From the State Government edition of September 8, 2026
Utah regulator keeps human review and acknowledges missing robust benefit evidence
Utah Office of Artificial Intelligence Policy · State regulatory oversight of a private healthcare AI pilot · Utah, United States
- Publisher
- Doctronic AI Regulatory Mitigation Agreement
- Original publication
- Undated status page inspected September 9, 2026 UTC
- Source retrieved
- 2026-09-09
What happened
The public status page describes Phase 1 physician authorization and says robust benefit evidence is not yet available.
Why it matters
State regulatory operating-model evidence; this is not a state-owned clinical deployment or an endorsement of the product.
Evidence and measured results
The page reports two company reports received and no serious incidents reported to the office. It describes adversarial vulnerabilities and changes to phase-transition criteria. These are regulator statements, not an independent safety finding.
Limitations and uncertainty
Undated relative timing cannot establish September operating status. Supporting May report relies on company physicians; independent review was initiated, not reported complete. That report's 'five months' heading conflicts with January–April wording; no duration or clinical accuracy percentage adopted.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-09-09; this does not change the original publication date. Labels below come from the analysis itself.
Sales
Role takeaway
For regulatory agencies, focus on the problem of supervising a bounded pilot while evidence is still developing. Engage the program director, relevant licensing specialists, privacy staff and evaluation leads. Ask which results are company-reported, who can inspect underlying interactions and what would stop expansion. A bounded engagement could design the oversight evidence register and reporting process. The value hypothesis is clearer decisions and traceability, not demonstrated patient benefit or reduced clinical labor. Do not present regulatory relief as a product endorsement or claim that absence of reported incidents proves safety.
Pre-sales engineering
Role takeaway
Fit is an assurance layer around actions with a defined human review boundary. Map identity verification, proposed action, reviewer approval, escalation and downstream execution as separately testable steps. Prerequisites include authorized access to representative records, domain-specific reviewers and a documented phase policy. Test bypass attempts, conflicting information, unavailable reviewers and disclosure failures. A proposed proof of value should demonstrate that prohibited actions cannot reach downstream systems and that escalation is usable. The public page provides neither implementation details nor independent adversarial results; it cannot establish a particular model's reliability or justify unsupervised authority.
Delivery
Role takeaway
Build a versioned evidence register, reporting schedule and escalation playbook before changing pilot permissions. The regulator owns continuation decisions; the company owns service operation; qualified reviewers assess cases. Dependencies include access to reviewable data, privacy decisions and evaluator capacity.
- Proposed acceptance criteria
- every sampled action traces to required approval, all report fields reconcile to records, and phase changes have written authorization and resolved critical findings. Train support staff to route complaints and preserve evidence. Risks include stale public status, altered measurement scope, weak independent review and confusing reported non-events with verified absence of harm.
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Enforce review and escalation in the execution path, rather than in instructions to a model alone.
Governance
Who approves, reviews and stays accountable for outcomes?
Retain explicit approval for any increase in automation authority and document changes to evaluation scope.
Security and privacy
What data, permissions and controls need testing?
Separately validate identity checks, disclosure protection, adversarial behavior and access to sensitive records.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Validate escalation access, language quality and patient comprehension; anecdotal convenience is not an access outcome.
Procurement
What should contracts, pricing and exit terms secure?
A regulatory agreement is not a state procurement or a general authorization; buyers need their own diligence.
Operating model
Which teams own the service once it runs?
Keep regulator, company clinical owner and independent evaluator responsibilities distinguishable.
What changed
Original and redirected URLs absent from the full archive; targeted Doctronic search returned zero. Newly added historical oversight evidence; undated page is not presented as a September update.
Publication history
- 2026-09-08State Government · Issue 034 resources
Stable resource ID: utah-doctronic-regulatory-status-evidence-limits