Prior authorization is under more pressure than at any point in its history.
Regulators have set firm dates. Under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), affected payers have had to meet new decision timeframes and denial-reason requirements since Jan. 1, 2026. The required application programming interfaces (APIs), including the Prior Authorization API, must be live by Jan. 1, 2027.
Providers keep pointing to administrative burden, and the 2025 AMA prior authorization survey puts numbers on it: 40 requests per physician each week, 13 hours of physician and staff time, and 95% saying it delays care. Patients, meanwhile, now have generative AI tools that can write a coherent appeal in minutes.
Payers are responding by moving faster. That instinct makes sense. It also raises a harder question: faster than what, and at what cost?
MRIoA sits in the middle of this. As an independent clinical review organization, we review on behalf of health plans, we hear from providers, and we see appeals arrive with AI-assisted arguments attached. That vantage point shapes how we think about where AI belongs.
Trust replaced capability as the constraint
For most of the past decade, the limit on AI in healthcare was capability. The tools could not read a clinical record well enough to be useful.
But the deeper problem was never the tools. As MRIoA Chief Technology Officer Nilesh Shah put it during a recent webinar with Itiliti Health, the industry digitized the transport, meaning how documents move, without digitizing the content. A faxed PDF became an uploaded PDF. The document moved faster, but nobody updated the structure of what was inside it. Three decades of partial digitization left the industry delivering unstructured data electronically, on both the provider and payer sides.
Then generative AI closed that gap as it became capable of reading unstructured clinical text. The capability constraint disappeared, and a trust and accountability constraint replaced it. For years the technology curve and the trust curve had moved in opposite directions. That is why, as Shah described it, the line between using AI to speed up work and letting it make the determination is now a compliance question rather than a philosophical one.
The question underneath all of it is short. “Can you trust the work being done?” It applies no matter who did the work, whether a model, your own staff, a vendor, or a platform.
The consequences show up on appeal. On the patient side, the barrier to a strong appeal was never information. Plan documents and appeal rights have been public for years. The barrier was effort and expertise, and generative AI removed it. Appeal quality no longer tracks a member’s sophistication or ability to pay for help. Appeals are getting stronger. Determinations that are fast but cannot be explained are the ones getting overturned.
Chad Frank, Chief Innovation Officer at Itiliti Health, framed the response as four categories: accountability, transparency, clinical authority, and traceability. Shah agreed with the list and organized MRIoA’s approach along a different axis: three layers, each with its own questions and governing framework.
Layer 1: Infrastructure
The first layer is the technology itself. Can it be kept secure? Can it be governed? Does it meet regulatory requirements? These are familiar questions, and most health plans already have mature answers for every other system they run.
Nothing about AI changes what you ask at this layer. There is simply more of it to ask about. MRIoA aligns this layer to the NIST AI Risk Management Framework, which exists so organizations do not have to invent infrastructure-level AI controls from scratch.
Layer 2: The processing platform
The second layer is where the work happens, on the platforms reviewers use every day. Here the questions shift. Can the data be protected? Are HIPAA protections in force? Can the platform itself be governed for appropriate AI use, so that a tool built to summarize a record is not quietly doing something else?
MRIoA aligns this layer to HITRUST’s AI security requirements, which extend an existing information security framework rather than running alongside it as a separate program.
Layer 3: Clinical determination
The third layer is the determination itself, and it is where MRIoA draws its firmest line.
“We do not use any tools to make clinical decisions,” Shah said. “Licensed clinicians remain responsible for every determination and every clinical rationale.”
AI’s role at MRIoA is deliberately narrow. It helps gather and validate information, summarizes clinical records, and produces consistent, member-friendly documentation. It supports clinicians rather than substituting for them. A network of more than 700 clinicians across more than 150 specialties is only an advantage if those clinicians are the ones making decisions. MRIoA is aligning this layer to URAC’s Health Care AI Accreditation.
Separating the layers works because each one asks its own question. Security controls answer whether the technology can be trusted. Clinician attestation answers who is responsible for the decision. Each framework is strong where it applies, and the three of them together cover ground that one policy written to span all three rarely does.
What it takes to hold the line
An attendee asked during the webinar: how can anyone tell whether an appeal was written by AI? Shah’s answer was honest. Largely, you cannot. Machine-readable watermarking is being explored, but the industry cannot rely on it today.
So the answer is not detection. It is governance on your own side of the process. At MRIoA, AI use is covered in reviewer training, reviewers attest that the final output is always human-generated, and quality reviews confirm that the attestation holds. Payer clients are increasingly writing the same requirement into their contracts.
Frank offered a useful test for whether a workflow can withstand that scrutiny: it should be traceable, explainable, and repeatable. That is the practical difference between a deterministic process, meaning one you can trace and prove, and a probabilistic one, which amounts to a well-informed guess. If a workflow cannot be described the first way, AI is not the problem.
Some limits are a choice, not a requirement. Speaking about clinical judgment, Shah said: “There’s a human aspect to it that I don’t know if AI can ever get to, and we really don’t want them to get to that level.”
Why this matters now
The window for setting these standards voluntarily is narrowing. As Shah noted, states keep legislating without coordinating with one another.
At least seven states passed AI prior authorization laws in 2026 alone. Several now bar AI as the sole basis for an adverse determination without licensed human review, several require plans to disclose where AI is used, and several add audit trail and reporting requirements. Those requirements map onto the third layer almost exactly. They are already law in some states and not in others.
Health plans that define their own guardrails now will keep control of how AI is used in their operations. Plans that wait will inherit someone else’s definition.
Hear the full conversation
Clarity and confidence in every clinical decision do not happen by accident. They come from knowing where technology helps, where a clinician decides, and how you would prove it.
In the full webinar, Nilesh Shah and Chad Frank work through the “bot wars” arms race, why layering AI on top of unchanged processes creates more work instead of less, and what these three layers look like in practice.
Watch the full webinar: AI in Prior Auth: Efficiency, Guardrails, and What Bot Wars Mean for Payers
