For the last two years, the conversation about AI in health care has been a conversation about potential. The models are getting better. The pilot studies are promising. The FDA might someday issue a framework. Meanwhile, inside hospitals and insurers and a handful of venture backed startups, the actual clinical footprint of generative AI remained narrow. There were scribes that transcribed notes. There were triage chatbots that routed calls. There were radiology assistants that flagged scans. None of it lived inside the part of medicine that actually decides what happens to a patient. That line is the one the states are now drawing on directly, and they are drawing it in two opposite directions in the same month.
Utah drew its line on January 6, 2026, when the state's Office of AI Policy, working with the Department of Commerce and a New York based clinical AI startup called Doctronic, launched the first state sanctioned program in the country that permits an AI system to approve prescription refills for a defined list of 190 common medications. The list reads like the back half of a cardiology and internal medicine formulary. Statins for high cholesterol. First line and second line antihypertensives for blood pressure. A set of psychiatric medications that includes common SSRIs and other maintenance drugs. Hormonal birth control. What the list excludes is almost as interesting as what it contains. Controlled substances are off the table. ADHD stimulants are off the table. Injectables are off the table. Everything the DEA schedules is off the table. The list is, in short, the population of medications where the clinical risk of the refill decision is dominated by the question of whether the patient is still the same patient, not whether the drug is still the right drug. Utah has made a bet that an AI system reading the chart can answer that question at a quality bar good enough to put a doctor's signature on the refill.
Five days ago, in a state legislature three time zones east of Salt Lake City, the Maine Senate sent LD 2082 to Governor Mills. The bill is brief. It says that an AI system may not provide clinical mental health therapy services to residents of the state, and that AI tools may only be used in an administrative or supportive role, meaning scheduling, documentation, intake questionnaires, and billing. Missouri is moving a similar restriction as part of an omnibus health care bill with a $10,000 first violation penalty and enforcement delegated to the Attorney General's office. California SB 243, which took effect on January 1, 2026, is a more elaborate version of the same basic instinct: companion chatbots aimed at emotional support have to meet a list of safety requirements that look a lot like the consumer protection rules that govern tobacco marketing and payday lending. Three states. One month. Same concern.
Two Opposite Directions in the Same Week
The easy reading of the split is that Utah is pro AI and Maine and Missouri are anti AI. That reading is wrong, and the people writing the bills would say so on the record. Utah's HB 452, which passed in March 2025 and set up the regulatory scaffolding that the Doctronic pilot is running inside, is in fact one of the more restrictive laws in the country when it comes to AI mental health chatbots. HB 452 requires clear disclosure that a user is interacting with a machine and not a human therapist. It prohibits advertising based business models where the chatbot can steer users toward sponsored products during an emotional conversation. It requires a set of user protections that Utah's own Division of Consumer Protection can enforce. In the specific domain of consumer facing mental health chatbots, Utah is not notably more permissive than Maine. In the specific domain of prescription refills, Utah is the first state in the country to say yes. The same legislature that approved one wrote the other, and it did so for the same reason. Both bills are answers to the question of where in the clinical workflow an AI system is actually allowed to be the thing that decides something.
Once you look at it that way, the split stops being ideological and starts being structural. Utah's yes and Maine's no are answers to two different questions about two different parts of the clinical encounter. A refill decision for atorvastatin or lisinopril is a highly constrained question with a short feature set, a long evidence base, and a well understood set of conditions under which the answer should change. A therapy session is an open ended question with a feature set that includes tone of voice, body language, childhood history, recent life events, and the subtle pattern of what a patient is not saying. One of those problems is the kind of thing modern language models are already pretty good at. The other is the kind of thing they are not good at in ways that are dangerous to discover at a vulnerable person's expense. The two state statutes, read together, are drawing the line between those two problems on the public record for the first time.
The Doctronic Model: How a Sandbox Becomes a Precedent
The mechanism that let Utah do this is worth understanding on its own terms, because it is likely to be copied. HB 452 established a regulatory sandbox run by the Utah Office of AI Policy, which itself is a permanent office created by the legislature rather than a task force. A company that wants to deploy an AI system in a regulated domain can apply to the sandbox. The office evaluates the application on a published set of risk criteria, negotiates mitigations, and issues a time limited authorization that preempts specific state regulatory obstacles. Doctronic applied. The Office of AI Policy approved it, working in concert with the Department of Commerce, which holds the state's pharmacy and occupational licensing authority. The authorization is not a general rule. It is a specific permission for a specific company to run a specific workflow under specific conditions for a specific period of time, with monitoring and reporting obligations attached.
