Fifty rulebooks, for now
The White House wants one national AI rulebook instead of fifty. Physicians should accept it only if it keeps the states' rules on AI in medicine or protects patients at least as well.
Listen to this special topic
read by an AI voiceOn Oct. 6 Britain's government accepted all 44 recommendations that a commission led by doctors of the National Health Service had made on the regulation of AI in health care. It promises a working group so that patients have access to redress when their care falls below what is reasonably expected, and it will consider what patients should be told when AI is used in their care. These are commitments, with details due by next spring, not yet rules.
In America the argument is about who may write such rules at all. The White House has asked Congress to preempt, or override, state AI laws that "impose undue burdens," in favor of "a minimally burdensome national standard," "not fifty discordant ones." Yet the rules that keep a clinician answerable for what AI does in a patient's care, and keep the patient informed, are being written in the states. Physicians should support a national standard only if it leaves those rules in place, as a bipartisan House bill appears to do. They should oppose any preemption of those rules, whether by executive order, agency statement or statute, that comes without a federal floor at least as protective.
An executive order signed last December told the Justice Department to set up a task force to challenge state AI laws. The order also called for legislation preempting state AI laws "that conflict with the policy set forth in this order," while sparing those on child safety, data centers, states' own use of AI and "other topics as shall be determined." Health care is not on that list. In July a bipartisan group of House members introduced the FRONTIER Act, which would bar states from imposing new duties on AI developers over the catastrophic risks of their models: how they disclose those risks, report incidents and submit to outside audits. It leaves states free to regulate how AI systems are used, as long as no duties fall on developers for how models are built, trained, tested or released.
The state rules at stake are specific, and two have been on California's books since 2024. One bars health plans and insurers from letting software deny, delay or modify care on grounds of medical necessity; only a licensed physician or other qualified clinician, weighing the patient's own history, may make that call. Another requires a health facility, clinic or practice whose generative AI communicates with patients about their clinical information to say so and explain how to reach a human, unless a licensed clinician has reviewed the message. Pennsylvania may be next. On Sept. 30 its House passed a bill 144 to 59. It would require health care facilities that use AI in clinical decisions to tell patients so in plain language, keep AI from superseding a clinician's decisions and forbid penalizing a clinician solely for exercising independent judgment.
In a national survey last November, with questions from University of Michigan researchers, more than half of adults wanted to be asked for permission each time AI is used to diagnose them or choose a treatment. A survey records preferences, not effects on health. Federal rules cover part of the ground: Medicare Advantage plans must base coverage on the individual patient, and an algorithm alone cannot be the basis for denying a hospital admission. But for a Californian whose health plan the state regulates, the rule that a physician or other qualified clinician, not software, decides medical necessity comes from the state, as does the label on an AI-written message about her care. Preempt those laws without a replacement and she loses both.
The case for preemption has real force: fifty rulebooks also serve patients badly. A company selling software nationwide could have to satisfy each state's definitions, labels and reviews. An industry group, the Consumer Technology Association, counts more than 240 health AI bills introduced this year across 43 states, and says state privacy laws already create a system "in which patients' rights can change depending on where they live." The case for preemption adds that laws giving clinicians the final say also leave physicians holding the liability for tools that others chose.
Each point has force, and none makes the case for preemption without a standard. If a patient's rights should not depend on where she lives, the remedy is a national floor, not the removal of protections some states already give. The industry group itself calls for "a consistent, risk-based federal AI framework that protects patients," with monitoring after deployment. The liability point is the hardest to answer, and Britain has not answered it either: its working group on who is responsible for what "will not determine or redistribute responsibilities," though work on guidance about indemnity continues. That argues for a national law whose terms physicians help to write, not for giving up the states' rules in the meantime.
Medical societies should put one condition to Congress: no preemption of state rules on the use of AI in medicine unless a federal law first keeps a clinician answerable for the decisions software informs, protects the clinician who overrules it, and requires that patients be told in plain language when AI is used in their care. Those terms matter most because the states' laws and bills already offer them, and because most adults surveyed say they want to be told.
Britain began by asking a commission led by its doctors what the rules for medical AI should say, and accepted every answer. America is being asked to decide first who may write the rules, and to leave what they say about medicine for later. Until Washington offers a rulebook that protects patients at least as well, the fifty it would replace should stand.
- Britain's response to its AI commissionThe UK government published its response to the National Commission into the Regulation of AI in Healthcare on Oct. 6, 2026: "We are accepting all 44 of their recommendations." The MHRA set up the commission in September 2025; Professor Alastair Denniston chairs it, and Professor Henrietta Hughes, Patient Safety Commissioner for England, is deputy chair. The MHRA will work to introduce a public database of reported adverse incidents for medical devices, "including those that are software and AI-enabled" (Recommendation 19). A DHSC working group is to ensure that patients have access to redress "if they receive a standard of care below what is reasonably expected" (25), and DHSC will consider how to clarify transparency expectations where AI is used in patient care (35). A working group on responsibility "will not determine or redistribute responsibilities"; "NHS England and NHSR will continue to progress guidance on indemnity" (24). Their timelines read "Further details to be shared by Spring 2027."
- Executive Order 14365"Ensuring a National Policy Framework for Artificial Intelligence," signed Dec. 11, 2025, and published Dec. 16, 2025 (90 FR 58499), calls for "a minimally burdensome national standard," "not 50 discordant State ones." It directs the attorney general to set up an AI Litigation Task Force to challenge state AI laws inconsistent with its policy; the Commerce Department, within 90 days, to identify onerous state AI laws and issue a policy notice making those states ineligible for non-deployment funds under the Broadband Equity, Access, and Deployment program to the extent federal law allows; and a legislative recommendation preempting state AI laws "that conflict with the policy set forth in this order," but not otherwise lawful state AI laws on child safety protections, AI compute and data center infrastructure (other than generally applicable permitting reforms), state government procurement and use of AI, and "other topics as shall be determined." The attorney general established the task force on Jan. 9, 2026.
