Law / United States / 
Colorado
HB 26-1139 (2026), Use of Artificial Intelligence in Health Care
Colo. HB 26-1139, 2026 Colo. Sess. Laws ch. 325
An AI risk obligations rule binding private bodies.
- Obligation class
- Governance, Reporting, Disclosure, Prohibition
As of .
What it requires
- Ensure that an AI system used for utilization review makes determinations based on the patient's medical or clinical history, individual clinical circumstances and other relevant clinical factors, with any denial of coverage reviewed by a licensed clinician, physician or other competent regulated professionalNIST AI RMFMAP 2.3NIST AI RMFMAP 3.5
- Do not base a utilization review determination solely on group data without reference to the individual's data, and do not use the system in a way that discriminates against individuals in violation of state or federal lawNIST AI RMFMAP 2.3NIST AI RMFMEASURE 2.11
- Periodically review the AI system to ensure its outcomes are accurate and reliable and that an individual's health data is not used beyond its intended or stated purposeNIST AI RMFMEASURE 2.4NIST AI RMFMEASURE 2.10
- Disclose to the Division of Insurance, the Department of Human Services or the Department of Health Care Policy and Financing, as applicable, the utilization review functions for which the AI system will be used and the points in the process where it will be used, the process for human oversight of adverse coverage determinations, and the process for maintaining audit informationNIST AI RMFGOVERN 1.1
- As a carrier, do not issue a denial of coverage based in whole or in part on medical necessity solely on the output of an AI system without human review by a licensed clinician, physician or other competent regulated professionalNIST AI RMFMAP 3.5
- As a carrier or a payer under the Colorado Medical Assistance Act or the Children's Basic Health Plan Act, do not pay for psychotherapy services provided directly to a client and conducted by an AI systemNIST AI RMFMAP 3.3
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- GOVERN 1.1Legal and regulatory requirements involving AI are understood, managed, and documented.
- MAP 2.3Scientific integrity and TEVV considerations are identified and documented, including those related to experimental design, data collection and selection (e.g., availability, representativeness, suitability), system trustworthiness, and construct validation.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.4The functionality and behavior of the AI system and its components – as identified in the MAP function – are monitored when in production.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
1 more
- MEASURE 2.11Fairness and bias – as identified in the MAP function – are evaluated and results are documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-09Information Security
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.1.4-5End-users told which uses of the system are prohibited.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
1 more
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What this law does
HB 26-1139 takes effect on as Chapter 325 of the 2026 Colorado session laws. The Governor signed it on . From that date, entities that use an AI system to conduct utilization review of health-care services, including carriers, pharmacy benefit managers, private utilization review organizations, behavioral health administrative services organizations and managed care entities, must ensure that the AI system complies with the act's requirements.
The system must make determinations based on medical or clinical history and individual clinical circumstances, must not rest solely on group data, must not be used in a discriminatory way, and must be periodically assessed for accuracy and reliability. An entity must disclose to the applicable state agency the utilization review functions for which the system will be used, the process for human oversight of adverse coverage determinations, and the process for maintaining audit information.
A carrier's denial of coverage based in whole or in part on medical necessity may not be issued solely on the output of an AI system without human review by a licensed clinician or physician or other competent regulated professional. The act also bars a carrier and a public-program payer from paying for psychotherapy services conducted directly with a client by an AI system.
When LexLint raises it
When your app profile says your app is an insurer or handles health records.