In 2026, several states introduced novel approaches for advancing the responsible and safe deployment of AI in healthcare, including sandbox pilots and AI auditor registries. While some of these paradigms are still in the early phases, the increasing fabric of state-level engagement provides a signal that there is a shift toward evidence generation as part of implementing AI models in healthcare.
Case Study: Utah’s AI Regulatory Sandbox as a lighthouse example
The state of Utah passed its landmark AI sandbox legislation in 2024, operated by the newly created Office of AI Policy (OAIP). While the sandbox and OAIP did not have a healthcare specific mandate, healthcare companies were some of the first to begin applying for the regulatory relief program.
The state originally faced scrutiny for one of its first sandbox pilots with AI-prescribing company Doctronic, which has since been quelled through the inclusion of the Utah State Medical Licensing Board (and other relevant parties) in pilot selection and oversight activities.
Since June, The OAIP recently made several announcements about the sandbox, including the introduction of two health systems in Utah, three pilots, and independent evaluators.
Importantly, the state laid out evidentiary standards for AI sandbox participants to meet, including the non-inferiority of care, bodily and psychological safety, and the potential for public health benefit.
“Utah is worth watching because it's built to produce evidence,” shared Keo McKenzie, an attorney at Baker McKenzie and Vega Health advisor. “The pilot is narrow and phased, physicians review every AI decision in the early stage, and the state collects regular reports and says it will publish the results. What makes Utah unusual is that it is generating real-world evidence through a state-sponsored regulatory experiment designed to report findings publicly.”
As the first state successfully embarking on the sandbox journey, Utah’s approach is being closely watched by other states and the national health policy landscape to understand how the oversight of increasingly autonomous AI should evolve to build trust and transparency across the ecosystem.
[Read more about the role of independent evaluators, including Vega Health]
States are focused on advancing AI regulation
Seven additional states introduced AI sandbox or regulatory relief laws in the first half of the year, according to Manatt Health’s state legislative tracker. Notably, Connecticut’s SB 5, was signed into law, making it the fourth state with an AI sandbox, following Utah, Texas and Delaware. Connecticut regulators will propose rules for the sandbox by the start of 2028.
The Cicero Institute’s AI in Medical Services Act is also gaining traction. The proposed legislation would grant certain use of AI a license to practice medicine autonomously and establish a regulatory sandbox with required oversight. Idaho and Iowa introduced the bill this year. Meanwhile, new laws passed in California also require transparency from health AI developers and deployers but take on a different approach.
According to McKenzie, California has diverged from other states, requiring clinicians to stay in charge of AI systems.
“California has gone another way,” she said. “Its new laws generally reinforce that AI cannot replace the professional judgment that licensed clinicians are expected to exercise and that clinicians remain responsible for patient care. ... California is insisting that people stay in charge.”
The state-level fabric of AI regulation: the shared principles and shared gap
While states are taking different routes, the proposed and enacted legislation share several key ideas. Each state is focused on keeping a human-in-the-loop who is accountable for AI in care and shares the view that the outcomes and performance of AI-enabled products need to be verified.
“None of these approaches accepts unaccountable AI in clinical care,” McKenzie said.
Utah’s approach and the Cicero-style bills underscore the importance of the supervision of AI to see what these technologies can safely enable, she explained.
“Utah is experimenting under supervision,” McKenzie said. “It temporarily relaxes certain licensing rules so a company can test an AI tool under close watch, starting with renewals of routine prescriptions. The Cicero-style bills contemplate licensing AI systems to perform certain healthcare functions subject to state oversight, after a probationary sandbox period.”
While a growing number of states share some principles regarding the regulation of AI in healthcare, there also remains a shared gap on how to operationalize enduring programs. States will need to identify how various capabilities, such as independent evaluations and performance reporting, are leveraged and what criteria will be applied. While Utah has invited evaluators into its sandbox – which is an important first step – it is not yet clear if the independent evaluators will take a uniform approach.
“Many regulators are still building the technical capacity needed to evaluate sophisticated AI models and monitor performance over time, so a lot of the evidence still comes from the vendors,” McKenzie said. “Few rules deal with what happens when a model is updated after approval. And having a human in the loop isn't a cure-all, since clinicians can be misled by a biased tool. Making independent evaluation and monitoring real is mostly about investment, not new laws. That means technical expertise inside regulators, benchmarks set up front, regular reporting after launch, including how different patient groups fare, and access to skilled independent auditors.”
Connecticut’s SB 5 and the Cicero bill are already considering how results could be recognized across state lines. States will have to decide not only how they will evaluate health AI products, but how also how they will shared those results with other stakeholders.
Looking ahead
For McKenzie, she is encouraged that state healthcare regulation is becoming more concrete.
“For years the debate was all promise or alarm,” she said. “Now we're starting to see more real-world performance data, pilot results and practical experience. If that keeps up, trust can rest on evidence rather than marketing.”
The Utah AI Regulatory Sandbox will continue to be a lighthouse example, as the public remains to see what evaluations will be conducted in the months following the announcement and how those results will be shared more broadly.
In this evolving state regulatory landscape, McKenzie recommends health care delivery organizations think about vendor engagements as long-term governance relationships, with clear expectations on compliance, clinician review, and liability terms.
“Treat it as a governance relationship, not just a purchase,” McKenzie stated. “The same tool may face different regulatory expectations from one state to another, so contracts need to say who carries that compliance risk. Clinician review has to be genuine, with enough time and information to push back on the tool. Ask for performance data, a say in model updates, audit rights, clear liability terms and keep the ability to pause a tool if the rules change. Vendors who welcome that kind of transparency and control are usually the ones worth partnering with.”
