Law / United States / 
Georgia
Private Review Agent Artificial Intelligence Coverage Determinations Act (SB 444)
O.C.G.A. § 33-46-7.1, enacted by Ga. SB 444 (2025-2026 session)
An AI sector rules rule binding private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- If you are a private review agent or utilization review entity making coverage determinations for healthcare services in Georgia, you may use artificial intelligence systems, artificial intelligence, or other software tools as part of a utilization review plan meeting the Insurance Commissioner's standards.
- Do not let such a system issue an adverse coverage determination on its own; have a natural person qualifying as a private review agent or utilization review entity conduct the utilization review, with a clinical peer participating, before any adverse determination issues.
- Do not let the system supersede the clinical peer's judgment.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
This section lets a private review agent or utilization review entity use an artificial intelligence system as part of a utilization review plan, but requires a natural person with a clinical peer to conduct the review before any adverse coverage determination issues and bars the system from superseding that clinical peer's judgment; it states no duty to log, record, or document the review or the system's role in it.
- Kind
- None
- As of
What this law does
SB 444, as passed by the General Assembly, adds O.C.G.A. § 33-46-7.1 to the private-review-agent certification chapter of the insurance code.
A private review agent or utilization review entity may use an artificial intelligence system or other software tool as part of a utilization review plan meeting the Insurance Commissioner's standards, but such a system may not issue an adverse coverage determination for healthcare services until a natural person qualifying as a private review agent or utilization review entity conducts the review with a clinical peer participating, and the system may never supersede that clinical peer's judgment. The Act sets its own effective date of .
When LexLint raises it
When your app profile says your app handles health records, makes health care decisions or makes insurance decisions.
Back to the example · Lint your app
Page updated .