Federal AI preemption would barely touch state health insurance rules

Federal AI preemption would barely touch state health insurance rules. The executive order President Trump signed in December 2025 set out to challenge state AI laws and build a case for a single national framework. In health coverage, though, the state rules that matter most are insurance laws. They require a licensed clinician to make medical necessity denials instead of an algorithm. They also sit behind legal protections that an executive order cannot remove.

That does not make the preemption fight irrelevant to health care. It means the fight is aimed mostly elsewhere, at broad algorithmic discrimination laws like Colorado’s. State rules on AI in utilization review are likely to stand, and if Congress writes a national framework, it should adopt their core rule as a federal floor.

Key takeaways

• The order directs agencies but preempts nothing on its own. Preemption comes from Congress or from agency rules made under authority Congress gave, and law firm analyses of the order said as much.
• The first federal court action targets Colorado. DOJ intervened in April 2026 in a lawsuit against Colorado’s AI Act, on equal protection grounds. Colorado’s legislature then passed a rewrite that takes effect in January 2027.
• States keep writing health insurance AI rules. California and Texas are among the states that bar AI from being the sole basis for a medical necessity denial.
• Insurance has its own federal shield. Under the McCarran-Ferguson Act, a federal statute does not override state insurance law unless it specifically relates to the business of insurance.
• State rules already stop at federal programs. Medicare Advantage follows federal standards, and self-funded employer plans fall under ERISA. State AI rules reach insured commercial plans and, through contracts, Medicaid managed care.
• A federal floor would beat a federal ceiling. If Congress acts, it should make the common state rule national. A machine can approve care, and only a clinician can deny it.

What the executive order does

The order, Executive Order 14365, is titled “Ensuring a National Policy Framework for Artificial Intelligence.” It aims at what it calls a “minimally burdensome national policy framework,” according to a White & Case analysis. It followed a failed effort in Congress. In July 2025, the Senate voted 99-1 to strip a proposed moratorium on state AI laws from the budget bill, according to TechCrunch.

From White & Case (January 2026).

The legislative recommendation carries its own exceptions. The proposed framework would not preempt state laws on child safety or on AI computing and data center infrastructure. It would also leave state government procurement and use of AI to the states, along with other topics to be determined. Health care is not on the list of exceptions.

What an order can and cannot do

An executive order can direct federal agencies. It cannot by itself displace a state statute. White & Case wrote that the order “would likely not independently displace state AI laws,” because federal preemption typically comes from congressional enactments. The order’s force lies in what it sets in motion, such as litigation and a legislative proposal.

Why health care is exposed anyway

The order can reach health care without preempting anything. The FTC’s policy statement on deceptive practices could shape how vendors describe clinical AI tools. An FCC disclosure standard could collide with state rules that require notices when AI writes to patients, such as California’s AB 3030, which our piece on AI disclaimers examined. Funding conditions could pressure states to slow new laws, even where those laws would survive in court.

The exposure varies by the kind of rule. Laws aimed at AI developers across sectors are the most exposed, because they are the order’s main target and they lack an insurance shield. Rules about how insurers decide coverage are the least exposed.

Our assessment, based on the sources cited.

Texas shows how a single state can sit in several rows. It enacted a law on providers’ use of AI and a broader governance act in 2025, according to Akin. Its insurance law separately bars AI from making adverse medical necessity determinations. A federal challenge to the governance act would not reach the insurance rule.

What has happened since

The most visible action came in Colorado. On April 9, 2026, xAI sued to block Colorado’s AI Act, the 2024 law that regulated high-risk AI systems and algorithmic discrimination. On April 24, DOJ moved to intervene on the company’s side. Its argument rested on the Equal Protection Clause, not on preemption. DOJ said the law requires AI developers to prevent unintentional disparate impact while exempting some practices meant to advance diversity.

Colorado then rewrote the law. In May 2026, its legislature passed SB 26-189, which replaces the 2024 framework from January 2027, according to Ballard Spahr. The new law focuses on automated decision tools that materially influence consequential decisions, and it lists health care and insurance among the covered sectors. In place of broad impact assessments, it requires notices and explanations after adverse outcomes. It also gives consumers correction rights and meaningful human review.

The Colorado sequence shows the pattern. Federal pressure fell on a broad, cross-sector law about discrimination. The state’s response kept the parts closest to individual decisions, such as human review. It dropped much of the rest.

For health plans and their vendors, the practical lesson is that work on human review is unlikely to be wasted. The parts of Colorado’s law that survived the rewrite are the parts that look most like sound utilization review practice. A plan that builds clinician review into every AI-assisted denial is ready for the 2027 version of the law and for most other states’ rules as well.

