Sector Statutes: Insurance, Health and Companion Chatbot Rules

Organisations operating across multiple US states must understand how sector-specific statutes interact with AI governance frameworks. In this lesson, we focus on insurance, health, and companion chatbot regulations. These statutes often impose unique obligations that complicate compliance efforts for firms operating in multiple jurisdictions. The interplay between these statutes and AI governance requires careful attention to data handling, transparency, and risk management.

Insurance Sector Regulations

Insurance statutes in both Colorado and California place strict requirements on data usage, particularly regarding AI-driven underwriting or claims processing. These laws often prohibit discriminatory practices and demand explainability in automated decisions. For example, an insurer using AI to assess risk must ensure that algorithms do not unlawfully discriminate against protected classes. The statutes also require that data used for AI models is accurate, relevant, and properly sourced. Firms must maintain records of data inputs and model outputs to support audit readiness. In Colorado, insurers must notify policyholders of AI usage in decision-making processes. California similarly requires transparency in automated underwriting, including disclosures about data sources and algorithmic reasoning. These statutes complicate AI governance because they require firms to align AI systems with existing regulatory frameworks, not just AI-specific laws.

• AI models must not produce discriminatory outcomes
• Consumers must be informed of AI usage in decision-making
• Data must be accurate, relevant, and traceable

Health Sector Regulations

Health statutes, such as those governing telemedicine or clinical AI tools, impose stringent data protection and privacy obligations. In California, the CCPA and state-specific health laws require explicit consent for data usage, including data used in AI models. Colorado similarly enforces data minimisation principles, which complicate AI development where large datasets are traditionally required. Firms must ensure that clinical AI tools used in healthcare settings meet clinical validation standards. These statutes often require clinical trials or peer review before AI tools can be deployed. For example, an AI chatbot used to diagnose symptoms must undergo clinical validation to ensure clinical safety. The statutes also require that clinical data is stored securely and access is restricted. These requirements complicate AI governance by introducing clinical and clinical data governance responsibilities alongside AI-specific ones. Firms must also consider data retention and deletion policies aligned with clinical care cycles.

• Explicit consent required for clinical data usage
• Clinical validation is mandatory for clinical AI tools
• Data must be stored securely and access must be restricted

Companion Chatbot Regulations

Companion chatbots, particularly those used in mental health or elderly care, are subject to special scrutiny. These statutes often require that chatbots provide clear disclaimers, maintain human oversight, and ensure data privacy. In California, chatbots must clearly identify themselves as AI systems and not mislead users into thinking they are human. Colorado similarly requires that AI systems used in care settings have human oversight. These statutes complicate AI governance by introducing human-in-the-loop requirements and transparency obligations. Firms must also ensure that chatbot data is stored securely and that users have access to data deletion. For example, a mental health chatbot must have a mechanism for human intervention when a user expresses distress. The statutes also require that chatbots do not provide clinical advice or diagnose conditions. These requirements complicate AI governance by introducing clinical, ethical, and user protection responsibilities.

• Chatbots must identify themselves as AI systems
• Human oversight is required in care settings
• Chatbots must not diagnose or provide clinical advice

Organisations must align these statutes with AI governance frameworks such as ISO/IEC 42001:2023. The standard provides a framework for managing AI risks through governance, risk assessment, and data management. Firms must ensure that AI systems meet these requirements across all jurisdictions. The EU AI Act also applies to US firms that offer services in the EU, including those using AI in insurance, health, or chatbot applications. The Act’s Article 5 prohibited practices apply from 2 February 2025, and firms must ensure that AI systems do not fall into these categories. The Act’s transparency duties apply from 2 August 2026, including machine-readable marking for generative AI systems. Firms must also consider the Digital Omnibus on AI, which defers certain obligations to 2027 or 2028. These EU obligations complicate US-based AI governance, particularly for firms that operate across multiple jurisdictions. The interplay of these statutes highlights the importance of cross-jurisdictional compliance strategies. Firms must develop AI governance frameworks that accommodate these varied requirements. Regular audits, staff training, and data protection impact assessments are essential. The goal is to ensure that AI systems meet both US state statutes and EU obligations. This requires continuous monitoring, updating, and documentation of AI governance processes. The frameworks must be adaptable to changing regulatory landscapes. Firms must also ensure that their AI governance is aligned with ISO/IEC 42001:2023, which provides a structured approach to AI risk management. The certification process through ISO/IEC 42006:2025 ensures that firms meet these standards. The first UKAS-accredited certification body was BSI, which began operations in January 2026. These developments complicate AI governance but also provide frameworks for compliance. Firms must stay informed of these evolving requirements to maintain regulatory alignment. The focus must always be on data protection, transparency, and risk mitigation. These statutes and frameworks must be embedded into AI governance processes to ensure compliance. The result is a layered approach to AI governance that reflects the complexity of modern regulatory environments.