Three states just turned the AI governance gap from a future problem into a current, measurable exposure. The federal floor everyone was waiting for is arriving one statehouse at a time.
On June 1, Maryland became the first state in the country to require insurers to report AI-generated claim denials to a regulator every quarter. On July 1, Indiana's restriction on letting AI make the final call on a coverage decision takes effect. On January 1, 2027, Colorado's reworked AI law lands, alongside two more Colorado bills targeting AI in utilization review and mental health care.
Three states. Three different definitions. Three different compliance clocks. And every health system operating across state lines now has to answer to all of them at once.
"Do we really need a governance framework, or can we wait for the federal rules?"
The patchwork is the answer. There is no single federal floor coming fast enough to wait for. The states are moving, they are not coordinating, and the obligations are already live. Waiting is itself a decision, and right now it is the wrong one.
Stripped of the legal language, the obligations converge on three things a health system has to be able to do.
"The governance gap is not a future problem. It is a current exposure, and the states just made it measurable."
The first wave of AI regulation asked health systems to disclose that they used AI. This wave asks them to account for what the AI decided. That is a different operating burden. Disclosure is a checkbox. Accountability is a workflow: an owner, an audit trail, and the ability to reconstruct why a model produced a given output when a regulator asks six months later.
The systems that will struggle are the ones treating governance as a document that lives in a binder. The systems that will be fine are the ones that already built governance as a function: a registry that updates when a new tool is procured, an accountable owner per decision class, and a record that does not require a forensic project to assemble.
None of this is theoretical, and none of it waits for the technology to mature. The governance work is the same work it has always been: an inventory, an accountable owner per decision, and a record you can hand to a board or a regulator without flinching. The patchwork did not create the need. It just put a date on it, and the first date already passed on June 1.
If your team cannot produce an inventory of which AI tools touch a regulated decision, that is the place to start. The Discovery and Clarity Session is a one-hour structural diagnostic on your AI governance exposure.