That is not a novel regulatory technology. The United Kingdom's Financial Conduct Authority has been running a fintech sandbox since 2016, and the model has been copied by Singapore, Australia, Abu Dhabi, and most of the Gulf. What is novel is its application to clinical medicine inside the United States, a jurisdiction where pharmacy practice, prescriber licensing, and medical liability are almost entirely state matters. Utah has, in effect, imported the fintech sandbox into the part of health care regulation that sits below the FDA. The FDA regulates the drug and, increasingly, the software as a medical device. Utah regulates who is allowed to prescribe the drug and under what conditions. Doctronic's authorization is operating in the seam between those two regulatory layers, which is exactly the seam where most digital health startups live and exactly the seam where nobody has written a clean rulebook yet.
The precedent effect is the part that matters for everyone outside Utah. Any other state that wants to move will now have a template. Legislators in states with active AI interest, which at this point is a list that includes Texas, Florida, Tennessee, Virginia, and at least a half dozen others, can look at Utah and write a bill that is one good staff memo away from being filed. It is always easier to pass the second version of a law than the first. The Doctronic pilot is the first version. The second version will move faster, and it will move in at least some states that would never have opened a sandbox on their own initiative.
Why Psychiatric Medications Are on the List and ADHD Drugs Are Not
The single most interesting line item on the Utah formulary is the inclusion of psychiatric medications alongside the exclusion of ADHD stimulants. On the surface, those look like adjacent categories. Both are prescribed primarily by psychiatrists and primary care physicians. Both treat conditions where the patient is not always the most reliable reporter of their own status. Both have a risk profile that demands ongoing monitoring. But the specific risk that an AI refill program has to be defended against is diversion and misuse, and on that axis the two categories are not adjacent at all. A maintenance dose of sertraline has essentially no street value and essentially no recreational utility. A 30 day supply of adderall has both, which is why it sits on DEA Schedule II and why every pharmacy in the country has to account for every tablet. The same reasoning covers the exclusion of injectables, which require administration technique and sterile handling that a chatbot cannot supervise, and the exclusion of every controlled substance across every schedule.
That distinction is a sharper regulatory instrument than it looks. It means the Utah program is not drawing its line between mental health medications and other medications. It is drawing its line between medications where the marginal refill decision is a clinical question about the patient and medications where the marginal refill decision is also an enforcement question about the supply chain. The AI is being allowed to answer clinical questions. It is not being allowed anywhere near supply chain enforcement, because that is the kind of decision that already has a federal regulator and a body of criminal law behind it. The people who drafted the formulary understood that distinction. It is the clearest sign in the whole Utah package that the policy work is serious and not performative.
The Therapy Chatbot Debate: Character Lawsuits, Companion Apps, and the Clinical Line
The reason Maine and Missouri are moving in the opposite direction is that the category of product their bills target is not actually prescription medication at all. It is the general purpose companion chatbot, which has quietly become one of the largest consumer AI categories in the country over the last eighteen months. Character.AI, Replika, and a long tail of smaller services host users who form extended emotional relationships with generative agents. A minority of those users describe the agents, explicitly or implicitly, as therapists. A smaller minority do so while in genuine mental health crisis. The Character.AI lawsuits filed in late 2024 and early 2025 put names and specific harms on the record for the first time, including the death of a fourteen year old boy in Florida whose family alleged the product had encouraged suicidal ideation. Replika has been through its own cycle of complaints over emotionally manipulative design patterns. None of those companies positions itself as a health care provider. Their terms of service are emphatic on that point. But the use pattern is the use pattern, and the statutes are responding to the use pattern rather than the label.
What Maine's LD 2082 does, read carefully, is draw a bright line that says nothing about specific products and instead defines the conduct. An AI system may not provide clinical mental health therapy services. It may provide administrative support. The bill leaves it to the Board of Counseling Professionals Licensure to figure out where the line sits in specific cases, which is how most professional licensing law works, and it attaches penalties severe enough that a company will not want to find out where the line is through enforcement. Missouri's omnibus bill attaches a $10,000 first violation penalty and Attorney General enforcement, which is the state consumer protection playbook applied to a new category of product. California SB 243 takes a different route and imposes a list of affirmative safety requirements rather than a categorical ban, which is closer to the consumer protection model used for social media minors. Three different policy architectures, all responding to the same underlying concern.
