From the State Government edition of October 16, 2026
Nextgov/FCW (Oct 16): Utah's AI policy office says its sandbox still lacks a liability framework, requires pilot companies to carry liability insurance, and plans a vendor-liability bill as health pilots expand
Utah Office of Artificial Intelligence Policy (Department of Commerce), with the Division of Professional Licensing; reported by Nextgov/FCW · State regulatory sandbox and oversight of AI in licensed health care · Utah
- Publisher
- Nextgov/FCW
- Original publication
- 2026-10-16
- Source retrieved
- 2026-10-17
- Event date
- 2026-10-15
What happened
Nextgov reports remarks by Utah OAIP director Zach Boyd at the ADAPT conference on Thursday, Oct 15, plus an interview. Boyd says Utah has evidentiary standards, is working on governance guidance, and is drafting a liability bill he hopes to unveil this month or next during the interim session, starting a 'multi-year process.' Regulators read the sandbox law as giving no authority to change liability rules, so OAIP requires Doctronic and later participants to carry special liability insurance and not waive liability. Boyd calls insurance less sustainable long term and wants vendors held directly liable, expecting physicians would otherwise bear too much. The Utah Medical Licensing Board, which sought suspension of the Doctronic pilot in April, now meets weekly with regulators; the 190-drug refill list dropped Butalbital and Flecainide. Future pilots must contract with one of six independent evaluators, and an evaluator CEO expects assessments to be repeated as models change. Utah's public pilot register, opened as a cross-check, says Doctronic is still in Phase 1, with a licensed practitioner authorizing every request.
Why it matters
New, current evidence on a question state regulators and agency counsel now face: who carries liability when a state-authorized AI system acts. Utah is the most cited state sandbox, and tonight's material adds the stopgap (mandatory insurance, no liability waivers), a planned statute, and a frank admission that its technical expectations are immature. Relevance to non-health state agencies is in the oversight model (phased human review, monthly agreement-rate reporting, statutory audit, independent evaluation), not the clinical use cases.
Evidence and measured results
Opened the Nextgov article over HTTPS and read it in full (dateline Oct 16, 2026 3:50 PM ET). For cross-checking, opened Utah's AI Authorized Pilots register at commerce.utah.gov. The register confirms Doctronic remains in Phase 1, with every request authorized by a licensed practitioner, and that a 2026 amendment tightened the Phase 2 threshold and removed two medications. It lists the Doctronic term as Oct 24, 2025 to Oct 24, 2026 and new agreements (August AI refills, Nolla Health topical acne prescriptions, Expect Fitness physical therapy plans) with phased human review. It also states monthly reporting of AI-clinician agreement rates, a statutory audit duty, and an annual report to the Business and Labor Interim Committee before Nov 30.
Limitations and uncertainty
Statements are a regulator's conference remarks and interview, not published outcomes; no agreement rates, adverse-event counts or evaluator results are reported. The liability bill has not been released. The pilot launches and the evaluator network were archived Oct 5; tonight's new material is the liability approach, the bill timeline, the licensing-board working group and the drug-list change. The 190-drug figure comes from Nextgov citing OAIP and does not appear on the register page. The register page carries no visible update date. Health care sits partly outside this stream; the oversight model is the transferable element.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-16; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- States authorizing or buying AI that acts on residents lack a settled way to allocate liability, evaluate claims and decide when human review can be reduced.
- Stakeholders
- State AI policy or innovation office
- Agency general counsel and attorney general's office
- Professional licensing boards
- Risk management and insurance office
- Legislative interim committees
- Discovery questions
- Who is liable today if an AI system your agency authorizes or buys harms a resident?
- Do your AI agreements require insurance and prohibit liability waivers?
- What evidence must a pilot produce before human review is reduced?
- Who evaluates vendor claims independently, and who pays for it?
- Value hypothesis
- A structured review of AI agreements and phase gates may help a state reduce unallocated liability and make advancement decisions on reported evidence rather than vendor assurances; benefit size is unknown.
- Potential engagement
- Fixed-scope review of one to three AI pilot or procurement agreements against Utah-style controls (insurance, waiver prohibition, phase gates, agreement-rate reporting, independent evaluation), with a gap memo for counsel.
