Back to News
May 26, 2026Blog

The State AI Regulation and What it Means for Health Care

Deon MetelskiDeon Metelski· Chief Product Officer

At actAVA.ai, we’re accelerating how healthcare companies use AI with our AI Factory. KORA, our AI orchestration suite, is a low-code, HIPAA-compliant platform that enables healthcare organizations to deploy specialized AI agents that streamline clinical operations, enhance patient outcomes, and ensure compliance with rigorous security standards. Having your company be HIPAA-compliant and SOC 2-certified is table stakes. We are, of course. But in the age of AI, a more consequential question has emerged: are your agents safe, governed, and accountable in practice, not just on paper?

The State AI Regulation and What it Means for Health Care
At actAVA, we're accelerating how healthcare companies use AI with our AI Factory. KORA, our AI orchestration suite, is a low-code, HIPAA-compliant platform that enables healthcare organizations to deploy specialized AI agents that streamline clinical operations, enhance patient outcomes, and ensure compliance with rigorous security standards. Being HIPAA-compliant and SOC 2-certified is table stakes. We are, of course. But in the age of AI, a more consequential question has emerged: are your agents safe, governed, and accountable in practice, not just on paper?

If there was any doubt that states would move aggressively on artificial intelligence regulation, Q1 2026 erased it. In just the first three months of the year, lawmakers across the country introduced approximately 195 health-applicable AI bills — nearly five times the volume seen in the same period a year ago. Nine of those bills were signed into law. The message is clear: states are not waiting for federal consensus.

This surge reflects a maturing policy conversation. Legislators are no longer asking whether AI in health care needs oversight. They are deciding how to regulate it, which applications to prioritize, and who bears responsibility when things go wrong. The answers vary considerably from state to state — and that fragmentation is itself becoming one of the defining challenges of the moment.

Q1 2026 At a Glance


195
Health-applicable AI bills introduced in Q1 2026
9
Bills enacted into law in the first quarter alone
Increase over the same period in 2025
55
Bills specifically targeting consumer chatbot safety

The Dominant Theme: Protecting Minors from AI Chatbots

No issue generated more legislative activity in Q1 than chatbot safety for minors. Across the country, at least 55 bills targeted consumer chatbots, with a particular focus on companion chatbots — AI systems that simulate ongoing, personalized relationships with users. The concerns driving this legislation are serious. Reports of minors forming intense emotional attachments to AI companions, and in some cases experiencing harm, have galvanized state legislatures.

Enacted Laws — AI Companion & Conversational AI


Oregon · SB 1546 · Effective Jan 1, 2027

AI Companion Safeguards & Minor Protections

Requires operators to detect expressions of suicidal ideation, interrupt conversations when necessary, and refer users to crisis resources like the 988 Suicide & Crisis Lifeline. For users under 18, prohibits sexually explicit content, mandates "take a break" prompts every three hours, and bans engagement-maximizing tactics. Violations carry a statutory penalty of $1,000 per incident.

Washington · HB 2225 · Effective Jan 1, 2027

AI Companion Transparency & Minor Protections

Adds mandatory human/AI disclosure requirements and bans manipulative features — excessive praise designed to foster emotional attachment, solicitation of in-app purchases — when the operator knows or should know the user is under 18. Violations are actionable under Washington's Consumer Protection Act.

Idaho · S 1297 · Effective Jul 1, 2027

Conversational AI Safety Act

Broadly covers any AI that simulates human conversation, requiring clear disclosure of AI identity and crisis referrals for suicidal ideation, while prohibiting AI from falsely claiming to provide licensed mental health services. Civil penalties enforced by the Attorney General; no private right of action.

More bills in this category are likely to follow throughout 2026. This is one area where there appears to be bipartisan agreement and genuine political will to act.

Mental Health AI Gets Specific Attention

Closely related to chatbot safety is a focused legislative effort to regulate AI in mental health and therapy contexts. Illinois set the template in 2025 with its Wellness and Oversight for Psychological Resources Act. At least 15 states introduced similar bills this quarter.

Maine · LD 2082 · Signed April 2026

Therapy Chatbot Ban

Prohibits anyone from offering therapy or psychotherapy services through AI unless the services are provided by a licensed professional. AI is permitted in purely administrative roles but faces a hard line at clinical use.

Tennessee · HB 1470 / SB 1580 · Effective Jul 1, 2026

Prohibition on AI Impersonating Mental Health Professionals

Prohibits developers and deployers of mental health chatbots from advertising or representing their systems as qualified mental health professionals. Violations constitute unfair or deceptive acts under the Tennessee Consumer Protection Act, with civil penalties up to $5,000 per violation.

