While federal agencies continue to issue guidance and framework updates, state legislatures are writing binding statutory obligations for artificial intelligence in healthcare. They are also rewriting them. Colorado passed the first comprehensive state artificial intelligence law, delayed it twice, and then repealed it before it ever took effect, which is the more useful lesson for procurement than any single statute.
For compliance leads, privacy officers, and counsel, monitoring state law is no longer academic, particularly for an organization operating across state lines or using these tools for clinical decision support, coverage determinations, or patient triage.
Colorado: a framework rewritten before it took effect
Colorado is the cautionary tale for anyone building a compliance program around pending statute. Senate Bill 24-205, the nation’s first comprehensive state artificial intelligence law, would have imposed a duty of care, annual algorithmic impact assessments, and attorney general reporting on deployers of high-risk systems in healthcare. It never took effect. Enforcement was stayed in April 2026, and in May 2026 Senate Bill 26-189 repealed and replaced it outright.
The replacement framework takes effect January 1, 2027. It moves away from the duty-of-care and impact-assessment model toward transparency, disclosure, and consumer correction rights for automated decision-making technology used in consequential decisions, healthcare among them. One change matters more than the rest for health systems: the original act carried conditional exemptions for certain federally regulated entities, and the replacement does not. Organizations that read the 2024 law and concluded it did not reach them should read the 2026 one again.
California: oversight of utilization decisions
California Senate Bill 1120 targets algorithmic decision-making in health insurance and care authorization. It prohibits health plans from relying solely on an algorithm to deny, delay, or modify health care services.
Every coverage decision must be based on individualized patient circumstances and adjudicated by a licensed medical professional, which establishes a direct statutory mandate for human review.
What procurement should ask regardless of statute
Does the vendor provide plain-language documentation of model behavior, clinical training data, and known limitations?
Has the vendor conducted bias testing, and do they publish ongoing monitoring results?
Does the contract preserve your right to enforce human review without software restriction?
A framework-aligned assessment your own team runs, covering the domains a standard questionnaire does not reach.
Talk with our team