State Payer AI Denial Laws Face Federal Preemption in 2026

In 2026, payer AI denial regulation is being fought on two different tracks that are too often collapsed into one. The Trump administration has told the Department of Justice to identify and challenge state AI laws that conflict with federal policy, including laws it considers “onerous or excessive,” and its March 2026 AI Framework recommends federal standards that would preempt the growing state patchwork.[1][2] That is real pressure. It is not, by itself, preemption.

The harder legal fact is older and less dramatic: ERISA already limits how far state insurance rules can reach. A state law restricting an insurer’s use of artificial intelligence in prior authorization or claims review may matter a great deal for a fully insured product. It may do little or nothing for a worker covered through a self-funded employer plan, where state insurance mandates generally do not apply.[2] For a patient trying to reverse a denial, that distinction can decide whether the new AI guardrail is available at all.

The Executive Order Is Pressure, Not a Judgment

The December 2025 executive order matters because it changes enforcement posture. It directs federal lawyers toward state AI laws and invites arguments that state regulation is inconsistent with national AI policy.[1] It does not repeal California’s law, suspend Washington’s statute, or make Maryland’s reporting obligations disappear. Executive orders bind the executive branch; they do not create a free-standing power to invalidate state law.

That distinction is not academic. A state legislature considering an AI denial bill in Q3 2026 is not only asking whether its insurance department has authority. It is also asking whether the bill will draw a federal challenge, whether carriers will argue federal conflict before the first enforcement action, and whether the state has the budget and appetite to defend the law. The National Health Law Program warned in January 2026 that the order could chill state guardrails even before any court rules on their validity.[1]

The March 2026 AI Framework pushes in the same direction from the policy side. As summarized by KFF, it recommends preemptive federal AI standards and frames the state patchwork as a burden on U.S. competitiveness.[2] That language gives regulated entities a federal talking point. It still leaves the legal work to Congress, agencies acting under delegated authority, or courts deciding a concrete preemption dispute.

States Are Not Regulating the Same Thing in the Same Way

The state response is not a single model wearing different labels. At least 10 states enacted laws in 2025 and 2026 addressing AI in coverage denials or related claims-review activity: California, Arizona, Maryland, Nebraska, Texas, Alabama, Indiana, Utah, Washington, and Georgia.[2][3] The interesting part is not the count. It is the theory of control each state chooses.

Washington’s approach is the cleanest example of a rule that changes the process. If an automated system can approve but not deny, the payer has less room to defend the denial as merely a human decision with software support. Maryland’s reporting requirement aims at a different problem: regulators cannot supervise patterns they cannot see. Louisiana’s pending bill, if enacted, would go further by making the payer prove that independent human judgment broke the causal chain between AI output and denial.[2]

Those differences matter for litigation. A disclosure or reporting law may be defended differently than a rule dictating who may make an adverse coverage decision. A prohibition on AI-only denials may raise different operational and preemption arguments than a law requiring human review, documentation, or appeal rights. Lumping all of them together as “state AI regulation” helps a press release; it obscures the legal questions carriers and state officials actually have to answer.

The Coverage Gap Runs Through ERISA

The central coverage question is not whether a patient has an insurance card. It is what kind of arrangement sits behind it. State insurance laws generally apply to fully insured plans because the insurer is selling a regulated insurance product. Self-funded employer plans are different. Under ERISA, employer plans that pay claims directly are generally outside state insurance regulation, even when a familiar insurer or third-party administrator processes the paperwork.[2]

That means a state AI denial law can be both meaningful and incomplete. It can change how a carrier handles prior authorization in a fully insured small-group or individual-market product. The same branded carrier may administer a large employer’s self-funded plan under a different legal regime. From the provider’s office, the denial may look identical. For the state insurance department, the enforcement hook may not be.

KFF’s May 2026 analysis makes the practical point bluntly: ERISA preemption means state laws do not apply to self-funded plans covering most U.S. workers with employer-sponsored insurance.[2] That is not a small carveout. It is the reason a state-by-state map of AI denial protections can overstate what commercially insured patients actually receive.

The ERISA analysis is also not a magic answer in the other direction. State laws may contain provisions aimed at insurers, utilization review entities, or vendors in ways that invite more detailed preemption fights. Some obligations may be framed as insurance regulation; others may be attacked as regulating plan administration. The point for 2026 is narrower: even before any new federal AI preemption law exists, ERISA already creates a large and uneven boundary around state protection.

Federal Policy Is Not Simply Anti-AI Denial Regulation

The federal-state story becomes harder to tell once Medicare enters the frame. CMS launched the WISeR model in January 2026, an AI-powered prior authorization model in traditional Medicare operating across six states.[4] While state lawmakers are trying to restrict AI-influenced payer denials, the federal government is testing AI-supported prior authorization in its own payment system.

