AI Governance Institute
← News
Corporate Policy2026-10-06

Utah Healthcare AI Sandbox Sets a Governance Template With Real Teeth

What happened

Utah's Office of Artificial Intelligence Policy signed master agreements with Intermountain Health and University of Utah Health. The agreements establish binding data privacy and AI governance terms. These serve as conditions for piloting healthcare AI tools within the state's regulatory sandbox, as reported in AI may soon be in more healthcare processes in Utah under new state agreements. Three pilot programs were approved under this structure: telehealth dermatology, postpartum physical therapy, and prescription refill support. Each program requires independent third-party evaluators and mandatory human oversight built into its compliance design. The Utah Medical Licensing Board criticized earlier sandbox activity for lacking adequate input from healthcare professionals and affected stakeholders. In response, the office broadened participation and added accountability mechanisms before proceeding.

Why it matters

  • ·Sandbox governance is contractual, not statutory. Health systems under master agreements with a state AI office face governance obligations that may be harder to audit, enforce, or escalate than those under established law. Compliance teams need to map those obligations explicitly.
  • ·The built-in third-party evaluator requirement sets a precedent: regulators are beginning to treat independent clinical AI review as a baseline condition for deployment approval, not an optional enhancement. The AI Billing Tools Added $942M in Unwarranted Healthcare Costs, Insurer Study Finds case illustrates why regulators are moving in this direction.
  • ·The Medical Licensing Board's earlier objections show that AI sandbox programs can be challenged on procedural grounds if clinical stakeholders are excluded from governance design. Organizations building their own sandbox or pilot frameworks need documented stakeholder engagement records, not just technical governance artifacts.

Stay ahead of stories like this

Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-016Agentic AI Deployment Readiness AssessmentALC-005Regulatory Audit ReadinessCMP-003Voluntary AI Framework Obligation MappingHOC-001AI System Risk ClassificationHOC-002Human Approval Gate for Consequential AI DecisionsPRC-003Third-Party AI Model Evaluation

What to do now

  • ☐If your organization participates in any state or federal AI sandbox program, obtain and review the governing master agreement to identify all compliance obligations, evaluation timelines, and human oversight requirements that apply specifically to your deployments.
  • ☐Ask your legal and clinical teams whether your current human oversight workflows for AI-assisted healthcare decisions meet the standard implied by the Utah model: a designated reviewer who can intervene before the AI output reaches a patient or prescriber.
  • ☐Confirm that any third-party evaluator engaged for a sandbox pilot is operationally independent from both the AI vendor and the clinical team deploying the tool, and document that independence in your vendor governance files.
  • ☐Review your stakeholder engagement records for any AI pilot program to confirm that affected clinical professionals, licensing bodies, or patient representatives were consulted before deployment, not after.
  • ☐Flag the Utah model to your compliance and government affairs teams as an emerging template for state-level healthcare AI oversight, and track whether your state's licensing boards or health regulators are moving toward similar sandbox conditions.

What to watch next

Compliance teams should monitor whether other state AI offices adopt the Utah master agreement model. Key conditions to watch include mandatory third-party evaluator and human oversight requirements for sandbox participation in other sectors. The utah-artificial-intelligence-policy-act-sb149-2024 provides the statutory backdrop for Utah's sandbox authority, and any amendments or guidance issued under that act will affect how broadly these obligations extend. The EU AI Office Inspections Target Hiring, Credit, and Healthcare AI pattern suggests regulators across jurisdictions are converging on healthcare AI as a priority enforcement area. Proactive governance documentation is increasingly urgent regardless of sandbox participation.

Related Coverage

Enforcement2026-11-11

Congress Targets Medicare AI Coverage Pilot for Repeal in First 100 Hours

A Democratic-controlled Congress is expected to move within its first 100 hours to repeal the Medicare WISeR model. WISeR is a Centers for Medicare and Medicaid Services pilot that uses AI to support coverage review decisions. The Seniors Deserve SMARTER Care Act, which would ban the pilot outright, has bipartisan support and already cleared the House Appropriations Committee unanimously. Separately, Democrats are pushing to delay Medicaid work requirements while calling for increased oversight of the technology vendors helping states implement eligibility systems.

Corporate Policy2026-11-14

HSI Demands Auditable AI Outputs and Source Citations for All Criminal Investigations

Homeland Security Investigations (HSI) has stated that any AI tool used in federal criminal investigations must produce auditable outputs with citable source documents. All investigative materials are subject to legal discovery. Peter Hatch, HSI's principal assistant director for intelligence, made the requirements explicit at a public event and said vendors who cannot meet them will not be considered. HSI currently operates nearly a dozen deployed AI use cases and has five more in pre-deployment phases.

Research2026-11-12

Vendor Custody, Delegated Authority, and the Agentic AI Accountability Gap

A peer-reviewed paper published in November 2026 by Springer Nature examines how accountability is distributed when AI agents make decisions on behalf of users and organizations. The research identifies four structural risks: delegated authority without clear ownership; vendor-controlled alignment measures that deployers cannot audit; limited inspection rights over agent behavior; and gaps in incident response responsibility. The findings have direct implications for vendor risk programs, human oversight requirements, and AI governance documentation.