Every AI rule that touches healthcare, cited and kept current.

Requires A PCCP lets a manufacturer pre-specify and get FDA authorization for future model changes as part of the original submission — so pre-approved updates don't each need a new submission. A PCCP must describe three things: the planned modifications, the methodology to develop/validate/implement them safely, and an impact assessment of benefits and risks.

Proposes The FDA's first comprehensive, total-product-lifecycle recommendations for AI devices — design, development, validation, transparency, and postmarket performance monitoring. It recommends manufacturers maintain a monitoring plan to catch performance drift after deployment. Still a draft as of August 2026 (comment period closed April 7, 2025).

Clarifies The FDA's January 2026 revision narrows which decision-support software — expressly including AI-enabled CDS — counts as a regulated medical device. Software that informs a clinician who can independently review the basis for its recommendation can qualify as Non-Device CDS, and the FDA now intends enforcement discretion for some single-recommendation tools (such as guideline-based risk scores) that the 2022 guidance pushed toward device status. The FDA walked industry through the changes in a March 11, 2026 town hall.

Status Proposed sweeping certification and interoperability changes (new patient/provider/payer FHIR APIs, public-health data exchange, updated standards). A small TEFCA-related slice was finalized in late 2024; the bulk was formally withdrawn December 29, 2025, citing deregulation and "emerging AI technologies."

Proposes The live ONC AI rulemaking — and it runs the opposite direction. It would remove the HTI-1 AI source-attribute / "model card" and risk-management requirements from the Predictive DSI criterion, arguing there's no published evidence they improved care. Broadly deregulatory (proposes removing 34 of 60 certification criteria). The comment period closed February 27, 2026; the rule is still not finalized as of August 20, 2026, so the HTI-1 model-card requirements remain in force in the meantime. It is close, though. The final rule reached OMB's regulatory-review office (OIRA) on July 28, 2026 and is listed as pending review — the last procedural step before a rule can publish — and the 2026 Unified Agenda projects final action in August 2026 (RIN 0955-AA09).

Status CMS is testing AI/ML-assisted review of prior-authorization requests in Original Medicare (fee-for-service — it does not apply to Medicare Advantage) across six states. The model targets a pre-selected list of services CMS flags as wasteful or fraud-prone (skin and tissue substitutes, electrical nerve-stimulator implants, and knee arthroscopy for knee osteoarthritis, among others). CMS says WISeR does not change Medicare coverage or payment policy — and any non-payment recommendation must come from an appropriately licensed clinician, not the technology alone.

Proposes A major cybersecurity update that would require a technology asset inventory and network map explicitly listing AI software that handles ePHI, and would require the risk analysis to assess — before deploying an AI tool — what ePHI it accesses and where outputs go. Confirms ePHI in AI training data and models is within scope. Not finalized as of August 20, 2026; outcome uncertain amid industry pushback — and the 2026 Unified Agenda carries it as a long-term action with final action projected July 2027 (RIN 0945-AA22), so it is unlikely to bind before then. Note the contrast with HTI-5 above: of the two open federal AI rulemakings, the deregulatory one is at OMB now and the one that would add AI security duties is parked three years out.

Prohibits Unsubstantiated or deceptive AI capability claims ("AI washing"). The September 2024 sweep brought five actions (DoNotPay, Rytr, and others) against companies overhyping or misusing AI. Health-tech AI marketing — diagnostic accuracy, "AI clinician," compliance-automation efficacy — is squarely within this standard.

Prohibits Sharing sensitive health data with advertisers/third parties without consent. The FTC penalized GoodRx ($1.5M, its first Health Breach Notification Rule action), BetterHelp ($7.8M), and Cerebral for leaking medication, mental-health, and telehealth data via tracking tools. Its 2024 HBNR amendments expressly cover health apps not governed by HIPAA, and treat tracker/pixel leaks as reportable breaches.

Was The most sweeping federal AI action to date — directed an HHS AI Task Force, a health-AI assurance strategy, and an AI safety program for clinical errors. Rescinded on Jan 20, 2025; the HHS deliverables it ordered are now superseded.

Directs A national policy to remove barriers to AI leadership; ordered a review/unwinding of EO 14110 actions and mandated the AI Action Plan. The Plan's three pillars — innovation/deregulation, infrastructure, and global influence — promote rapid AI adoption in healthcare and call for regulatory "sandboxes," including for health.

Directs A "OneHHS" approach across CMS, FDA, NIH, CDC — deploy AI aggressively while applying OMB's "high-impact AI" risk-management controls (bias mitigation, monitoring, human oversight), with implementation milestones in 2026.