No published version of the Commerce evaluation the order required could be found, nor a federal preemption statute enacted by July 2026.

The state rules in health insurance

The state laws that govern AI in coverage decisions are narrower than Colorado’s original act. Most do one thing. They prevent an algorithm from being the sole basis for a denial of care.

From the Kansas Legislative Research Department (March 2026).

More states followed in 2026, as our review of state AI denial laws described in May. Enforcement runs through state insurance regulators, who can examine plans and act on complaints. Several of the laws also give regulators the right to inspect the tools themselves. The laws vary in detail, but their center is the same. A machine may help, and a licensed person decides when care is denied.

That rule is not an obstacle to AI. It allows automated approvals and summaries of the record. It reserves only the adverse decision for a person. Our analysis of auditing payer AI like a reviewer argued that plans should test their tools the way they test human reviewers. The state laws assume the same division of labor.

Why preemption would miss them

Insurance has its own shield

The McCarran-Ferguson Act gives state insurance law unusual protection from federal statutes. Under 15 U.S.C. § 1012, a federal law does not override a state law regulating the business of insurance “unless such Act specifically relates to the business of insurance.” A general federal AI framework would face that test. A statute aimed at AI developers, written without mention of insurance, could leave state rules on insurers’ coverage decisions intact.

Congress could write around the shield by naming insurance in a preemption clause. That would make health coverage an explicit target of the bill, and the Senate’s 99-1 vote in 2025 suggests how hard such a provision would be to pass.

The rules already stop at federal programs

State insurance laws never reached the 2 largest federal arenas for utilization review. Medicare Advantage plans follow federal standards, which under the Medicare statute supersede state law except for licensing and solvency. Self-funded employer plans fall under ERISA, which keeps state insurance mandates out of them.

What remains for state AI rules is still large. They reach fully insured commercial plans, including those sold on the exchanges. They also reach Medicaid managed care plans, which states regulate through insurance law and through their contracts.

Medicaid adds another layer of state control. States write the contracts for their managed care plans, and those contracts can require human review of AI-assisted denials whatever happens to general AI laws. CMS reviews the contracts, but the requirement is the state’s to set.

Medicare Advantage already has a federal version

For Medicare Advantage, CMS has already taken a position close to the state rule. In its February 2024 answers on the CY2024 final rule, CMS said “algorithms or artificial intelligence alone cannot be used as the basis to deny admission or downgrade to an observation stay,” as our two-midnight analysis described. Medical necessity denials must also be reviewed by a physician or other appropriate professional. The federal program and the state laws point in the same direction.

The federal version is thinner than it looks, though. CMS’s statement came in answers to questions, not in regulatory text. CMS proposed broader guardrails on AI in coverage decisions for 2026 and did not finalize them, according to the Kansas briefing. A future administration could revise the answers without new rulemaking.

A federal floor, not a ceiling

The strongest argument for preemption is uniformity. A vendor that sells utilization review tools to plans in many states faces a patchwork of definitions and audit rights. That burden is real, and it falls hardest on smaller vendors and plans.

The way to end a patchwork is to make its best common rule national, not to erase it.

Health care already has a model for this. The HIPAA Privacy Rule preempts contrary state laws, but it leaves standing state laws that are more stringent in protecting privacy. Hospitals and plans have worked within that design since 2003. A federal AI floor for coverage decisions could work the same way.

Uniformity does not require weaker rules. Congress could set a federal floor for AI in coverage decisions that matches the rule most states already share. States could add to it but not fall below it. A floor for health coverage could hold 4 commitments.

1. A licensed clinician makes every denial. An algorithm can recommend approval and can triage, but an adverse medical necessity decision is made by a person with the right qualifications.
2. The decision rests on the individual record. A prediction about a population cannot by itself decide an individual’s care, which matches CMS’s position for Medicare Advantage.
3. The reasons are disclosed. A denial states the criteria and the facts from the record that support it, in terms the patient and clinician can contest.
4. The decision can be audited. Regulators can inspect the tool and the record of each decision, as several state laws already allow.

A statutory floor would also firm up the federal side. It would turn CMS’s guidance for Medicare Advantage into law and extend the same rule to every program the floor covers. A clinician reviewing a denial in a Medicaid plan in Ohio and one reviewing a denial in a commercial plan in Texas would work under the same core rule.

A floor would give vendors a single standard to build to, and it would give patients the same protection whether their plan is regulated by a state or by CMS. It would also avoid the fight a ceiling would start. States would have little reason to resist a federal rule that adopts their own.

