Oklahoma — Federal AI Profile + State AI Law (HB 1364 AI-generated nonconsensual intimate images, 2025) + OID Bulletin 2024-11 (verbatim NAIC AI model-bulletin adoption) + algorithmic insurance-scoring statute (36 O.S. §§ 950-959) + physician-made prior-authorization determinations (36 O.S. §§ 6570.3, 6570.53): AI Compliance Requirements

Oklahoma HB 1364 (2025 Regular Session, authored by Rep. Toni Hasenbeck and Sen. Jerry Alvord; signed by Gov. Kevin Stitt; effective November 1, 2025) amended Oklahoma's nonconsensual-dissemination-of-private-sexual-images statute (21 O.S. § 1040.13b) to cover "artificially generated" / AI-fabricated sexually explicit depictions. It is a crime to knowingly or recklessly disseminate AI-generated sexually explicit images of an identifiable person without their consent and with intent to cause harm. Penalty tracks the existing statute: misdemeanor on a first offense (up to one year / $1,000), felony where committed for financial gain (up to four years), and up to ten years plus sex-offender registration on a second or subsequent financial-gain offense. Exceptions exist for criminal investigations, journalism, and lawful public/commercial exposure; internet platforms and telecom providers are protected from liability for user-generated content. Binds individuals and any business or platform that creates or distributes such material in Oklahoma. Counsel should confirm the exact 21 O.S. § 1040.13b "artificially generated" amendment language, the felony classes and sentencing, and the November 1, 2025 effective date against the enacted text.

FTC Act § 5 applies to all Oklahoma businesses using AI. Oklahoma Consumer Protection Act (79 O.S. § 55) provides independent state enforcement for deceptive AI claims in trade and commerce. Ensure AI chatbots disclose their nature, AI marketing claims are truthful, and AI-driven pricing in energy and agricultural markets does not engage in unfair practices.

EEOC May 2023 guidance applies to Oklahoma employers using AI hiring, scheduling, or performance evaluation tools. Oklahoma's energy sector (Devon Energy, Chesapeake) and aerospace companies using AI worker monitoring must test for disparate impact. Oklahoma has a significant Native American workforce — adverse impact analysis must include indigenous workforce data.

On November 14, 2024 Oklahoma Insurance Commissioner Glen Mulready issued Bulletin No. 2024-11, "Use of Artificial Intelligence Systems in Insurance", to "All Insurers Licensed To Do Business In Oklahoma". The Oklahoma Insurance Department issues it "to remind all Insurers that hold certificates of authority to do business in the state that decisions or actions impacting consumers that are made or supported by advanced analytical and computational technologies, including Artificial Intelligence (AI) Systems ... must comply with all applicable insurance laws and regulations. This includes those laws that address unfair trade practices and unfair discrimination." The bulletin "sets forth the Department's expectations as to how Insurers will govern the development/acquisition and use of certain AI technologies" and "advises Insurers of the type of information and documentation that the Department may request during an investigation or examination". READ THE NORMATIVITY: unlike Kentucky's Bulletin 2024-02, which inserts a "NON-BINDING guidelines" lead-in and downgrades the model's expectation to a "strongly urges", Oklahoma preserves the NAIC model's operative sentence verbatim — "Consistent therewith, all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices. The AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes, including, at a minimum, the statutory provisions set forth in Section 1 of this bulletin." Section 3 first states the substantive floor: decisions made using AI Systems "must comply with the legal and regulatory standards that apply to those decisions, including unfair trade practice laws. These standards require, at a minimum, that decisions made by Insurers are not inaccurate, arbitrary, capricious, or unfairly discriminatory. Compliance with these standards is required regardless of the tools and methods Insurers use to make such decisions." The AIS Program Guidelines then track the model exactly: the Program should be designed to mitigate the risk that the Insurer's use of an AI System will result in Adverse Consumer Outcomes (1.1); should address governance, risk management controls, and internal audit functions (1.2); should vest responsibility for development, implementation, monitoring and oversight, and for setting the Insurer's AI strategy, with senior management accountable to the board or an appropriate board committee (1.3); should be tailored to and proportionate with the Insurer's use and reliance on AI, with the scope of controls for a given use case reflecting the Degree of Potential Harm to Consumers (1.4); may be independent of or part of the existing Enterprise Risk Management program and may adopt, incorporate or rely upon a third-party framework such as the NIST Artificial Intelligence Risk Management Framework, Version 1.0 (1.5); should address AI use across the insurance life cycle including product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection (1.6); should address all phases of an AI System life cycle — design, development, validation, implementation (both systems and business), use, on-going monitoring, updating and retirement (1.7); should address AI Systems used for regulated insurance practices whether developed by the Insurer or a third-party vendor (1.8); and should include processes and procedures providing NOTICE to impacted consumers that AI Systems are in use and providing access to appropriate levels of information based on the phase of the insurance life cycle in which the AI Systems are being used (1.9). Section 2 defines "Adverse Consumer Outcome", "Algorithm", "AI System", "Artificial Intelligence (AI)", "Degree of Potential Harm to Consumers", "Generative Artificial Intelligence", "Machine Learning (ML)", "Model Drift", "Predictive Model" and "Third Party". The Department "recognizes the Principles of Artificial Intelligence that the NAIC adopted in 2020 as an appropriate source of guidance". Questions go to marketregulation@agency.ok.gov.