- Unsupported claims
- That Utah's sandbox has proven AI prescribing or refills safe
- Any cost savings or access gains from the pilots
- That insurance requirements resolve liability
- That independent evaluators have produced results
Pre-sales engineering
Role takeaway
- Fit
- Agencies or regulators where AI would take or recommend actions in licensed, benefit or rights-affecting workflows and must remain auditable.
- Architecture and integration
- Build verification against systems of record before any AI action, rule-based stop conditions that route to humans, logging of AI and reviewer decisions for agreement-rate reporting, and an adverse-event feed to the overseeing office.
- Prerequisites
- Defined list of permitted actions and exclusions
- Access to authoritative records for verification
- Reviewer staffing for initial full-review phase
- Agreed reporting schema with the regulator
- Constraints
- Sandbox relief covers named code sections only, not liability
- Possible federal FDA premarket requirements for clinical software
- Utah statute caps demonstration terms at 12 months with up to two extensions
- State-specific licensing rules limit transferability
- Security
- Require third-party adversarial testing before launch, ban data sale and advertising use, keep HIPAA-grade controls where health data is involved, and verify identity before any action.
- Proof of value
- Measure AI-reviewer agreement rates during full human review before proposing any reduction
- Demonstrate stop rules route every flagged case to a human in testing
- Show adverse events can be reported within 24 hours end to end
- Have an independent evaluator re-run assessment after any model change
Delivery
Role takeaway
- Work
- Design and run the oversight lifecycle for an AI pilot: agreement controls, phase-gate criteria, reviewer operations, reporting, independent evaluation, and public posting of objections and responses.
- Dependencies
- Authorizing statute or policy
- Counsel decision on liability and insurance terms
- Independent evaluator contract
- Licensing board or program owner engagement
- Ownership
- The authorizing regulator or agency AI office owns oversight; the vendor or provider owns operation within the agreed protocol; the relevant board or program office is consulted on each phase.
- Skills and adoption
- Train reviewers on stop rules and on recording disagreement with the AI; train regulator staff to interpret agreement-rate and adverse-event data.
- Governance checkpoints
- Written approval before each phase advance
- Monthly numeric report review
- Annual legislative report
- Re-evaluation after model or population change
- Acceptance criteria
- Proposed: agreed agreement-rate threshold met over a defined case count before review is reduced
- Proposed: 100% of flagged cases routed to humans in audit samples
- Proposed: adverse events reported within 24 hours in all sampled cases
- Risks
- Liability remains unallocated until statute passes
- Evaluator independence or funding questioned
- Federal jurisdiction overrides state relief
- Reviewer workload and liability concentrated on clinicians
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
No architecture details are given. The register's controls imply integration requirements for any AI that acts in a regulated workflow: identity and prescription verification against pharmacy records, hard stop rules that route to clinicians, adverse-event reporting within 24 hours, and data feeds to a regulator dashboard and monthly reports.
Governance
Who approves, reviews and stays accountable for outcomes?
Utah separates regulatory relief (enforcement forbearance on named code sections) from liability, which the sandbox cannot change; it is filling the gap with insurance and contract terms until a statute exists. Phase advancement requires written approval from the office, and objections from professional boards are published with the office's response. Boyd's remark that half of the health AI expectations document 'is probably wrong' signals that standards are provisional.
Security and privacy
What data, permissions and controls need testing?
Register terms ban selling patient data and advertising against it and require third-party adversarial testing for Doctronic and HIPAA-compliant systems for some pilots. The article does not report security testing results or incidents.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Clinician review workload is built into each phase, for example review of the first 250 refills before they reach patients and then the next 1,000 in some agreements, so staffing for oversight is a real cost. The article raises concern that physicians supervising AI may carry disproportionate liability.
Procurement
What should contracts, pricing and exit terms secure?
States that contract for or authorize AI acting on residents may need insurance requirements, prohibitions on liability waivers and independent evaluation clauses in agreements, as Utah does, until statutes allocate vendor liability.
Operating model
Which teams own the service once it runs?
The regulator runs a learning loop of phased approvals, monthly numeric reporting, weekly engagement with the objecting licensing board and an annual legislative report. That loop requires dedicated regulator capacity beyond the original agreement.
Publication history
- 2026-10-16State Government · Issue 392 resources
Stable resource ID: utah-ai-sandbox-liability-insurance-evaluators-nextgov-20261016