WISeR is not just a technology demonstration. KFF reported that the services covered by the model represented $12.3 billion, or 5.3 percent, of Part B spending in 2024.[4] The model also uses vendors that share in savings from denied claims, a design choice that raises a structural incentive question separate from the accuracy of any individual algorithm.[4] If a contractor is paid in part when spending falls, patients and providers will reasonably ask who benefits when a request is slowed, narrowed, or denied.

This is why “federal preemption versus state consumer protection” is too tidy. The federal government is not merely restraining state experimentation. It is also centralizing the authority to decide when and how AI may be used in coverage review, including in Medicare. A House amendment to defund WISeR passed but was excluded from final FY2026 appropriations, leaving the model in place.[4] Whatever one thinks of the model, it weakens any simple federal claim that AI-assisted prior authorization is too dangerous for states to regulate but suitable for federal payment experiments without serious oversight.

Human Oversight Is Doing Too Much Work

Many state laws, model policies, and payer assurances lean on “human review” as the stabilizing concept. The phrase sounds reassuring until the appeal file is opened. A nurse or physician reviewer may have technically touched the case. The record may still fail to show whether the reviewer independently assessed the medical facts, relied on a generated recommendation, or merely confirmed a system output under production pressure.

Stanford researchers have highlighted risks around AI-driven insurance decisions and the limits of human oversight when algorithms shape coverage outcomes.[5] The policy implication is not that every automated triage tool is unlawful or clinically useless. It is that “a human was involved” is not a complete answer unless the law specifies what the human must do, what must be documented, and how a patient can challenge the decision.

The NAIC model bulletin on AI governance, adopted by more than 25 states, gives regulators a broader governance vocabulary: oversight, risk management, accountability, and documentation.[2] That kind of framework can help insurance departments examine systems before the denial lands in an appeal queue. It does not automatically answer the harder benefits question: whether a particular adverse determination complied with the patient’s contract, medical-necessity standard, and applicable utilization review law.

Congress Has Not Filled the Gap

There are federal legislative ideas on the table, but they are not yet the governing law. The Ban AI Denials in Medicare Act, H.R. 6361 in the 119th Congress, would prohibit AI-only denial models in Medicare, but KFF reported that it had not advanced as of May 2026.[2] Pending state bills, including Louisiana’s SB 246, remain unresolved unless and until enacted.[2]

That leaves agencies, courts, and state legislatures working in partial light. No DOJ preemption challenge to these state AI insurance laws has yet produced an adjudicated rule defining the scope of federal authority. No federal statute has displaced the state laws as a class. And ERISA, the doctrine already doing the most boundary-setting for employer coverage, was not written for generative models, predictive utilization tools, or vendor dashboards embedded in claims operations.

What Applies in Q3 2026 Depends on the Plan

For health plans, the compliance answer in Q3 2026 is fragmented. A carrier selling fully insured products in multiple states may face state-specific AI denial limits, reporting duties, human-review requirements, and governance expectations. The same enterprise may administer self-funded ERISA plans where state insurance mandates are contested or unavailable. Medicare Advantage, traditional Medicare, Medicaid managed care, and exchange coverage each bring their own statutory and contractual overlays.

For providers, the operational answer is equally uneven. The appeal letter cannot assume that a state AI denial statute applies just because the patient lives in that state. The first questions are more basic: Is the plan fully insured or self-funded? Is the denial from a Medicare arrangement, Medicaid managed care plan, exchange product, or employer plan? Does the relevant state law regulate the insurer, the utilization review entity, the vendor, or the adverse decision itself? Does it create a private right, an agency complaint pathway, a reporting duty, or only a standard for regulator enforcement?

For patients, none of that makes the denial feel less immediate. A delayed imaging approval, a rejected post-acute care stay, or a medication denial still arrives as a practical barrier to care. The legal architecture matters because it determines who can be forced to explain, reconsider, report, or change the process that produced the decision.

The most accurate reading of 2026 is therefore not that state payer AI denial laws have been wiped out, or that they fully protect insured patients. State laws still matter where they validly apply. Executive orders do not self-execute against state statutes. Federal litigation threats can still chill new guardrails. ERISA already excludes many workers in self-funded employer plans from state insurance protections. The live question is not whether AI denial regulation survives in the abstract; it is which authority reaches which plan before the next denial is issued.

References

1. Federal AI Policy Threatens Prior Authorization Reform, National Health Law Program, January 2026
2. Regulation of AI in Prior Authorization and Claims Review: A Look at Federal and State Consumer Protections, KFF, May 2026
3. States Continue Efforts to Regulate AI in Healthcare, Holland & Knight, May 2026
4. Examining the Potential Impact of Medicare’s New WISeR Model, KFF, February 2026
5. AI algorithms in health insurance care risks research, Stanford Report, January 2026