The concern is legitimate. The open question is whether a categorical ban is the right instrument for it, or whether the bans will in practice push the use case into a gray market where unregulated agents continue to do exactly the same thing without any disclosure, any safety testing, or any licensing oversight. That is a debate that deserves more than one legislative session to resolve, and it is not going to get one.
Federal Preemption Pressure and the Trump Executive Order
Every state regulatory divergence raises the same question, which is whether Washington is going to tolerate it. On December 11, 2025, the Trump administration issued an executive order establishing a federal policy position that state AI regulations which obstruct national competitiveness should be preempted where legally possible, and directing the creation of an AI Litigation Task Force inside the Department of Justice to identify candidates for federal challenge. The executive order does not, by itself, preempt anything. An executive order cannot override a validly enacted state law. What it does is signal the administration's posture, fund an office whose job is to find test cases, and invite industry to bring preemption claims under existing federal statutes, including the Federal Food, Drug, and Cosmetic Act, the Supremacy Clause, and the dormant Commerce Clause.
The Utah program is unlikely to be a federal target. It is an authorization to do something, not a restriction on doing it, and the constituency for challenging it does not meaningfully exist. The Maine and Missouri bans are different. A company that considers itself preempted by federal regulation of software as a medical device, or by federal consumer protection law, or by the First Amendment in its application to speech generated by a computer program, will have a real case to bring. The AI Litigation Task Force exists precisely to support that kind of case. Expect at least one of the mental health chatbot bans to be challenged in federal court within twelve months of taking effect, and expect the challenge to be well funded. Whether the challenge succeeds is a different question, and the answer probably depends more on which circuit hears it than on the merits. The Ninth Circuit and the First Circuit are likely to look at speech claims differently than the Fifth or the Eleventh.
There is also a harder, slower possibility, which is that Congress passes a preemption statute. An explicit federal floor for medical AI, with a ceiling that prohibits states from adding additional restrictions, would resolve the patchwork in a single stroke. It would also require the current Congress to pass a controversial piece of technology regulation in a year where it is not clear Congress can pass routine appropriations. The odds of federal preemption via statute in 2026 are low. The odds of federal preemption via litigation are not low, and they are climbing.
The Compliance Math for Startups Building Medical AI
The practical consequence of the split lands on the founders and operators who are actually trying to ship medical AI products. Until this year, a clinical AI startup could treat the state layer as, at most, an annoyance to be handled at the end of a sales process. HIPAA was federal. FDA was federal. Payer contracts were national. State licensing applied to the clinicians using the product, not to the product itself. The product team could build one thing. That is no longer true. A product that performs a clinical action in Utah may be explicitly authorized. The same product performing the same action on a mental health presentation in Maine may be explicitly prohibited. A product that is a companion chatbot in California has to meet affirmative safety standards that a product serving the same users in Arizona does not. Nothing about the underlying model changes. The rules about what the model is allowed to do change at the state line.
The compliance math gets expensive quickly. A national product has to either build state specific feature flags that turn capabilities on and off by the user's IP geolocation and self reported residence, or it has to build to the most restrictive state's standard and take the capability hit everywhere else, or it has to cede the restrictive states entirely and operate a smaller map. None of those choices are free. Feature flagging by state requires a compliance engineering investment that most seed stage companies do not have the budget for. Building to the most restrictive standard means Utah's sandbox authorization is of no commercial value. Ceding states means losing customers. The winners in this configuration are the companies big enough to build the state logic and small enough to be specialized in a single clinical workflow. The losers are the broad horizontal platforms that were supposed to be the category defining winners of the current wave, because they have the most exposure to state variance and the least slack to absorb it.
There is a second order effect worth naming. Insurance is going to notice. Professional liability underwriters are going to reprice policies for clinics that use AI tools in states where the legal status of those tools is uncertain, and they are going to reprice them up. Malpractice carriers will start asking whether a clinic's AI vendor has been authorized in the sandbox, whether it carries its own coverage, and whether the clinic has documented human review of the AI output. None of that is visible on the day a state statute passes. All of it shows up three to nine months later when policies renew. Founders who are not modeling premium changes into their unit economics are going to be surprised.