Requires Prohibits developing/deploying AI with intent to unlawfully discriminate, to manipulate people toward self-harm or crime, for government social scoring, or for unlawful biometric capture. Enforced by the AG (no private lawsuits), with a 60-day cure period and a regulatory sandbox. Healthcare-specific: TRAIGA's disclosure duty is broad (AI used "in relation to a health care service or treatment"); the specific requirement that a provider disclose to patients when AI is used in diagnosis or treatment comes from a separate Texas law, SB 1188 (see below).

Requires One of the first provider-facing AI disclosure laws. People in a regulated occupation (including healthcare providers) must disclose generative-AI use to consumers. A 2025 amendment (SB 226) narrowed proactive disclosure to "high-risk" interactions — which still generally captures use of health data for personalized advice. Created Utah's Office of AI Policy and AI "learning lab."

Prohibits AI systems from using terms or titles (e.g., "doctor," "nurse," "psychologist") in a way that implies care is being provided by a licensed human. Each prohibited use is a separate violation, enforced by the relevant licensing board.

Prohibits The whole operative section is one sentence: "A nonhuman entity, including but not limited to an agent powered by artificial intelligence, may not use any of the following titles" — Advanced Practice Registered Nurse (APRN), certified registered nurse anesthetist (CRNA), clinical nurse specialist (CNS), licensed practical nurse (LPN), registered nurse (RN), nurse practitioner (NP), certified medication aide (CMA), or certified nursing assistant (CNA). It sits inside Oregon's Nursing Practice Act, so it is enforced as a title-protection rule.

Prohibits Offering — or claiming — that an AI system can provide professional mental/behavioral health care, and bars providers from using AI to deliver care directly to patients (support uses with provider review allowed). Also restricts AI for these services in public schools. Penalty up to $15,000 per violation.

Requires AI "mental health chatbots" must clearly disclose they are AI (before use, after 7 days of non-use, and on request); in-chat advertising must be labeled; and suppliers may not sell or share users' identifiable health information or inputs (limited exceptions).

Requires Licensed practitioners may use AI for diagnosis/treatment only within their scope and only if they review all AI-generated records per Texas Medical Board standards; also prohibits offshoring electronic medical records.

Requires After scaling back its broad AI act, Colorado passed two targeted health laws in mid-2026. HB 26-1139 requires AI coverage decisions to use the patient's individual history, requires a licensed clinician to review medical-necessity denials, mandates disclosure of AI use to regulators, and bars payer reimbursement for AI-delivered psychotherapy. HB 26-1195 restricts AI from conducting therapeutic communication except during live sessions with the provider present, and requires consent for AI session recording.

Requires Spring 2026 added four more states to the mental-health red line. Tennessee (SB 1580, eff. Jul 1, 2026) bars advertising or representing that an AI system is — or can act as — a qualified mental-health professional, with a private right of action under its consumer-protection law. Delaware (HB 191, eff. Apr 23, 2026) says a nonhuman entity, including an AI agent, cannot be licensed as — or use the title of — a nurse, physician, or physician assistant. Idaho (S 1297) and Nebraska (LB 525) enacted near-identical Conversational AI Safety Acts (both eff. Jul 1, 2027): public-facing chatbots must clearly disclose they are AI, follow crisis-response protocols when a user expresses suicidal ideation, and may not claim to provide professional mental or behavioral health care. Colorado joined on May 29, 2026 (HB 26-1263, operator requirements eff. Jan 1, 2027): conversational-AI operators must disclose that outputs are AI-generated, maintain suicidal-ideation and self-harm response protocols, protect minor users (age estimation, no simulated emotional dependence), report annually to the Attorney General — and may not represent a chatbot's output as equivalent to services from a licensed professional.

Prohibits Providing, advertising, or offering therapy or psychotherapy services to the public — including through Internet-based AI — unless the services are provided by a licensed professional; a violation is an unfair trade practice under Maine law. Licensed clinicians may still use AI for administrative and "supplementary" support (therapy notes, anonymized trend analysis, referral research), but only with the client's explicit written consent — the law says consent can't be collected through a general terms-of-use agreement — after disclosing the tool's purpose and how session data is stored, used for training, and deleted. Even then, the AI may not make independent therapeutic decisions, interact with clients in therapeutic communication, or generate treatment plans without the licensee's review. Clients can't be denied care for refusing consent, and client waivers of these protections are void.

Requires Rhode Island enacted two healthcare AI laws that took effect the day they were signed. The Oversight of Artificial Intelligence Technology in Mental Health Care Act bars any person or entity from providing, advertising, or offering therapy or psychotherapy to the public — including through Internet-based AI — unless a licensed professional conducts it. A licensed provider may not let AI make independent therapeutic decisions, determine therapeutic recommendations or treatment plans, or directly engage a client in therapeutic communication without an established relationship. Where AI designed to simulate emotional attachment (or an AI "companion") assists in a recorded or transcribed session, the patient must be told in writing that AI will be used and for what purpose, and must consent — and the statute is explicit that consent cannot be harvested from acceptance of a broad terms-of-use agreement. FDA-cleared AI tools, religious counseling, peer support, and public self-help materials are carved out. Separately, the Use of Artificial Intelligence by Healthcare Providers Notification Act requires any provider or facility that uses AI to document an in-person or telehealth visit to notify the patient and to review the AI-generated documentation for accuracy after the visit.

