Why the AI preemption order barely reached health care’s own AI rules

The week

For two years, hospital leaders had been learning to live with a growing patchwork of state laws on artificial intelligence. In the second week of December 2025, Washington signaled it wanted to push back on that patchwork.

On December 11, 2025, the President signed an executive order titled Ensuring a National Policy Framework for Artificial Intelligence. An executive order is an instruction from the President to federal agencies. It can direct what the government does, but it cannot by itself change what a state law says.

The order directed the Attorney General to set up an AI Litigation Task Force within 30 days to challenge state AI laws inconsistent with the order’s policy, including on interstate commerce and preemption grounds. Two terms need explaining. The Constitution gives Congress power over commerce between states, and courts have long held that states cannot unduly burden it; that is the interstate commerce argument. Preemption is the principle that valid federal law overrides conflicting state law.

The order told the Secretary of Commerce to publish, within 90 days, an evaluation identifying onerous state AI laws. It tied some remaining federal broadband funds to states’ AI laws, a softer form of pressure through money: states that wanted the funds would have reason to reconsider their rules. It asked the FCC and FTC, the federal communications and consumer protection agencies, to consider federal actions. And it called for a legislative proposal for a national framework, because only Congress can write a federal AI law that clearly overrides the states.

That proposal was not to preempt state laws on child safety, AI compute and data center infrastructure, or states’ own procurement and use of AI. Those carve-outs signaled that the target was broad laws that regulate how AI is built and sold, rather than every state rule touching AI.

The order followed the Senate’s rejection of a state-law moratorium in July, a proposal that would have paused enforcement of state AI laws. Having lost that route in Congress, the administration turned to the tools the executive branch controls. For health systems, the question that week was simple to ask and harder to answer: which of our AI obligations, if any, does this actually touch?

The Senate’s rejection of a state-law moratorium in July 2025 left state AI laws standing as the rules health systems had to follow. The December order was an attempt to change that.

For health systems, the useful question was narrower than whether the order would succeed. It was which of their AI obligations it could plausibly reach. Sorted by legal footing, health care’s AI rules fall into three groups: broad AI governance laws, state rules on medical practice and insurance, and privacy and consumer protection laws that touch AI incidentally. The order’s reach falls off sharply from the first group to the third.

The legal analysis only makes sense against the real uses, so they come first.

Portal replies, chart summaries and prior authorization

When people hear “AI in health care,” they often picture a robot diagnosing disease. The reality inside most hospitals and health plans is more mundane, and more widespread. AI tools are already drafting replies to patient messages in the online portal, summarizing long medical records for busy clinicians, transcribing and structuring the conversation in an exam room, flagging patients at risk of deterioration, predicting no-shows, helping coders assign billing codes, and helping health plans sort requests for prior authorization, the approval some insurers require before they will pay for a test or treatment.

Some of these tools use generative AI, the kind of system that produces new text, such as a draft letter or a summary. Others are predictive models, which estimate the likelihood of something, such as readmission. Many are bought from vendors and switched on inside systems the hospital already uses, like its electronic health record, the digital chart that holds a patient’s history, medications and results.

That last point matters. A health system is usually a deployer of AI rather than a developer. It decides how and where to use a tool, but it relies on the vendor for much of what it knows about how the tool was built, what data trained it and where it performs poorly. The position resembles a hospital buying a new imaging machine: the hospital is responsible for using it safely, but it depends on the manufacturer for the specifications and the warnings.

Every one of these uses can touch patients, clinicians, payment or privacy. That is why the laws governing them come from so many different directions, and why the preemption order affects them so unevenly.

Why preemption fights move slowly

The order speaks the language of litigation, and those disputes follow a predictable course.

Federal and state governments share power in the United States. When they collide, federal law wins, but only if there is a valid federal law to do the winning. That can be a statute passed by Congress, or a regulation issued by a federal agency acting within the powers Congress gave it. An executive order directs federal officials; it is not itself that kind of law. So the order’s main tools were indirect: lawsuits, conditions on federal money, agency actions and a push for legislation.

Lawsuits against state laws take time. A challenger files in court, the state defends its law, and judges decide whether the law conflicts with federal law or with the Constitution. A court can block a law temporarily while the case proceeds, which is called an injunction. Appeals can follow. Throughout, the state law usually remains on the books, and organizations subject to it must decide whether to comply while the outcome is uncertain.

Courts also look at the kind of power a state is using. States have long-recognized authority to license doctors and nurses, to regulate insurance companies and to protect their residents’ health and privacy. Courts tend to be cautious about displacing state rules in those areas without clear direction from Congress. A new law that regulates a technology across every industry does not enjoy the same deep roots.

