An authorized representative attests.
Whose independent evidence is behind the signature?
In 2026, state law began moving the duty to stand behind AI outcomes from the vendor’s marketing page to the plan’s regulatory filing. Prior authorization and utilization management are the focal point. The vendor wrote the accuracy claims. The plan signs for them.
What 2026 state law actually says
Four statutes, four different mechanisms — and one common thread: the plan, not the vendor, answers for the AI’s outcomes.
Alabama · SB 63
Effective Oct 1, 2026
The AI certification rides the existing annual utilization-review filing, due on or before July 1 each year, attested by an “authorized representative.” The statute permits the attestation to rest on reasonable reliance on internal policies and third-party vendors. The open question: what makes that reliance reasonable if the Department of Insurance inquires.
Colorado · HB 26-1139
Effective Jan 1, 2027
AI outcomes must be “periodically reviewed to maximize accuracy and reliability,” with records “sufficient to demonstrate compliance.” A periodic review with records means someone has to run the review and keep the evidence — and be able to say who ran it.
Washington · SB 5395
Effective Jun 11, 2026
AI cannot be the sole basis for a medical-necessity denial — and plans must report the percentage of denials aided by AI. Reporting a percentage presumes the plan can measure, reliably, where AI touched the decision.
Iowa · HF 2635
Effective Jul 1, 2026
AI cannot be the sole basis for a medical-necessity denial. Demonstrating that a human judgment — not the algorithm alone — carried each denial is an evidence question, not a policy question.
None of these statutes ask whether the vendor’s dashboard is impressive. They ask what the plan can show.
The examination layer is arriving on schedule
The NAIC’s AI Risk Evaluation Supplement v5.0 is out for public comment (comments due September 29, 2026), with an adoption vote expected at the Fall National Meeting in November 2026. Once adopted, AI reviews fold into standard market-conduct and financial examinations — not a separate, special event.
Routine exams, not one-off inquiries
When AI questions live inside the standard exam, the evidence has to exist before the exam letter arrives. Assembling it afterward is the expensive way.
Accountability does not transfer to the vendor
The NAIC’s work on third-party data and models has established this plainly: buying the AI from someone else does not move the obligation to someone else. The plan answers.
The Attestation Reliance File
An independent, desk-based verification of the vendor’s accuracy-monitoring claims against the elements of the statute — delivered as the basis memo for the attestation. When the authorized representative signs, this file is what the signature rests on.
01 · Claims, itemized
The vendor’s specific accuracy and monitoring representations — from the contract, the SLA, the security review, the sales material — extracted and mapped to the statute’s elements, one by one.
02 · Claims, checked
Each claim verified against evidence the plan already holds — reports the vendor has delivered, logs the plan already receives, contractual monitoring artifacts. Desk-based. No system access. No PHI or raw-data handoff.
03 · The basis memo
A written verdict on what is substantiated, what is unsubstantiated, and what evidence would close each gap — the documented answer to “why was reliance on this vendor reasonable?”
Engagement through the plan’s outside counsel is available, with findings delivered under privilege. See an illustrative sample of the report format →
Why the evidence has to come from outside
A vendor attesting to its own accuracy is a marketing document. A plan attesting on the vendor’s say-so is a signature without a basis. The file behind the attestation carries more weight when it is produced by a party with no stake in the answer.
Buyer-paid, not issuer-paid
The plan pays for the verdict. Our fee is the same whether the answer is yes or no.
No build, no operate
We do not build, sell, or integrate AI, and hold no stake in any vendor we examine. There is nothing for us to defend by softening a result.
Reproducible verdict
A method, not an opinion — re-runnable by your team, your counsel, or your examiner.
First-Verdict Diagnostic — $9,500 fixed
One named AI deployment. One pre-agreed numeric criterion, fixed in writing before evidence review. 30–45 days, desk-based — we verify the claims against evidence you already hold. No system access. No PHI or raw-data handoff.
Through counsel, if preferred
Engagement through the plan’s outside counsel is available, with findings delivered under privilege.
Fee credited in full
The diagnostic fee is credited in full toward an annual verification agreement if you continue.
Federal buyers: $14,500 fixed — under the $15,000 micro-purchase threshold. Federal page →