Law / United States / 
Minnesota
Utilization Review, AI-Only Adverse Determination Prohibition
Minn. Stat. § 62M.09, subd. 3(f) (2026 Minn. Laws ch. 124, art. 3, § 6)
An AI sector rules rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence, Operator establishment
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- If you are a utilization review organization, do not use automated processing alone, without a clinician review by an appropriate health professional, to make an adverse determination on a health care service, admission, or extension of stay.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Logging duty
The paragraph bars a utilization review organization from making an adverse determination through automated processing alone, and states no duty to keep a log or record of the clinician review it requires instead.
- Kind
- None
- As of
What this law does
A 2026 amendment to the utilization review act adds paragraph (f) to section 62M.09, subdivision 3, barring a utilization review organization from using any form of automated processing alone, without a clinician review by an appropriate health professional as the rest of the subdivision already requires, when making an adverse determination on a health care service, admission, or extension of stay.
A utilization review organization under this chapter is a private entity, such as an insurance company, prepaid limited health service organization, or health plan company, rather than a state agency. The amendment reached enactment as section 6 of House File 4188, an omnibus commerce policy bill, after a conference committee substituted new language for the entire bill (a delete-everything amendment).
House File 2500, a stand-alone bill on the same subject, was introduced in 2025 and never advanced past its initial committee referral. Its companion, Senate File 1856, was amended in committee in 2026 but received no recommendation and no floor vote in either chamber. The House repassed the conference report 121-13 on , and the Senate 49-15 on ; the governor approved the act, filed as 2026 Minnesota Session Law chapter 124, on .
The amendment's own effective-date clause makes it effective , applying to health plans offered, sold, issued, or renewed on or after that date.
When LexLint raises it
When your app profile says your app handles health records or is an insurer.
Back to the example · Lint your app
Page updated .