Prohibits A corporation or entity may not provide, advertise, or otherwise offer mental health services to the public — including through the use of artificial intelligence — unless those services are provided by a mental health professional, or delivered as part of a study approved by an IRB or privacy board under 45 CFR 164.512(i)(1)(i)(A)–(B). Vermont's definitions run wide: "therapeutic communication" expressly includes "offering clinical support, including reassurance or empathy in response to emotional or psychological distress," and "mental health professional" reaches nonlicensed psychotherapists and "any other professional who provides mental health services."

The clinician safe harbor is conditioned on HIPAA This is the provision to know. Under §7115(d) a professional may use AI tools only if they are "compliant with the Health Insurance Portability and Accountability Act of 1996" and the professional reviews and approves the service. FDA-cleared digital therapeutics sit in the same harbor when prescribed or recommended. Vermont has effectively made HIPAA compliance a licensing condition for clinical AI, not just a privacy obligation.

Enforcement A violation by an entity is a violation of the Vermont Consumer Protection Act (9 V.S.A. ch. 63) — which carries both Attorney General authority and a private right of action. Separately, prohibited AI use is unprofessional conduct under 3 V.S.A. §129a(a)(30) and 26 V.S.A. §1354(a)(3), so it also reaches board discipline.

Also on the books Vermont Act 101 (H.814, signed May 18, 2026) declares neurological rights — mental and neural data privacy, freedom of thought, and protection from unauthorized access to or manipulation of brain activity (18 V.S.A. ch. 42C §1891). It imposes no duty on a provider today; read it as the signal for Vermont's next round. It also extends the AI Advisory Council to 2030 and orders a January 15, 2027 report that will recommend, among other things, regulating AI in health-insurance utilization review.

Requires The operative sentence is short: a healthcare professional licensed under Title 37 "shall verbally disclose the use of any recording device, software, or service to a patient before recording any part of an appointment or treatment to be transcribed by artificial intelligence." Note the two words that decide how you implement it — verbally, and before. A line in the intake paperwork does not satisfy this; the disclosure has to be spoken, and it has to come before the recording starts.

Disclosure, not consent The bill was introduced as a consent requirement and amended in committee down to disclosure — and Louisiana's own bill-status digest still carries the old "obtain a patient's consent" short title. The enacted text controls, and it requires disclosure. Enforcement runs through the professional licensing board; the statute also limits civil liability absent gross negligence or willful misconduct, so a simple failure to disclose is a board matter rather than a damages claim.

Requires A separate cluster regulates AI companions — the consumer chatbots people confide in — rather than clinical tools. Every law in it is built on the same duty: detect a user in crisis, and hand them to a human service.

The two originals — New York and California New York was first in the nation and has been in effect since Nov 5, 2025. The law arrived as Part U of the FY2026 budget bill (S3008-C) rather than as a standalone act — which is why several trackers still point at A6767, a different bill that died in the Senate — and is codified at Gen. Bus. Law Art. 47. Under §1701 it is unlawful to operate an AI companion unless it runs a protocol to address a user's expression of suicidal ideation or self-harm and refers that user to a crisis service; §1702 requires notice at the start of the interaction and at least every three hours that the user is not talking to a human. The Attorney General enforces it (§1703). California SB 243 (Ch. 677, Stats. 2025, signed Oct 13, 2025) took effect Jan 1, 2026: a crisis-referral protocol, AI disclosure and break reminders for minors, and annual reports to the state's Office of Suicide Prevention beginning Jul 1, 2027 — backed by a private right of action for the greater of actual damages or $1,000 per violation.

The 2026 wave Connecticut (Public Act 26-15, approved May 27, 2026; the AI-companion sections take effect Jan 1, 2027) requires an evidence-based protocol to detect a user expression indicating risk of suicide, self-harm, or imminent violence and to refer the user to the 988 lifeline and on to treatment "consistent with clinical best practices"; the companion may not claim to be a human being; and for minors it may not offer mental-health services at all unless it is designed to deliver them using clinical best practices and displays, clearly and conspicuously at the start of each interaction, a statement that it is not a licensed mental health professional.

