Three states just turned the AI governance gap from a future problem into a current, measurable exposure. The federal floor everyone was waiting for is arriving one statehouse at a time.
On October 1, 2025, Maryland became one of the first states in the country to require insurers to report quarterly on the AI they use in utilization management, with AI-use disclosure built into adverse-decision reporting; the first revised quarterly report was due January 30, 2026, so that clock has been running for months. On July 1, Indiana's law takes effect, barring AI from being the sole basis for downcoding a claim and requiring disclosure whenever AI is used in an adverse prior-authorization determination or downcoding decision. Colorado's psychotherapy-AI bill takes effect August 12, 2026, with its reworked AI law and a utilization-review bill following on January 1, 2027.
Three states. Three different definitions. Three different compliance clocks. And every health system operating across state lines now has to answer to all of them at once.
"Do we really need a governance framework, or can we wait for the federal rules?"
The patchwork is the answer. There is no single federal floor coming fast enough to wait for. The states are moving, they are not coordinating, and the obligations are already live. Waiting is itself a decision, and right now it is the wrong one.
Stripped of the legal language, the obligations converge on three things a health system has to be able to do.
"The governance gap is not a future problem. It is a current exposure, and the states just made it measurable."
The first wave of AI regulation asked health systems to disclose that they used AI. This wave asks them to account for what the AI decided. That is a different operating burden. Disclosure is a checkbox. Accountability is a workflow: an owner, an audit trail, and the ability to reconstruct why a model produced a given output when a regulator asks six months later.
The systems that will struggle are the ones treating governance as a document that lives in a binder. The systems that will be fine are the ones that already built governance as a function: a registry that updates when a new tool is procured, an accountable owner per decision class, and a record that does not require a forensic project to assemble.
None of this is theoretical, and none of it waits for the technology to mature. The governance work is the same work it has always been: an inventory, an accountable owner per decision, and a record you can hand to a board or a regulator without flinching. The patchwork did not create the need. It just put a date on it, and the first dates have already passed: Maryland's law took effect October 1, 2025, and its first revised quarterly report came due January 30, 2026.
If your team cannot produce an inventory of which AI tools touch a regulated decision, that is the place to start. The Discovery and Clarity Session is a one-hour structural diagnostic on your AI governance exposure.