Proposed AI Governance Framework: Risk-Mitigation Recommendations for Health Plans

Senator Maria Cantwell (D-Wash), the ranking member of the Senate Committee on Commerce, Science, and Transportation, recently outlined a comprehensive artificial intelligence (AI) governance framework designed to drive legislative and executive actions. The framework is built on six principles and is being introduced at a time when federal AI legislation is actively being debated. While the framework is a proposal, it reflects priorities that have bipartisan resonance and signals where lawmakers are likely to focus. For health insurance payors, several elements of the framework are directly relevant to existing and planned AI deployments, particularly in utilization management, claims processing, and member-facing services.

The proposed framework notes that frontier AI systems require constant oversight and vigilance, and stresses that covered models should not be released until they have undergone an independent audit confirming that they meet applicable safeguards and standards. That is a high bar. If enacted, such a law would require health plans to scrutinize not only their internally developed AI tools but also AI systems that are embedded in vendor products they procure and deploy. 

Enforced Federal Standards Would Establish Safeguards 

Senator Cantwell's framework calls for the National Institutes of Standards and Technology (NIST) to develop clear, transparent, measurable, risk-based standards for AI systems that could cause catastrophic harm. Those standards would establish proportionate safeguards and risk-management requirements, with heightened review and oversight for systems that exhibit dangerous capabilities or are capable of self-improvement that may bypass safety controls. As AI evolves, federal standards would need to be regularly updated.

For health plans, this means compliance would not be a one-time exercise but an ongoing obligation. The practical implication is that AI systems used in clinical and administrative decisions — such as prior authorization, claims adjudication, and fraud detection — could be subject to federally mandated risk standards and pre-deployment audits. 

Framework Calls for “Constant Oversight and Vigilance” 

The framework calls for government and independent experts to provide “constant oversight” and to continually scrutinize and stress test covered AI models against catastrophic risk standards, particularly where testing requires specialized expertise, sensitive information, or secure facilities.  Audit firms would conduct comprehensive audits of AI developers, akin to outside auditors examining a company's financial statements, to ensure AI products meet applicable federal standards and safeguards.

Health plans should note that this audit model, based on financial statement audits, contemplates a level of rigor and external scrutiny that most health plan AI programs are not currently structured to support. Developers, including health plans that develop or configure AI tools, would be required to provide qualified independent testers and auditors to assess risks, investigate serious incidents, and verify that safety and security safeguards are functioning as intended.  

Transparency, Disclosure, and Accountability 

The framework requires developers to provide clear, plain-language disclosures of material safety and security risks, and mitigation of those risks. The disclosures and mitigation would be modeled after the risk disclosures public companies provide to investors. Developers would be required to promptly report AI safety and security incidents, including loss of control over autonomous agents, dangerous cyber capabilities, failures of critical safeguards, and unsafe recursive self-improvement.

Perhaps most significant for health plans is the accountability dimension. Developers would be liable under applicable civil and criminal law for foreseeable harms and unlawful conduct arising from their AI systems. This would include when their design, deployment, modification, or failure to implement reasonable safeguards contributes to harm. If enacted, this standard could expose health plans to liability for harms caused by third-party AI tools, particularly those used in utilization management, where the plan failed to implement reasonable safeguards or conduct adequate oversight of those tools. 

The framework also includes whistleblower protections for employees and contractors who report safety, security, or compliance concerns. Health plans should be aware that this provision, if enacted, could affect the internal reporting dynamics around AI governance programs. 

Framework Calls Out CMS’s WISeR Model  

When AI is involved in consequential decisions about employment, health care, credit, or other essential services, the framework requires that the AI be transparent, fair, and subject to meaningful human oversight, particularly where AI-assisted prior authorization could delay or deny needed care. It specifically calls out the Wasteful and Inappropriate Service Reduction (WISeR) model, a six-state pilot launched by the U.S. Centers for Medicare and Medicaid Services’ (CMS) Innovation Center in early 2026 as an example of an AI-assisted prior authorization model. The WISeR model, which targets low-value care, fraud, waste, and abuse in original fee-for-service Medicare, expands the use of AI assistance in prior authorization.  

The model has drawn scrutiny from members of Congress and advocacy groups concerned that it could systematically deny care. Senator Cantwell’s framework signals that legislative action to mandate human oversight of AI-driven prior authorization decisions is a possibility, and health plans should be preparing for that eventuality now. 

The framework also recognizes that health care consumers should be able to understand when and how an AI system was used in making a consequential decision and whether that decision was reviewed by a qualified human decision-maker. For health plans, this translates into a potential obligation to disclose AI’s role in adverse prior-authorization determinations. They will need to ensure that appeals and grievance processes provide meaningful, not perfunctory, human review. 

The framework calls for government to work with industry to develop and deploy defensive AI that detects and contains malicious activity, identifies and patches cyber vulnerabilities, and protects critical infrastructure from increasingly automated attacks. For health plans, participation in these public-private initiatives could represent both a compliance opportunity and an avenue for influencing how health-specific AI standards are developed. 

Risk-Mitigation Recommendations for Health Plans 

Given the trajectory of Congressional interest in AI governance, and the explicit focus Senator Cantwell’s framework places on AI in health care decision-making, health plans should consider the following steps now: 

1. Map AI use across the enterprise: Identify every AI system currently in use, including those embedded in third-party vendor products, that informs or automates a decision about a member's coverage, care, or benefits. Pay particular attention to prior authorization, claims adjudication, and utilization-management tools. 
2. Assess human oversight protocols: For every AI system that informs a consequential clinical or administrative decision, evaluate whether meaningful human review is built into the workflow — not as a rubber stamp, but as a substantive check on AI-generated outputs. 
3. Review member-facing transparency: Determine whether explanation of benefits, denial notices, and grievance and appeals communications adequately disclose when and how AI was used in a coverage or prior-authorization determination, and whether members have a practical path to human review. 
4. Audit vendor contracts: Review agreements with AI vendors to ensure they include representations regarding compliance with applicable standards, audit rights, incident reporting obligations, and indemnification for AI-related harms. The accountability standard in Senator Cantwell’s framework — imposing liability for failure to implement reasonable safeguards — underscores the importance of ensuring contractual protections flow down through the vendor relationship.  
5. Build a governance and documentation infrastructure: Establish board-level and senior management accountability for AI oversight, and document the policies and procedures governing AI use across all lines of business. If federal standards modeled on Senator Cantwell’s framework are enacted, health plans that can demonstrate a mature, documented governance program will be better positioned to demonstrate compliance. 
6. Engage with the legislative process: The framework is a policy proposal, and health plans have an opportunity to engage with policymakers to shape how human oversight, transparency, and accountability requirements are ultimately defined in future legislation. Senator Cantwell emphasized that America can lead the world in AI by building systems that are not only more capable, but safer and more secure. Health plans can be constructive partners in demonstrating how that vision can be realized in the health care context. 

Our team is ready and available to assist health insurance payors navigating the evolving landscape of federal AI governance. For further details or clarification on what Senator Cantwell’s framework could mean for your organization’s AI programs, including prior authorization, utilization management, and vendor oversight, please contact any author of this alert or your preferred Crowell lawyer.