Why the AI preemption order barely reached health care’s own AI rules
The December 2025 executive order aimed federal pressure at broad state AI laws. Most of the AI rules health systems actually follow sit in licensing, insurance and privacy law, where preemption arguments are weakest, so the order’s main risk lay with vendors.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On December 11, 2025, the President signed an executive order titled Ensuring a National Policy Framework for Artificial Intelligence. It directed the Attorney General to set up an AI Litigation Task Force within 30 days to challenge state AI laws inconsistent with the order’s policy, including on interstate commerce and preemption grounds. It told the Secretary of Commerce to publish, within 90 days, an evaluation identifying onerous state AI laws. It tied some remaining federal broadband funds to states’ AI laws, asked the FCC and FTC to consider federal actions, and called for a legislative proposal for a national framework. That proposal was not to preempt state laws on child safety, AI compute and data center infrastructure, or states’ own procurement and use of AI. The order followed the Senate’s rejection of a state-law moratorium in July.
Earlier in this series, we argued that the Senate’s July 2025 vote made state law the working baseline for AI compliance. The December order was an attempt to change that. For health systems, the useful question was narrower than whether the order would succeed. It was which of their AI obligations it could plausibly reach. Sorted by legal footing, health care’s AI rules fall into three groups: broad AI governance laws, state rules on medical practice and insurance, and privacy and consumer protection laws that touch AI incidentally. The order’s reach falls off sharply from the first group to the third.
Broad AI governance laws
Cross-sector AI laws were the order’s clearest target. Colorado’s AI Act was the leading example. It treated decisions about health care services as consequential decisions and imposed risk management, impact assessment and notice duties on developers and deployers of high-risk systems. Its effective date had already been pushed to June 30, 2026.
These laws are exposed for structural reasons. They regulate AI as a technology across industries, which invites commerce clause arguments. They impose duties on model developers who sell nationally, which is where the order’s concern about a patchwork was aimed. And they were new, without a long line of state practice behind them.
For a health system, the exposure is mostly indirect. Under a law like Colorado’s, much of the documentation burden falls on the developer, and the deployer relies on what the developer supplies. If such a law is narrowed or enjoined, vendors may slow work on the impact documentation, bias testing summaries and model cards they were preparing. That is the order’s most direct operational effect on providers.
The response is contractual. Health systems buying AI tools should require that documentation regardless of what any state law requires: intended use, training data provenance, known limitations, performance by relevant subgroup and update notices. Those terms protect clinical safety and support accreditation. They should not depend on how one statute fares in court.
State rules on medical practice and insurance
The second group regulates how care is delivered and paid for. California requires a disclaimer when generative AI is used to communicate clinical information to patients without review by a licensed provider, and a route to reach a human. It also requires that medical necessity decisions in utilization review be made by a licensed physician or qualified health professional, not by an algorithm alone. Illinois restricted the use of AI to deliver therapy. Texas’s 2025 AI law, effective January 2026, requires providers to tell patients when AI is used in their care.
These rules sit inside powers states have exercised for generations: licensing professionals, regulating insurers and protecting patients. Insurance regulation in particular has a federal statute, the McCarran-Ferguson Act, that generally leaves it to the states. A preemption argument against a rule that says a physician must make a coverage decision is far harder than one against a general algorithmic discrimination law. An executive order cannot preempt anything by itself; that requires Congress, a valid federal regulation or a court ruling.
Federal policy also points the same way in places. CMS rules for Medicare Advantage require medical necessity determinations based on the individual patient’s circumstances, and CMS guidance said algorithms may assist but not replace that judgment. A health system or health plan building human review into utilization management is meeting state and federal expectations at once.
The work here is operational. Patient portals and messaging tools need disclosure language and a visible route to a person. Utilization review workflows need evidence that a qualified reviewer made each adverse decision. Behavioral health services need a clear boundary between AI-supported administrative tasks and therapy itself.
These duties also land on different owners. Disclosure in patient messaging belongs to whoever runs the portal and the clinical communications program. Utilization review sits with health plan operations or, for providers, with the teams that respond to denials. Disclosure at the point of care in Texas reaches individual clinicians and their documentation. An AI governance committee that only approves tools will miss most of this. It needs a named operational owner for each duty and a way to show, on request, that the duty was met.
Privacy and consumer protection laws
The third group applies to AI because AI processes personal data. State comprehensive privacy laws give consumers rights over profiling and automated decisions in some contexts. Several states protect consumer health data outside HIPAA. State unfair and deceptive practices statutes reach misleading claims about what an AI tool does.
An AI-specific federal policy is least likely to displace these. They are general laws of long standing, and attacking them would mean attacking state privacy and consumer protection law as a whole. For health systems, many already carry HIPAA-related exemptions, so the exposure sits mostly in marketing, consumer apps and websites outside the covered entity’s clinical records.
Read in this order, the three groups suggest a simple program design. Map each AI use to the laws that apply by legal footing, not by whether the statute mentions AI. Treat the first group as uncertain and cover it through vendor contracts. Treat the second and third as stable and build to them. That posture does not depend on predicting how the preemption fight ends.
With hindsight
The Justice Department set up its AI Litigation Task Force in January 2026. Its most visible move followed in April, when the department joined a lawsuit by xAI challenging Colorado’s AI Act. In May, Colorado repealed and replaced that law with a narrower, disclosure-based framework due to start in 2027, and enforcement was paused while the litigation and rulemaking continued. The broad, cross-sector law was where the pressure landed.
State rules on clinical communication, utilization review and AI therapy stayed on the books, and we are not aware of a court ruling that displaced them. For health systems, that confirmed the sorting. The obligations that bind daily operations were the hardest to preempt. The real uncertainty sat with vendors, whose documentation duties under broad laws became a moving target. Health systems that wrote documentation requirements into their contracts were insulated from that. Those that relied on statutes to make vendors comply were not.