Section 2.0 asks that the AIS Program include "a governance framework for the oversight of AI Systems used by the Insurer. Governance should prioritize transparency, fairness, and accountability in the design and implementation of the AI Systems, recognizing that proprietary and trade secret information must be protected." An Insurer may adopt new internal governance structures or rely on existing ones, but should consider addressing: the policies, processes and procedures, including risk management and internal controls, to be followed at each stage of an AI System life cycle from proposed development to retirement (2.1); the requirements adopted to DOCUMENT compliance with the AIS Program's policies, processes, procedures and standards, "developed with Section 4 in mind" (2.2); and the internal AI System governance accountability structure (2.3) — (a) formation of centralized, federated or otherwise constituted committees comprising representatives from business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance and legal; (b) scope of responsibility and authority, chains of command and decisional hierarchies; (c) the INDEPENDENCE of decision-makers and lines of defense at successive stages of the AI System life cycle; (d) monitoring, auditing, escalation and reporting protocols and requirements; and (e) development and implementation of ongoing training and supervision of personnel. Section 2.4 adds a Predictive-Model duty: processes and procedures for designing, developing, verifying, deploying, using, updating and monitoring Predictive Models, "including a description of methods used to detect and address errors, performance issues, outliers, or unfair discrimination in the insurance practices resulting from the use of the Predictive Model". Section 3.0 asks the Program to document the Insurer's risk identification, mitigation and management framework and internal controls for AI Systems generally and at each life-cycle stage, addressing: the oversight and approval process for development, adoption or acquisition of AI Systems and identification of constraints and controls on automation and design to align and balance function with risk (3.1); data practices and accountability procedures including data currency, lineage, quality, integrity, bias analysis and minimization, and suitability (3.2); management and oversight of Predictive Models including algorithms used therein — inventories and descriptions, detailed development-and-use documentation, and assessments such as interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, model drift and the auditability of these measurements where appropriate (3.3); validating, testing and RETESTING as necessary to assess the generalization of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate and audit the model, where validation "can take the form of comparing model performance on unseen data available at the time of model development to the performance observed on data post-implementation, measuring performance against expert review, or other methods" (3.4); protection of non-public information, particularly consumer information, "including unauthorized access to the Predictive Models themselves" (3.5); data and record retention (3.6); and a narrative description of the model's intended goals and objectives and how the model is developed and validated to ensure the AI Systems relying on it correctly and efficiently predict or implement those goals (3.7). Section 4.0 covers third-party AI Systems and data: the Program should address the process for acquiring, using or relying on (i) third-party data to develop AI Systems and (ii) AI Systems developed by a third party, which may include standards, policies, procedures and protocols for due diligence and the methods employed to assess the third party and its data or AI Systems "to ensure that decisions made or supported from such AI Systems that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself" (4.1); "where appropriate and available", contract terms that provide audit rights and/or entitle the Insurer to receive audit reports by qualified auditing entities, and that require the third party to cooperate with the Insurer regarding regulatory inquiries and investigations related to the Insurer's use of the third party's product or services (4.2); and the performance of those contractual rights regarding audits and other activities to confirm the third party's compliance with contractual and, where applicable, regulatory requirements (4.3). Every one of these sections is textually identical to the NAIC model bulletin adopted December 4, 2023 — the sentence-level diff run this session found no departure anywhere in Sections 2, 3 or 4.