- Colorado's law and the FTC's proposed statementOn April 24, 2026, the Justice Department moved to intervene in xAI's lawsuit against Colorado's SB24-205, alleging that it violates the Equal Protection Clause. Colorado's SB 26-189 was signed May 14, 2026. The FTC's proposed policy statement on AI accuracy (posted July 1; Federal Register, July 7, 2026; comments due July 31) cites SB 24-205 as "repealed and reenacted, as amended, by Colo. Sen. Bill 26-189 (enacted May 14, 2026)." It says "The Executive Order directs the Commission to issue this enforcement policy statement"; that "Although the FTC Act does not expressly preempt State law, State law is impliedly preempted to the extent it conflicts with a Federal regulatory scheme"; and that "A State law that requires an AI firm to deceive its consumers obviously conflicts with section 5's express purpose of protecting consumers from such conduct." A footnote says clinicians and patients use AI more and more "to help diagnose illness and injuries."
- The White House's legislative recommendationsThe White House's "National Policy Framework for Artificial Intelligence" legislative recommendations, dated March 2026, say: "Congress should preempt state AI laws that impose undue burdens to ensure a minimally burdensome national standard consistent with these recommendations, not fifty discordant ones." They say "States should not unduly burden Americans' use of AI for activity that would be lawful if performed without AI," that states should not be permitted to regulate AI development, and that "Congress should not create any new federal rulemaking body to regulate AI," relying instead on existing regulatory bodies and industry-led standards. States would keep their police powers to enforce laws of general applicability, including laws to protect children, prevent fraud and protect consumers, as well as zoning for AI infrastructure and rules on their own use of AI. Lawyers at Sheppard Mullin wrote that health AI "would therefore likely be governed by the same federal agencies as today, such as CMS, DOJ, and FDA."
- In CongressOn July 23, 2026, Reps. Jay Obernolte and Lori Trahan, with four other original sponsors of both parties, introduced H.R. 9925, the FRONTIER Act. Section 9(b) bars states from adopting or enforcing requirements that impose "new substantive obligations on artificial intelligence developers" in three areas tied to catastrophic risks: risk transparency, third-party auditing and independent verification, and incident reporting. Section 9(c)(2) keeps state authority to "regulate the use or deployment of AI systems by deployers or users," provided no substantive obligations are imposed on developers concerning model development, training, evaluation or release. TIME reported on Sept. 25, 2026, "according to a person familiar with the matter," that Sens. John Thune and Amy Klobuchar "have discussed proposing a bill" on frontier AI liability, and that "their measure may also preempt some state laws." The GUARD Act (S. 3062), reported by the Senate Judiciary Committee on May 11, 2026, saves state laws "at least as protective of users of artificial intelligence chatbots."
- The state laws at stakeCalifornia's SB 1120 (Chapter 879, approved Sept. 28, 2024): a plan's AI or other software tool "shall not deny, delay, or modify health care services based, in whole or in part, on medical necessity." AB 3030 (Chapter 848, same date): generative AI clinical messages must carry a disclaimer and instructions for reaching a human unless a licensed or certified provider reviewed them. AB 1979 (Chapter 854, Statutes of 2026, approved Sept. 30, 2026): facilities and practices "shall take reasonable steps" so a licensed provider "retains the ability to exercise independent professional judgment" when care is informed "by the output of a clinical decision support system." Pennsylvania's HB 1925 passed the House 144-59 on Sept. 30, 2026 (Democrats 103-0, Republicans 41-59). It would require plain-language disclosure of clinical AI, bar AI from superseding providers' decisions, forbid penalizing independent judgment that differs from AI, and require insurers' reviewing providers to examine records and "exercise judgment independent of any recommendations" by AI.
- What adults said about being toldUniversity of Michigan researchers (the TIERRA team) proposed questions fielded by Verasight in the American Public Health Association's Omnibus Survey, Nov. 14 to 20, 2025: 3,000 U.S. adults, each answering one of three modules, weighted to Current Population Survey demographics, partisanship and 2024 presidential vote; margin of error ±3.2%. For AI used for clinical purposes such as choosing treatments or diagnosing, 54% wanted to be asked permission each time, 32% wanted to be notified each time without giving permission and 14% wanted neither. For clinical notetaking or after-visit summaries the shares were 46%, 38% and 16%; for administrative tasks, 45%, 39% and 16%. The results were posted Jan. 5, 2026, as a fact sheet rather than a journal article.Source: University of Michigan
- Medicare Advantage's rule, and the industry's caseCMS told Medicare Advantage organizations on Feb. 6, 2024, that "An algorithm or software tool can be used to assist MA plans in making coverage determinations," that one deciding coverage from a larger data set instead of the individual patient's history would not comply, and that "algorithms or artificial intelligence alone cannot be used as the basis to deny admission or downgrade to an observation stay." In Fierce Healthcare on Sept. 18, 2026, Kinsey Fabrizio, president and CEO of the Consumer Technology Association, wrote that "more than 240 health AI bills have been introduced across 43 states" this year, that "at least 20 different state laws" on privacy create a system in which patients' rights "can change depending on where they live," and that "Policymakers can create a consistent, risk-based federal AI framework that protects patients."