For a health system, the practical task is therefore to sort its obligations into those that rest on old, well-defended state powers and those that rest on new, broad AI statutes, rather than to predict whether the federal government will win.

Broad AI governance laws

Cross-sector AI laws were the order’s clearest target. Colorado’s AI Act was the leading example. It treated decisions about health care services as consequential decisions and imposed risk management, impact assessment and notice duties on developers and deployers of high-risk systems. Its effective date had already been pushed to June 30, 2026.

An impact assessment is a structured written review of what could go wrong with a system and for whom: what it is for, what data it uses, whether it might treat some groups unfairly, and how the organization will watch for problems. A notice duty means telling people when such a system plays a part in a significant decision about them.

These laws are exposed for structural reasons. They regulate AI as a technology across industries, which invites commerce clause arguments. They impose duties on model developers who sell nationally, which is where the order’s concern about a patchwork was aimed. And they were new, without a long line of state practice behind them.

For a health system, the exposure is mostly indirect. Under a law like Colorado’s, much of the documentation burden falls on the developer, and the deployer relies on what the developer supplies. If such a law is narrowed or enjoined, which means blocked by a court, vendors may slow work on the impact documentation, bias testing summaries and model cards they were preparing. A model card is a short fact sheet for an AI model: what it is for, how it was tested, and its known limits. Losing that pipeline is the order’s most direct operational effect on providers.

The response is contractual. Health systems buying AI tools should require that documentation regardless of what any state law requires: intended use, training data provenance, known limitations, performance by relevant subgroup and update notices. Training data provenance means where the data used to build the model came from. Performance by subgroup means how well the tool works for different groups of patients, for example by age or sex, since a tool that is accurate on average can still be unreliable for a particular population. Those terms protect clinical safety and support accreditation. They should not depend on how one statute fares in court.

State rules on medical practice and insurance

The second group regulates how care is delivered and paid for. California requires a disclaimer when generative AI is used to communicate clinical information to patients without review by a licensed provider, and a route to reach a human. It also requires that medical necessity decisions in utilization review be made by a licensed physician or qualified health professional rather than by an algorithm alone. Utilization review is the process insurers use to decide whether a requested service is medically necessary and will be covered. Illinois restricted the use of AI to deliver therapy. Texas’s 2025 AI law, effective January 2026, requires providers to tell patients when AI is used in their care.

These rules sit inside powers states have exercised for generations: licensing professionals, regulating insurers and protecting patients. Insurance regulation in particular has a federal statute, the McCarran-Ferguson Act, that generally leaves it to the states. A preemption argument against a rule that says a physician must make a coverage decision is far harder than one against a general algorithmic discrimination law. An executive order cannot preempt anything by itself; that requires Congress, a valid federal regulation or a court ruling.

Federal policy also points the same way in places. CMS, the Centers for Medicare & Medicaid Services, sets rules for Medicare Advantage, the private plans that deliver Medicare benefits. Those rules require medical necessity determinations based on the individual patient’s circumstances, and CMS guidance said algorithms may assist but not replace that judgment. A health system or health plan building human review into utilization management is meeting state and federal expectations at once.

The work here is operational. Patient portals and messaging tools need disclosure language and a visible route to a person. Utilization review workflows need evidence that a qualified reviewer made each adverse decision. Behavioral health services need a clear boundary between AI-supported administrative tasks and therapy itself.

These duties also land on different owners. Disclosure in patient messaging belongs to whoever runs the portal and the clinical communications program. Utilization review sits with health plan operations or, for providers, with the teams that respond to denials. Disclosure at the point of care in Texas reaches individual clinicians and their documentation. An AI governance committee that only approves tools will miss most of this. It needs a named operational owner for each duty and a way to show, on request, that the duty was met.

Privacy and consumer protection laws

The third group applies to AI because AI processes personal data. State comprehensive privacy laws give consumers rights over profiling and automated decisions in some contexts. Several states protect consumer health data outside HIPAA, the federal law that protects medical information held by providers, health plans and their contractors. State unfair and deceptive practices statutes reach misleading claims about what an AI tool does.

An AI-specific federal policy is least likely to displace these. They are general laws of long standing, and attacking them would mean attacking state privacy and consumer protection law as a whole. For health systems, many already carry HIPAA-related exemptions, so the exposure sits mostly in marketing, consumer apps and websites outside the covered entity’s clinical records. A symptom checker on the public website, or a wellness app sold to consumers, can fall under these laws even when the hospital’s clinical systems do not.

Read in this order, the three groups suggest a simple program design. Map each AI use to the laws that apply by legal footing, not by whether the statute mentions AI. Treat the first group as uncertain and cover it through vendor contracts. Treat the second and third as stable and build to them. That posture does not depend on predicting how the preemption fight ends.