The EU AI Act Parallel and the Global Map
For context on where the American split is headed, it is worth looking at the European framework that has been the background assumption for most medical AI regulation worldwide. The EU AI Act, which entered application in a staged rollout that completed its high risk provisions during 2025, classifies medical AI as a high risk use case and imposes a set of obligations on providers that include conformity assessment, data governance, human oversight requirements, transparency, and post market monitoring. The EU framework does not distinguish between prescription refills and mental health therapy at the statute level. Both are high risk. The difference shows up in the conformity assessment process, which evaluates specific use cases against the obligations and determines what is allowed to ship.
The American state patchwork is, in effect, doing the same classification work the EU framework does in a single statute, but doing it case by case, state by state, and with dramatically different outcomes depending on the political composition of the legislature and the preferences of the governor. An American startup that wants to operate in Europe has to navigate one framework with a clear rulebook. An American startup that wants to operate across American states now has to navigate an uncoordinated set of frameworks with different assumptions. For the foreseeable future the European map is simpler than the American one, which is a sentence that would have been startling to write five years ago.
What to Watch Over the Next Six Months
Several specific signals will determine how this develops. First, the FDA. The agency has been working on a software as a medical device framework update for most of the last year, and internal signals suggest a guidance document on generative AI in clinical decision support is being staffed for release in the second half of 2026. Whatever that guidance says will set the federal floor. If it is permissive on prescription workflows and silent on therapy, it will effectively ratify the Utah approach and put pressure on the Maine approach. If it is restrictive on both, it will be cited in every preemption lawsuit for the next three years.
Second, state attorneys general. Missouri has already told the field it is going to enforce its ban through the AG's office, and the Missouri AG has historically been aggressive about using consumer protection authority in technology cases. The first enforcement action is the one to watch. The target, the theory, and the remedy requested will tell operators more about what the bans actually mean in practice than any amount of statutory analysis.
Third, the first real lawsuit. A Character.AI case, a Replika case, or a case against a newer entrant, tried to verdict in a state with one of the new statutes on the books, will generate the first published opinion on what clinical mental health therapy actually means when the provider is a language model. Every subsequent case will cite it. The choice of forum will matter more than the choice of facts.
Fourth, the Doctronic reporting. The Utah sandbox authorization comes with monitoring obligations, and the Office of AI Policy is expected to publish aggregate outcome data from the first six months of the refill program sometime in the summer. If the data looks good, and the metric that matters most is adverse events, then other states will move quickly. If the data looks bad, the whole regulatory sandbox model for medical AI will take a serious hit, and not just in Utah.
Fifth, the AI Litigation Task Force. The task force was created in December and has had four months to identify candidates. Its first filing, whenever it comes, will set the tone for the preemption fight and will tell the field which theory the administration is betting on. The industry has been asking for federal clarity for two years. It is about to find out what federal clarity looks like when it arrives through the Department of Justice rather than through Congress, and the answer is not going to make everybody comfortable.
The Deeper Question the Split Is Asking
Under all of the specific legal mechanics, the Utah, Maine, Missouri split is asking a question that the AI industry has not yet had to answer clearly. The question is: when is a generative model allowed to be the thing that decides, and when is it only allowed to be the thing that assists a human who decides? The entire industry has been describing its products as copilots and assistants and decision support systems, language carefully chosen to place the human in the legal and moral position of the decider. The Doctronic program is the first real exception at the state level. It places the AI in the decider position for a bounded class of decisions, with a defined scope and monitoring regime, and it does so inside a formal regulatory authorization. That is a different category of product, and the rules that apply to it are going to be different.
Maine and Missouri are answering the same question in the other direction. They are saying that for clinical mental health therapy, the decider must be human, and no regulatory sandbox will change that. Both answers are defensible on their own terms. Both will shape which products get built. The uncomfortable truth is that the answer to the question is probably different for different clinical workflows, which means the patchwork that is forming is not a temporary condition on the way to a unified rule. It may be the permanent steady state of how medical AI is regulated in this country, because the right answer is not the same answer for every part of medicine. The work of the next three years is going to be figuring out which workflows go in which bucket, and the work will happen one state bill and one court opinion at a time.
The field spent a long time waiting for a federal framework. The federal framework is not coming on the timetable the field wanted. The states are filling the vacuum, and they are filling it with real policy, not placeholder policy. Utah said yes. Maine said no. Missouri is saying no with a fine attached. California is saying yes with guardrails. The map that results is going to define the commercial reality of medical AI for the rest of the decade, and the companies that understand this week as the moment the map started being drawn are going to be in a meaningfully better position than the ones that treat it as another news cycle. This is not another news cycle. This is the first real state patchwork on medical AI, and it is going to matter for a long time.