New York · Assembly Bill · 2025-2026 Regular Sessions
AB3991
New York Assembly Bill 3991 — An Act to amend the insurance law, in relation to requirements for the usage of artificial intelligence in utilization review and management

Status ● Introduced Effective N/A Passage Likelihood L

WHAT THIS BILL REGULATES · 2 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority
Enforced through the New York Department of Financial Services as part of the Insurance Law regulatory framework. No private right of action is created by this bill. Enforcement is agency-initiated through the Superintendent of Insurance's existing authority over health care service plans.
Private Right of Action
No private right of action. Enforcement is exclusive to the designated authority.
Penalties
The bill does not specify monetary penalties, damages, or remedies. Enforcement would fall under the existing Insurance Law regulatory and administrative penalty framework administered by the Superintendent of Insurance.

What This Bill Requires

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text
Analysis & Obligations
Insurance Law § 107(a)(56)
Definition of artificial intelligence

(56) "Artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.Insurance Law § 107(a)(56)" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.

Section 1 of the bill adds a new paragraph 56 to Insurance Law § 107(a), defining artificial intelligence for purposes of the Insurance Law. The definition is broad and technology-neutral, covering any engineered or machine-based system that varies in autonomy and infers from inputs how to generate outputs influencing physical or virtual environments. This definition closely tracks the NIST AI RMF and federal Executive Order 14110 language.

Insurance Law § 3224-e
Requirements for usage of artificial intelligence in utilization review and management
Deployer

(a)(1) 1 The artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.Insurance Law § 107(a)(56), algorithm, or other software tool bases its determination on the following information, as applicable: (i) An enrollee's medical or dental history; (ii) Individual clinical circumstances as presented by the requesting provider; and (iii) Other relevant clinical information contained in the enrollee's medical or dental record.

(a)(2) 2 The artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.Insurance Law § 107(a)(56), algorithm, or other software tool does not supplant health care provider decision making.

(a)(3)–(4) 3 The use of the artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.Insurance Law § 107(a)(56), algorithm, or other software tool does not adversely discriminate, directly or indirectly, against an individual on the basis of race, color, religion, national origin, ancestry, age, sex, gender, gender identity, gender expression, sexual orientation, present or predicted disability, expected length of life, degree of medical dependency, quality of life, or other health conditions. (4) The artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.Insurance Law § 107(a)(56), algorithm, or other software tool is fairly and equitably applied.

(a)(5) 4 The artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.Insurance Law § 107(a)(56), algorithm, or other software tool is open to inspection.

(a)(6) 5 Disclosures pertaining to the use and oversight of the artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.Insurance Law § 107(a)(56), algorithm, or other software tool are contained in the written policies and procedures.

(a)(7) 6 The artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.Insurance Law § 107(a)(56), algorithm, or other software tool's performance, use, and outcomes are periodically reviewed and revised to maximize accuracy and reliability.

(a)(8) 7 Patient data is not used beyond its intended and stated purpose, consistent with applicable state laws and the federal Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191).

(a)(9) 8 The artificial intelligenceArtificial intelligence"Artificial intelligence" means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.Insurance Law § 107(a)(56), algorithm, or other software tool does not directly or indirectly cause harm to the enrollee.

(b) 9 Notwithstanding subsection (a) of this section, a denial, delay, or modification of health care services based on medical necessity shall be made by a licensed physician or other health care provider competent to evaluate the specific clinical issues involved in the health care services requested by the provider by considering the requesting provider's recommendation and based on recommendation, the enrollee's medical or dental history, as applicable, and individual clinical circumstances.

Section 3224-e is the operative core of the bill. Subsection (a) imposes nine enumerated requirements on any health care service plan or specialized health care service plan that uses AI, an algorithm, or other software tool for utilization review or utilization management, including plans that contract with third-party entities performing those functions. The requirements span individualized clinical data use, prohibition on supplanting provider decision-making, non-discrimination, equitable application, openness to inspection, written policy disclosures, periodic performance review, patient data purpose limitation, and a general do-no-harm standard.

Subsection (b) separately requires that any denial, delay, or modification of services based on medical necessity must be made by a licensed physician or competent health care provider who considers the requesting provider's recommendation and the enrollee's individual clinical circumstances. This effectively prohibits AI from serving as the sole or final decision-maker on adverse medical necessity determinations.

Compliance actions 9 items
1
Health care service plans and specialized health care service plans must ensure that any AI, algorithm, or other software tool used for utilization review or utilization management bases its determinations on individualized enrollee clinical data, including: (1) the enrollee's medical or dental history, (2) individual clinical circumstances as presented by the requesting provider, and (3) other relevant clinical information contained in the enrollee's medical or dental record.
HC-01.3
2
Health care service plans must ensure that AI, algorithms, or other software tools used in utilization review or utilization management do not supplant health care provider decision making.
HC-01.1
3
Health care service plans must ensure that AI, algorithms, or other software tools used in utilization review or utilization management do not adversely discriminate, directly or indirectly, against any individual on the basis of race, color, religion, national origin, ancestry, age, sex, gender, gender identity, gender expression, sexual orientation, present or predicted disability, expected length of life, degree of medical dependency, quality of life, or other health conditions. The tools must be fairly and equitably applied.
H-02.1
4
Health care service plans must ensure that any AI, algorithm, or other software tool used in utilization review or utilization management is open to inspection.
HC-01.7
5
Health care service plans must include disclosures pertaining to the use and oversight of AI, algorithms, or other software tools used in utilization review or utilization management in their written policies and procedures.
HC-01.7
6
Health care service plans must periodically review and revise the performance, use, and outcomes of any AI, algorithm, or other software tool used in utilization review or utilization management to maximize accuracy and reliability.
HC-01.4
7
Health care service plans must ensure that patient data used by AI, algorithms, or other software tools in utilization review or utilization management is not used beyond its intended and stated purpose, consistent with applicable state laws and the federal Health Insurance Portability and Accountability Act of 1996.
HC-01.5
8
Health care service plans must ensure that any AI, algorithm, or other software tool used in utilization review or utilization management does not directly or indirectly cause harm to the enrollee.
9
Any denial, delay, or modification of health care services based on medical necessity must be made by a licensed physician or other health care provider competent to evaluate the specific clinical issues involved. The reviewing professional must consider the requesting provider's recommendation and base the determination on the enrollee's medical or dental history and individual clinical circumstances.
HC-01.1
§ 3 (Effective Date)
Effective date

This act shall take effect immediately.

Section 3 provides that the act takes effect immediately upon enactment. There is no delayed implementation period or phased compliance timeline.

Passage Likelihood

Low
Status Introduced
Chamber No passage
Committee No action
Majority party Yes
Bipartisan No
Prior session None

Legislative History

2025-01-30 referred to insurance
2026-01-07 referred to insurance

Entry Last Reviewed

2026-05-20
AI generated