SB 63 (2026), Artificial Intelligence in Health Insurance Prior Authorization

Ala. SB 63, 2026 Regular Session

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force in 8 days, effective 1 October 2026.

An AI sector rules rule binding private bodies.

As of 8 September 2026.

What it requires

If you are a health benefit plan provider using artificial intelligence to make medical-necessity determinations on prior-authorization requests, base each determination on the enrollee's own medical history, the clinical circumstances the treating provider presents, and other clinical information in the enrollee's record, not a group dataset.
Certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.
Have a licensed physician or other health care professional competent to evaluate the artificial intelligence's recommendation make the final determination to deny, delay, or modify a prior-authorization request based on medical necessity.
Make prominent written disclosure of your use of artificial intelligence in utilization review in your policies and procedures, review its outcomes periodically for accuracy, and keep patient data used in that review within its stated purpose under Health Insurance Portability and Accountability Act (HIPAA).

If you get it wrong

Criminal exposureNo

Private right of actionNo

Penalty structure

Administrative fine only, capped at $5,000, and only for a violation of the AI prior-authorization requirements occurring with such frequency as to indicate a general business pattern or practice; for the same pattern the department may instead or additionally suspend or revoke the provider's certificate of authority.

Rule: Fixed only
As of: 8 September 2026
Currency: USD
Fixed cap: 5,000

Who enforces it

Enforcement body

Alabama Department of Insurance

What it reaches

How the hook was established

express

What makes it apply

Market targeting

Obligation class

Governance, Disclosure, Reporting

What it makes you log

What the log must hold

Output reference, Decision basis, Human involvement

Logging duty

Section 1(c)(2) requires a health benefit plan provider to ensure its use of artificial intelligence and the outcomes it generates are reviewed on a periodic basis for accuracy and reliability, and Section 1(c)(4) lets the provider satisfy that and the annual certification duty in Section 1(b)(2) through an attestation resting on internal policies, procedures, and third-party vendors. Neither provision uses the words logs, records, event recording, or an audit trail, but reviewing outcomes on a periodic basis and attesting to compliance both require the provider to be able to show something about its own AI-assisted determinations that cannot be shown without an underlying record. No period is stated for keeping that record.

Kind: Implicit
As of: 21 September 2026
Provision: SB 63, Section 1(c)(2) and (c)(4)
Trigger: automated_decisions

Who checks it

Audit expectation

periodic

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A health benefit plan provider that uses artificial intelligence to determine medical necessity for a request for prior authorization must base the determination on the enrollee's own medical history, the clinical circumstances the treating health care provider presents, and other clinical information in the enrollee's medical record.

The provider must certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.

A determination to deny, delay, or modify a prior-authorization request based on medical necessity must always be made by a licensed physician or other health care professional competent to evaluate the artificial intelligence's recommendation in light of the enrollee's own clinical circumstances.

The provider must make prominent written disclosure of its use of artificial intelligence in utilization review in its policies and procedures, periodically review the outcomes for accuracy, and keep patient data used in that review within its intended purpose under Health Insurance Portability and Accountability Act (HIPAA).

The Department of Insurance may investigate an alleged violation and order corrective changes to the provider's procedures, and for a violation occurring with the frequency of a general business pattern or practice, may impose an administrative fine of up to $5,000 or suspend or revoke the provider's certificate of authority. This act becomes effective October 1, 2026.

When LexLint raises it

high_risk_decisions
handles_health_records
provides_financial_services

Read the law

official text, enrolled SB 63 (2026 Regular Session), Alabama Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app