The group no state can reach

A federal floor would matter most for people state law cannot protect. Self-funded employer plans cover a majority of workers with employer coverage, according to KFF’s annual employer surveys. ERISA keeps state insurance rules out of them. No state AI law reaches a denial made by a self-funded plan’s administrator.

Federal rules for those plans already require some human judgment. Under the ERISA claims regulation, an appeal of a denial based on medical judgment must be decided in consultation with a health care professional who has appropriate training and experience. That rule applies at appeal, not at the first decision. A federal floor could move it forward, so that the first adverse decision is made by a clinician too.

This is the group the preemption debate rarely mentions. A national framework that only preempted state rules would leave these members where they are. A framework that set a floor would reach them for the first time.

There are fair objections. A federal floor written in 2026 could lock in rules that age badly as tools improve. Definitions of AI shift quickly, and a statute is slow to amend. The answer is to regulate the decision rather than the technology. A rule that says a person decides every denial does not depend on how the tool works.

Where Redlake stands

Redlake builds tools that health plans use in utilization review. Our first rule is that a machine can say yes, but only a person can say no. It is the rule that California and several other states have written into law. It is also the position CMS took for Medicare Advantage. We would build to it whether or not any law required it.

Our other rules follow from it. Every recommendation shows its reasons, so the clinician who decides can see what the tool saw. Every decision can be reconstructed, so a regulator or an appeal can check it later.

In practice, that means our tools treat every program the same way. An approval can be automated where the criteria are met and the plan allows it. Anything that could end in a denial goes to a clinician with the reasons laid out. That holds in commercial and public programs alike. A federal floor would not change how we build. It would change how many patients can count on that design.

We support a national framework for AI in health coverage, if it sets a floor. A framework that preempted state human-review rules without replacing them would leave patients with less protection than they have today. A framework that made those rules national would give everyone, including vendors like us, a clearer standard.

What to watch in the rest of 2026

• The xAI case. Watch whether the court rules on the constitutional claims before Colorado’s rewrite takes effect in January 2027.
• The FTC and FCC actions. Watch for the FTC’s policy statement and any FCC proceeding on AI disclosure. Watch also whether either mentions health care.
• Congress. Watch for a federal framework bill, and for whether its preemption clause names insurance.
• Medicare Advantage guardrails. Watch whether CMS returns to the AI guardrails it proposed for 2026 and did not finalize.
• State sessions in 2027. Watch whether states keep adding human-review rules for coverage decisions despite federal pressure.

About this analysis

Method. The December 2025 executive order and the litigation and legislation that followed in Colorado are read against state laws on AI in health insurance and the federal statutes that govern preemption in insurance.

Data notes. The state law table relies on a March 2026 briefing by the Kansas Legislative Research Department and covers laws enacted through 2025. None of this is legal advice, and the application of McCarran-Ferguson to any specific federal statute would depend on its text. Employer plan figures are described from KFF’s surveys in general terms. The federal floor is our proposal.

Sources. White & Case (January 2026). TechCrunch (July 2025). DOJ, intervention announcement (April 2026). Ballard Spahr via JD Supra (May 2026). Kansas Legislative Research Department (March 2026). Akin (2025). 15 U.S.C. § 1012. CMS, answers on the CY2024 final rule (February 2024).

Frequently asked questions

Does the December 2025 executive order preempt state AI laws?

No. An executive order can direct federal agencies, but preemption generally requires an act of Congress or an agency rule issued under authority Congress granted. The order set in motion litigation and a proposal for federal legislation.

Do state laws on AI in health insurance apply to Medicare Advantage?

Generally not. Medicare Advantage plans follow federal standards that supersede most state law. CMS has said that algorithms or AI alone cannot be the basis to deny an admission or downgrade it to observation.

What do state AI laws in health insurance require?

Most prevent an algorithm from being the sole basis for a medical necessity denial. California requires that final medical necessity determinations be made by a licensed physician or qualified licensed provider.

Which state AI rules are most exposed to federal action?

Broad laws aimed at AI developers across sectors, such as Colorado’s 2024 AI Act, are the most exposed. Rules on how insurers make coverage decisions are the least exposed, because federal law protects state insurance regulation from statutes that do not specifically address insurance.

Do state AI rules apply to employer health plans?

They apply to fully insured employer plans, which buy coverage from a state-regulated insurer. They do not apply to self-funded plans, which ERISA governs. Those plans cover a majority of workers with employer coverage.

Could Congress preempt state AI laws in health insurance?

It could try, but the McCarran-Ferguson Act protects state insurance law from federal statutes that do not specifically relate to the business of insurance. A preemption clause would likely need to name insurance explicitly.