AI in utilization review: Colorado's 2027 human-review rules.

Who is in scope?

The enacted summary names health-insurance carriers, pharmacy benefit managers, private utilization-review organisations, behavioural-health administrative services organisations and managed-care entities. Scope should be mapped by legal entity, line of business, payer program, decision type and regulator rather than by technology platform alone.

The required decision inputs

The AI-assisted determination must use the person's medical or clinical history, individual clinical circumstances and other relevant clinical factors in the record. It cannot rely solely on group data without reference to the individual's data. Operationally, that means documenting:

• the clinical and benefit-plan inputs available to the system;
• missing-data and stale-data handling;
• how group evidence is combined with the individual's circumstances;
• the output delivered to the reviewer; and
• conditions that force manual handling or escalation.

Human review of adverse decisions

A denial of coverage based in whole or in part on medical necessity cannot be issued solely from an AI output. It requires review by a licensed clinician, physician or other competent regulated professional able to assess the clinical issue and the benefit plan's coverage terms.

The human-review control should define competence, independence, information access, decision authority and evidence. A checkbox reading “human in the loop” is not enough. Retain who reviewed the case, which patient-specific information was considered, whether the AI recommendation changed, the final rationale and the timing.

Fairness, validation and data use

The system must not be used in a way that unlawfully discriminates and must be fairly and equitably applied. It must also be reviewed periodically for accurate and reliable outcomes, and individual health data must not be used beyond its intended or stated purpose.

A practical monitoring pack should stratify approvals, denials, reversals and review times by relevant populations and decision categories; track drift and override patterns; test data completeness; and record remediation. The analysis still needs qualified statistical, clinical, legal and privacy review.

Regulator disclosure and audit information

Covered entities must disclose to the Division of Insurance, Department of Human Services or Department of Health Care Policy and Financing, as applicable:

• which utilization-review functions use AI;
• where AI is used in the process;
• how adverse coverage determinations receive human oversight; and
• how audit information is maintained.

Build this from the operating inventory. A filing assembled separately from the production workflow will become inaccurate as models, vendors and process stages change.

Psychotherapy coverage boundary

The act separately prohibits carriers and specified public-program payers from paying for psychotherapy services delivered directly to a client and conducted by an AI system. Keep this prohibition distinct from AI used for administrative support, clinician tools or utilization review; those uses need their own analysis.

Implementation checklist

1. Inventory Colorado utilization-review decisions and the AI role in each stage.
2. Confirm the individual clinical inputs and missing-data rules.
3. Identify every path that can produce a medical-necessity denial or delay.
4. Assign a competent regulated reviewer and preserve decision evidence.
5. Establish outcome, fairness, drift and data-purpose monitoring.
6. Build the regulator disclosure directly from the controlled inventory.
7. Separate prohibited AI-conducted psychotherapy from permitted support uses.

How Sia RegAI can support the workflow

RegReview can monitor the enacted act, agency rules and insurance guidance and route changes to utilization-management, clinical, privacy and model-risk owners. RegMatcher can map each requirement to the decision inventory, clinical-input controls, reviewer procedures, validation tests, filings and audit evidence. It supports the evidence chain; it does not make medical-necessity decisions or replace the qualified reviewer.

Primary source

• Colorado General Assembly — HB26-1139, enacted summary and signed act

This analysis is general information, not legal or clinical advice. Review the signed act, applicable agency rules and the facts of the specific utilization-review process.