One health system sorts its dozen tools

Suppose a regional health system has hospitals in two states, a health plan, and a dozen AI tools in use. Its AI governance committee meets monthly and approves new tools. After the December order, the chief executive asks whether any of its compliance work can be paused.

The general counsel sorts the tools by legal footing rather than by whether a statute mentions AI. The patient-message drafting tool falls under a state rule on disclosure in clinical communications, a rule rooted in medical practice; it stays. The health plan’s prior authorization tool falls under state utilization review rules and Medicare Advantage requirements; human review of every denial stays. The consumer symptom checker on the website falls under state consumer health data and privacy laws; that work stays too. The deterioration prediction model, used in a state with a broad AI governance law, is the one area where the legal duty might shift.

Even there, the committee decides not to pause. The documentation it wanted from the vendor, how the model was trained, how it performs across patient groups and how updates will be announced, matters for clinical safety whatever happens in court. The general counsel adds those terms to the renewal. The answer to the chief executive is that almost nothing can be paused, and that the one uncertain area is better handled through the contract than through waiting.

The rules closest to the bedside

Patient safety. The rules that survive any preemption fight are the ones closest to the bedside: who makes a coverage decision, whether a patient knows a message was drafted by AI, whether therapy is delivered by a person. Getting them wrong harms patients first.

Money. Utilization review is where AI meets revenue most directly, for plans and for providers fighting denials. Decisions that cannot show a qualified human reviewer are vulnerable to challenge.

Regulators. Health systems answer to state licensing boards, state insurance departments, CMS, accreditors and privacy regulators. None of those relationships changed in December 2025.

Trust. Patients are still forming views about AI in their care. Clear disclosure and an easy route to a human are what keep that trust intact.

A program sorted by legal footing

A well-run program keeps an inventory of every AI use, with the laws that apply to each sorted by legal footing. Each duty has a named operational owner. Vendor contracts require documentation and update notices as standard. The governance committee looks at how tools are used after approval as well as at the approval itself.

Weaker programs tend to make the same errors:

• Reading “federal preemption” as covering all AI rules, and pausing work that rests on licensing, insurance or privacy law.
• Searching statutes for the word “AI” and missing rules that apply to AI without naming it.
• Relying on a state law to make vendors produce documentation, instead of writing it into the contract.
• Treating AI governance as tool approval only, with no owner for disclosures, reviews and records once a tool is live.
• Forgetting consumer-facing websites and apps, which can fall outside HIPAA exemptions.

What a December-style order can and cannot pause

1. Do we have a complete list of the AI tools in use across our organization, including features switched on inside systems we already own?
2. Which of our obligations, if any, could actually change if a broad state AI law were blocked in court?
3. Do our vendor contracts require model documentation, performance by patient subgroup and notice of updates, whatever state law says?
4. For every adverse utilization decision, can we show which qualified professional made it?
5. Who owns each AI-related duty day to day, and how would they show it was met?

Good answers name people, documents and dates. If the answer to the second question is “a lot,” the team has probably not sorted its obligations by legal footing at all.

With hindsight

The Attorney General established the AI Litigation Task Force by a memorandum dated January 9, 2026. Its most visible move followed in April, when the Justice Department intervened in a lawsuit by xAI challenging Colorado’s AI Act, weeks before the law’s June 30 effective date. The department’s filing argued that the law violated the Equal Protection Clause. The broad, cross-sector law was where the federal pressure landed.

State rules on clinical communication, utilization review and AI therapy stayed on the books, and we are not aware of a court ruling that displaced them. For health systems, that confirmed the sorting. The obligations that bind daily operations were the hardest to preempt. The real uncertainty sat with vendors, whose documentation duties under broad laws became a moving target. Health systems that wrote documentation requirements into their contracts were better insulated from that than those relying on statutes to make vendors comply.

The episode also shows how to read a high-profile legal fight. Headlines framed the order as a contest between Washington and the states over AI. Inside a hospital, that contest touched only part of the picture. The rules that shape what happens when a patient opens a portal message, when a plan reviews a request for care, or when someone seeks therapy rest on old and well-defended state powers. They were never the main battleground.

That suggests a durable way to run an AI compliance program in health care. Sort obligations by where their legal authority comes from rather than by whether a statute uses the word “artificial intelligence.” Build firmly to the rules rooted in licensing, insurance and privacy, because those are stable. Handle the uncertain layer, broad AI governance laws, through contracts that require vendors to supply what clinical safety demands anyway. A program built that way does not need to guess how the preemption fight ends, and it would have looked much the same whichever way the courts ruled.