
- Have a licensed physician or other health care professional competent to evaluate the artificial intelligence's recommendation make the final determination to deny, delay, or modify a prior-authorization request based on medical necessity.NIST AI RMFMAP 3.5
- Make prominent written disclosure of your use of artificial intelligence in utilization review in your policies and procedures, review its outcomes periodically for accuracy, and keep patient data used in that review within its stated purpose under Health Insurance Portability and Accountability Act (HIPAA).NIST AI RMFMEASURE 2.8NIST AI RMFMEASURE 2.5NIST AI RMFMEASURE 2.10
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.5The AI system to be deployed is demonstrated to be valid and reliable. Limitations of the generalizability beyond the conditions under which the technology was developed are documented.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
1 more
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-09Information Security
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Administrative fine only, capped at $5,000, and only for a violation of the AI prior-authorization requirements occurring with such frequency as to indicate a general business pattern or practice; for the same pattern the department may instead or additionally suspend or revoke the provider's certificate of authority.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 5,000
What it makes you log
What the log must hold
Output reference, Decision basis, Human involvement
Logging duty
Section 1(c)(2) requires a health benefit plan provider to ensure its use of artificial intelligence and the outcomes it generates are reviewed on a periodic basis for accuracy and reliability, and Section 1(c)(4) lets the provider satisfy that and the annual certification duty in Section 1(b)(2) through an attestation resting on internal policies, procedures, and third-party vendors. Neither provision uses the words logs, records, event recording, or an audit trail, but reviewing outcomes on a periodic basis and attesting to compliance both require the provider to be able to show something about its own AI-assisted determinations that cannot be shown without an underlying record. No period is stated for keeping that record.
- Kind
- Implicit
- As of
- Provision
- SB 63, Section 1(c)(2) and (c)(4)
- Trigger
- automated_decisions
What this law does
A health benefit plan provider that uses artificial intelligence to determine medical necessity for a request for prior authorization must base the determination on the enrollee's own medical history, the clinical circumstances the treating health care provider presents, and other clinical information in the enrollee's medical record.
The provider must certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.
A determination to deny, delay, or modify a prior-authorization request based on medical necessity must always be made by a licensed physician or other health care professional competent to evaluate the artificial intelligence's recommendation in light of the enrollee's own clinical circumstances.
The provider must make prominent written disclosure of its use of artificial intelligence in utilization review in its policies and procedures, periodically review the outcomes for accuracy, and keep patient data used in that review within its intended purpose under Health Insurance Portability and Accountability Act (HIPAA).
The Department of Insurance may investigate an alleged violation and order corrective changes to the provider's procedures, and for a violation occurring with the frequency of a general business pattern or practice, may impose an administrative fine of up to $5,000 or suspend or revoke the provider's certificate of authority.
When LexLint raises it
When your app profile says your app handles health records or is an insurer.
Back to the example · Lint your app
Page updated .