Regulon.AI — VA-SB-586 · VA SB 586 (Health Carrier AI Disclosures)

2026-01-14 introduced Prefiled and ordered printed; Offered 01-14-2026 26100849D

2026-01-14 committee referral Referred to Committee on Commerce and Labor

2026-02-03 amendment Committee substitute printed 26106800D-S1

2026-02-05 amendment Committee substitute agreed to (Voice Vote)

2026-02-05 amendment Engrossed by Senate committee substitute (Voice Vote)

2026-02-06 chamber passage Read third time and passed Senate (22-Y 18-N 0-A)

2026-02-06 chamber passage Read third time and passed Senate (23-Y 16-N 0-A)

2026-02-12 committee referral Referred to Committee on Communications, Technology and Innovation

Summary

Amends Virginia's existing health carrier fair business practices statute to add AI-specific disclosure and documentation obligations for health insurance carriers. Carriers that use AI to manage insurance claims and coverage must publicly disclose to the Bureau of Insurance the AI's use, including underlying algorithms, data used, and resulting determinations. Carriers must maintain AI decision documentation for at least three years, submit information and software to the Bureau upon request for enforcement purposes, and notify enrollees and providers when AI has been used to issue an adverse determination with a clear and timely appeal process. Enforcement is through the State Corporation Commission, with a private right of action available to providers who suffer actual loss, including potential treble damages for gross negligence and willful conduct.

Enforcement & Penalties

Enforcement Authority

The State Corporation Commission (the Commission) has jurisdiction to determine if a carrier has violated the standards set forth in subsection B, including the new AI disclosure requirements, and may promulgate rules and regulations to implement the section. The Commission does not adjudicate individual controversies. Providers who suffer loss from a carrier's violation may initiate a private action to recover actual damages. Provider complaints to the Commission for failure to pay claims require a prior 30-day conferral period with the carrier.

Penalties

A provider who suffers loss as the result of a carrier's violation is entitled to recover actual damages. If the trier of fact finds the violation resulted from gross negligence and willful conduct, damages may be increased up to three times actual damages sustained. Reasonable attorney fees and court costs may also be awarded. Each claim paid or processed in violation constitutes a separate violation.

Who Is Covered

"Carrier," "enrollee," and "provider" shall have the meanings set forth in § 38.2-3407.10; however, a "carrier" shall also include any person required to be licensed under this title which offers or operates a managed care health insurance plan subject to Chapter 58 (§ 38.2-5800 et seq.) or which provides or arranges for the provision of health care services, health plans, networks or provider panels which are subject to regulation as the business of insurance under this title.

Compliance Obligations 3 obligations · click obligation ID to open requirement page

R-02 Regulatory Disclosure & Submissions · R-02.1 R-02.2 · Deployer · HealthcareFinancial Services

Va. Code § 38.2-3407.15(B)(15)(i)-(ii)

Plain Language

Carriers that use AI to manage insurance claims and coverage must proactively disclose to the Bureau of Insurance details about their AI use, including the underlying algorithms, the data used, and the resulting determinations. In addition, carriers must submit to the Bureau upon request all information — including documents and software — necessary for the Bureau to enforce this provision. The proactive disclosure obligation is ongoing and not limited to a response to a regulatory request, while the second clause creates a separate on-demand production obligation that extends to the software itself.

Statutory Text

Each carrier shall (i) publicly disclose, if applicable, to the Bureau the carrier's use of AI to manage insurance claims and coverage, including in underlying algorithms, data used, and resulting determinations; (ii) submit to the Bureau, upon request, all information, including documents and software, necessary for enforcement of this subdivision;

G-01 AI Governance Program & Documentation · G-01.3 G-01.4 · Deployer · HealthcareFinancial Services

Va. Code § 38.2-3407.15(B)(15)(iii)

Plain Language

Carriers must maintain documentation of all AI-driven decisions related to claims and coverage management for a minimum of three years. This is a recordkeeping obligation — the documentation must be retained in a form that can be produced to the Bureau upon request under subdivision (ii). The three-year retention period runs from the date of the AI decision, creating an ongoing rolling retention window.

Statutory Text

Each carrier shall (iii) maintain documentation of AI decisions for at least three years;

HC-01 Healthcare AI Decision Restrictions · HC-01.6 HC-01.8 · Deployer · HealthcareFinancial Services

Va. Code § 38.2-3407.15(B)(15)(iv)

Plain Language

When a carrier uses AI to issue an adverse determination (e.g., a claim denial, coverage modification, or other unfavorable coverage decision), the carrier must notify both the affected enrollee and the relevant health care provider that AI was used in reaching the adverse determination. The carrier must also provide a clear and timely appeal process for the determination. This creates two distinct obligations: (1) a transparency/disclosure obligation triggered by any adverse AI-assisted determination, and (2) an appeal process obligation ensuring meaningful recourse. The statute does not specify required timeframes for the notice or appeal, which the Commission may address through rulemaking under subsection K.

Statutory Text

Each carrier shall (iv) provide notice to enrollees and health care providers when AI has been used to issue an adverse determination and provide a clear and timely process for appealing the determination.