Earlier in 2026, Utah’s Office of AI Policy announced a limited sandbox program with Doctronic and Legion Health for prescription refills. That program, built on top of a three-tiered mitigation agreement between the state of Utah and Doctronic/Legion Health, generated considerable criticism from physicians nationwide at the time of its approval. Utah’s own Medical Licensing Board called for its immediate suspension.
Notably, Doctronic and Legion Health served prescription refills, only, meaning their autonomy was mitigated by a physician who had already written the original prescription. Now, Utah is pushing the envelope even further. Last week, Utah reached a mitigation agreement with Nolla Health to use AI-powered intake to issue new prescriptions for mild-to-moderate acne treatment. In the pilot’s foundational stages, physicians will sign off on all prescriptions. Later, Nolla may prescribe drugs without rigorous review, pending state approval.
Nolla's exaggerations
Its mandate is limited, but Nolla is bullish. The company, which raised $4.5 million in initial funding last year from investors including General Catalyst, intends to expand beyond acne vulgaris. Its co-founder’s self-crowning as “the first company in the US (and possibly the world) authorized to let AI prescribe medication autonomously” speaks to those lofty ambitions.
Nolla’s self-congratulations, however, are, plainly, incorrect. In fact, Nolla has yet to receive any “authorization.” Utah’s Office of AI Policy doesn’t authorize AI ventures; it waives state regulations, including those governing the practice of medicine, so they can be tested. Moreover, the FDA classifies AI devices which make autonomous clinical decisions as SaMD (software as a medical device), forcing innovators to obtain premarket approval or 510(k) clearance. The FDA specifically names diagnosis as a regulated function.
Federalist chaos
Where Utah seeks to move as it expands its Nolla pilot program is unclear. For their part, Doctronic and Utah have previously argued that, as prescribing medication is the “practice of medicine,” its right is reserved to states. Asked whether the state would move its pilots to autonomous deployment without the FDA, OAIP director Zach Boyd said, “I’m not going to comment on that one.” The FDA, he added, is “going to define their own role in this.”
Ironically, the FDA has done no such thing. An FDA spokesperson, asked about the Nolla case, said only that where “violations occur, the agency takes action as appropriate." Thus, Nolla’s case appears to be in a state of regulatory limbo – at least for now. As Utah waits for the FDA to define its role, the FDA waits for a violation.
In the absence of regulatory clarity, companies write their own regulatory vocabulary. When pressed about Nolla’s press materials, its CEO, Luis Wenus, told reporters that, because Utah state regulators, by definition, regulate, they “authorized” Nolla’s sandbox. That Nolla announcement recalls UpDoc, which overstated its AI-Alexa as the “realization of Clinical AI’s potential.”
Ceding the regulatory
Wherever the regulatory terrain is empty, innovators draw their own regulatory maps. That's a dangerous precedent. The Utah pilots have generated considerable debate over AI autonomy in clinical decision-making. By declining to draw a line, the FDA has effectively established that each case of “autonomous AI” should be evaluated, litigated, and relitigated independently. The grounds for the debate itself, then, appear shaky because the definition – of who regulates what – is unclarified. Regulators, in other words, don’t yet know what regulation looks like.
Case-by-case litigation is the opposite of what we should demand. Ryan Whyte, in correspondence with CHARGE, wrote
The question isn’t whether AI can generate a prescription. Clearly it can. The question is whether it can consistently meet the standard of care we expect when something unexpected happens – and who is accountable when it doesn’t. -- Ryan Whyte, CEO American Medical Association
In a regime of endless, minute litigation, we can never reach consistency because the bounds and regulation of the “standard of care” can never be agreed upon.The procedure, by contrast, should run in the opposite direction: governance leaders should – demand clear regulatory policy first, so that we can know how and where to safely push the autonomy envelope. Until then, “authorization” just looks like a new press release.
References
[1] https://www.washingtonpost.com/opinions/2026/03/09/ai-prescriptions-doctronic-peer-review
[2] https://www.statnews.com/2026/10/05/utah-expands-health-ai-sandbox-picks-third-party-auditors/
[3] https://www.statnews.com/2026/10/08/breast-cancer-ai-goes-dtc-utah-sandbox-ai-psychosis-health-tech/
[4] https://www.statnews.com/2026/10/07/utah-sandbox-health-ai-pilots-and-fda-regulations-ai-prognosis/