Oregon and Iowa Oregon (SB 1546, approved Mar 31, 2026, effective Jan 1, 2027) requires a suicidal-ideation detection protocol and a referral carrying contact information and a hyperlink for 988 — or a youthline for a user under 25 — restricts simulated emotional dependence and romantic role-play for minors, and gives users a private right of action for the greater of actual damages or $1,000 per violation. Iowa (SF 2417, approved May 2, 2026; by its own terms the act applies July 1, 2027) requires conspicuous AI disclosure to minor account holders and a protocol referring users to a crisis service, and bars an operator from knowingly programming the service to represent that it provides professional psychology or behavioral-health services that would require a license — enforced by the Attorney General at up to $500,000 per operator, with no private right of action.

Hawaii Hawaii (SB 3001 CD1, the Artificial Intelligence Disclosure and Safety Act) is the 2026 wave's first to be in effect: Governor Green signed it as Act 248 on July 14, 2026 (Gov. Msg. No. 1350), and it takes effect on approval. It requires operators of conversational-AI services to clearly disclose that a user is interacting with AI rather than a human; adds safeguards for minors — limits on manipulative engagement techniques and sexually explicit content, plus tools for parents and guardians to manage screen time and account settings; and requires a protocol to respond to a user expressing suicidal ideation or self-harm by directing them to crisis-intervention resources such as suicide hotlines and crisis text lines. Beginning January 1, 2028, operators must file annual reports with the Department of Health's Behavioral Health Administration. It is enforced as an unfair or deceptive trade practice.

Washington and Georgia Two more land in 2027, and both are worth reading for how far the duty now reaches. Washington HB 2225 (Ch. 168, Laws of 2026, approved Mar 24, 2026; effective Jan 1, 2027) conditions deployment itself on the protocol: "An operator may not make available or deploy an AI companion chatbot unless it maintains and implements a protocol for detecting and addressing suicidal ideation or expressions of self-harm by users." The protocol must cover expressions "including eating disorders," refer users to a suicide hotline or crisis text line, and prevent content describing how to self-harm — and the operator must publicly disclose both the protocol and the number of crisis referrals it issued the prior calendar year. Violations are unfair or deceptive acts under ch. 19.86 RCW, which carries a private right of action. Unlike most of this cluster, the duty runs to all users, not only minors. Georgia SB 540 (O.C.G.A. §39-5-6, effective Jul 1, 2027) requires a protocol for "severe harm or related emotional crises" — identification methods, automated or human-mediated referral to the 988 lifeline, prevention of content that encourages or normalizes severe harm, and escalation procedures for repeated or severe indicators — plus a plain-language public summary and an annual crisis-referral count. It also bars programming a companion to represent that it is "licensed, certified, or otherwise authorized to provide professional mental health, behavioral health, medical, or counseling services" unless it lawfully is — the same red line as CA AB 489 and DE HB 191. The Attorney General enforces it at up to $10,000 per knowing violation.

Read this one carefully These are operator duties, not provider duties. Connecticut and Oregon both expressly carve out software that assists or supports patient or resident care services in a facility. If you run an AI scribe or a clinical decision-support tool, these eight laws are not aimed at you — the ones that are aimed at you are Rhode Island's, Vermont's, Louisiana's, Texas SB 1188, and the therapy bans above.

Requires Insurers (including health insurers) maintain a written AI governance program covering risk management, bias/data-quality controls, consumer notice, vendor oversight, and documentation available to regulators. As of early-to-mid 2026, roughly half the states (~24–25) had adopted it via bulletin. It's guidance, not a binding denial-of-care ban.

Requires Three more states put a licensed human between AI and a denial. Alabama (SB 63, signed Apr 16, 2026, effective Oct 1, 2026): a decision to "deny, delay, or modify" a prior-authorization request based on medical necessity "shall always be made by a licensed physician or other health care professional who is competent to evaluate any recommendation or conclusion of artificial intelligence." The plan must also certify annually to the department that its AI does not rely on a group dataset, is applied fairly and equitably, and does not discriminate — and must make prominent written disclosure of its AI use in its utilization-review policies and procedures.

Georgia (SB 444, effective Jan 1, 2027): AI may automate tasks and participate in decision-making, but such systems "shall not issue an adverse determination to a patient until a natural person qualifying as a private review agent or a utilization review entity conducts a utilization review in which a clinical peer participates. In no event shall artificial intelligence … supersede the judgment of such clinical peer."

Utah (SB 319, effective Jan 1, 2027): an insurer must disclose — to the department, to each health care provider in its network, and to each enrollee — if it uses AI to review authorization requests. And an adverse preauthorization determination on clinical or medical necessity must be made by an individual who "exercises independent medical judgment" and "does not rely solely on recommendations from any other source."

Context In 2025, legislators in 36 states introduced 168 AI-and-health bills, part of a record year for AI legislation generally. There is no single clean count of states with enacted healthcare-AI statutes — the honest summary is "dozens of states are legislating; a smaller subset have enacted binding health-AI or insurer-AI laws," and the pace is accelerating.