Emerging Legislative Priorities

Downcoding — A New Frontier
At least eight states introduced bills targeting AI downcoding in Q1 — using automated systems to adjust provider claims downward, resulting in lower reimbursement. This issue moved from niche concern to active legislative priority in a single quarter.
Prior Authorization Oversight
At least 21 states introduced bills targeting AI use in prior authorization decisions. The core principle: AI cannot be the sole basis for denying, delaying, or modifying a patient's access to health care services.
Regulatory Sandboxes
At least four states introduced AI regulatory sandbox proposals — structured programs allowing developers to test AI systems under state supervision in a deregulated environment. Arizona, Illinois, and Connecticut led this counter-current.
The Pattern
Sandboxes reflect a recognition that overly prescriptive rules risk foreclosing beneficial innovation. They signal that some legislators are thinking about how to create responsible pathways for development, not just guardrails against harm.

The Liability Debate: Two Very Different Visions

As AI becomes more embedded in clinical decision-making, the question of legal liability is becoming unavoidable — and states are arriving at very different answers.

Strong Accountability

Missouri SB 1598

Erroneous reliance on AI for diagnosis, treatment, or clinical care would constitute medical malpractice. Places direct liability on providers who follow AI guidance that leads to patient harm.

Safe Harbor

California AB 2575

Creates a safe harbor for licensed professionals relying in good faith on employer-deployed AI, while prohibiting AI developers from using a provider's failure to override output as a defense against patient harm claims.

These two bills represent genuinely competing visions for balancing innovation with accountability and allocating responsibility across the developer-employer-provider chain. This debate will shape how AI is deployed in clinical settings for years to come.

The Compliance Headache: Definitional Fragmentation

Perhaps the most underappreciated challenge emerging from this legislative wave is definitional fragmentation. States are pursuing similar policy goals — particularly chatbot safety — using different, and sometimes incompatible, legal frameworks.

A single product operating nationally could be regulated differently — or not regulated at all — depending on which state framework applies.

This quarter, 27 bills used the term "companion chatbot," defined narrowly around adaptive, humanlike responses and social bonding features. Nine others used "conversational AI service," a broader term covering any AI that simulates human conversation. Both target similar products, but with different scopes and obligations. Similar fragmentation exists around "high-risk AI," which varies significantly in statutory definition across states. For any organization deploying AI at scale, this patchwork creates genuine legal uncertainty and compliance cost.

The State-Federal Tension

All of this activity is unfolding against a backdrop of explicit federal pushback. The Trump administration's National Policy Framework for Artificial Intelligence, released in early 2026, promotes AI deregulation and explicitly includes provisions for state preemption — signaling that the administration would like to limit exactly the kind of legislative activity documented here.

One notable carve-out: the federal framework preserves state authority over minors' use of AI, which aligns with the single most active area of state legislative activity this quarter. The tension's resolution — through federal preemption legislation, court challenges, or negotiated compromise — will be one of the defining policy stories of the next several years. For now, states are moving forward, and organizations operating in health care AI need to track this landscape carefully.

Key Takeaways for Health Care Organizations

  1. Track state-by-state variation. There is no single national framework for health care AI regulation. Organizations must monitor individual state bills, particularly in the states where they operate most heavily.
  2. Prepare for chatbot compliance requirements. If you deploy any AI that involves user interaction — particularly in mental health, wellness, or consumer-facing contexts — new obligations around disclosure, minor protections, and crisis protocols are either already law or likely coming.
  3. Watch the downcoding space. This issue has moved from niche concern to active legislative priority in a single quarter. Payers using AI in claims processing should assess their exposure now.
  4. Don't wait on liability frameworks. The question of who is responsible when AI contributes to a bad clinical outcome is being answered in real time, and the answers vary. Organizations should be reviewing their AI deployment practices with legal counsel in light of emerging state liability bills.
  5. Engage in the definitional debates. The fragmentation of terms like "chatbot," "conversational AI service," and "high-risk AI" is not just an academic problem — it determines whether and how your products are regulated. Industry engagement in these definitional discussions matters.

actAVA KORA — Built for the Regulatory Moment

actAVA is the only AI orchestration engine with an AI Policy Suite and an enterprise AI registry, designed to test and monitor agents. This built-in capability enables organizations to effectively manage the legal and ethical risks associated with their agents while ensuring compliance with more than 250 AI laws and standards across 30+ countries.

The pace of state AI regulation in health care is only accelerating. Q1 2026 made that unmistakably clear. Trust actAVA AI to securely power your healthcare transformation.


Stay Ahead of the Regulatory Curve

KORA|RED — Governed, tested, and accountable agents for healthcare.

Visit actAVA.ai →

This blog post draws on publicly available legislative information from Q1 2026.