Law / United States / 
Utah
Health Insurance Preauthorization AI Disclosure (SB 319, 2026 General Session)
Utah Code 31A-22-650, as amended
An AI sector rules rule binding private bodies.
- Obligation class
- Disclosure, Governance
- Audit expectation
- none
What it requires
- Disclose to the Insurance Department, to each network health care provider, and to each enrollee whether you use artificial intelligence in reviewing a preauthorization request, if you are a health insurerNIST AI RMFMEASURE 2.8
- Post that disclosure and your preauthorization statistics on your websiteNIST AI RMFMEASURE 2.8
- Base an adverse preauthorization determination on clinical or medical necessity on independent medical judgment, not solely on a recommendation from any other sourceNIST AI RMFMAP 3.5
- Set an authorization validity period of at least 12 months for a drug, device, or covered service treating a chronic or long-term care condition, and at least six months for an outpatient covered serviceno control in the NIST AI RMF
- This duty takes effect , so it is a duty to prepare for rather than one owed today
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
- 5.3.1-2.1That guidance covers proper use, limits and likely failure modes.
1 more
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
Who may demand the log
Regulator, Public
What the log must hold
Decision basis, Human involvement, Disclosure shown
Logging duty
The section never names a log or a record. It requires an insurer to disclose whether it uses artificial intelligence to review a preauthorization request, and to post and annually report authorization and denial statistics broken out by category, including appeal outcomes and response times, none of which can be stated without a decision-level record of each authorization and denial as it happens.
- Kind
- Implicit
- As of
- Provision
- 31A-22-650(2), (3) and (9)
- Trigger
- automated_decisions
What this law does
SB 319 (2026 General Session) amends Utah Code 31A-22-650, effective , to require a health insurer to disclose to the Insurance Department, to each network health care provider, and to each enrollee whether the insurer uses artificial intelligence in reviewing a preauthorization request, and to post that fact and its preauthorization statistics on its website.
An adverse preauthorization determination on clinical or medical necessity must be made using independent medical judgment and may not rely solely on a recommendation from any other source. The same bill sets a minimum authorization validity period of at least 12 months for a drug, device, or covered service treating a chronic or long-term care condition (shorter only for an experimental drug or on specified grounds). It separately sets a minimum authorization validity period of at least six months for an outpatient covered service.
When LexLint raises it
When your app profile says your app handles health records or is an insurer.
Back to the example · Lint your app
Page updated .