Section 4 sets out what the Department may request in an AI-focused investigation or market conduct action. Its opening sentence is the one to plan against: "Regardless of the existence or scope of a written AIS Program, in the context of an investigation or market conduct action, an Insurer can expect to be asked about its development, deployment, and use of AI Systems, or any specific Predictive Model, AI System or application and its outcomes (including Adverse Consumer Outcomes) from the use of those AI Systems, as well as any other information or documentation deemed relevant by the Department." Inquiries should be expected to include the Insurer's governance framework, risk management, and internal controls. The enumerated production list is: (1.1) information and documentation related to or evidencing the AIS Program, including (a) the written AIS Program; (b) documentation evidencing its adoption; (c) its scope, including any AI Systems and technologies NOT included in or addressed by it; (d) how it is tailored to and proportionate with the Insurer's use and reliance on AI Systems, the risk of Adverse Consumer Outcomes and the Degree of Potential Harm to Consumers; and (e) the policies, procedures, guidance, training materials and other information relating to adoption, implementation, maintenance, monitoring and oversight — specifically (i) processes and procedures for development, adoption or acquisition of AI Systems, covering (1) identification of constraints and controls on automation and design and (2) data governance and controls, any practices related to data lineage, quality, integrity, bias analysis and minimization, suitability, and Data Currency; (ii) processes and procedures for management and oversight of Predictive Models, "including measurements, standards, or thresholds adopted or used by the Insurer in the development, validation, and oversight of models and AI Systems"; and (iii) protection of non-public information including unauthorized access to Predictive Models themselves. (1.2) Information and documentation relating to the Insurer's pre-acquisition/pre-use diligence, monitoring, oversight and auditing of data or AI Systems developed by a third party. (1.3) Information evidencing implementation of and compliance with the AIS Program, including monitoring and audit activities: (a) documentation of the formation and ongoing operation of the Insurer's coordinating bodies for the development, use and oversight of AI Systems; (b) documentation of data practices and accountability procedures; (c) management and oversight of Predictive Models and AI Systems, including (i) "the Insurer's inventories and descriptions of Predictive Models, and AI Systems used by the Insurer to make or support decisions that can result in Adverse Consumer Outcomes", and (ii) as to any specific model under investigation, (1) documentation of compliance with all applicable AI Program policies, protocols and procedures, (2) information about the data used in development and oversight including source, provenance, lineage, quality, integrity, bias analysis and minimization, suitability and Data Currency, and (3) information on the techniques, measurements, thresholds and similar controls used; and (d) documentation of validation, testing and auditing "including evaluation of Model Drift to assess the reliability of outputs", the nature of which "should be reflective of the underlying components of the AI System, whether based on Predictive Models or Generative AI". Part 2 adds, where the investigation concerns third-party data or models: (2.1) due diligence conducted on third parties and their data, models or AI Systems; (2.2) the contracts themselves, "including terms relating to representations, warranties, data security and privacy, data sourcing, intellectual property rights, confidentiality and disclosures, and/or cooperation with regulators"; (2.3) audits and confirmation processes performed regarding third-party compliance; and (2.4) documentation pertaining to validation, testing and auditing including evaluation of Model Drift. Section 4 closes by noting that investigations and market conduct actions may use procedures varying in nature, extent and timing per regulatory judgment, may include "any of the continuum of market actions described in the NAIC's Market Regulation Handbook", and "may involve the use of contracted specialists with relevant subject matter expertise".

This requirement exists because Bulletin 2024-11 rewrote the NAIC model's rating bullet, and the rewrite narrows the AI-rating exposure in ways that change advice. The model states flatly that the Property and Casualty Model Rating Law "requires that property/casualty (P/C) insurance rates not be excessive, inadequate, or unfairly discriminatory", and that an Insurer must assure that AI- and Machine-Learning-developed rates, rating rules and rating plans "do not result in excessive, inadequate, or unfairly discriminatory insurance rates with respect to all forms of casualty insurance—including fidelity, surety, and guaranty bond—and to all forms of property insurance—including fire, marine, and inland marine insurance". Oklahoma's bulletin instead says the Property and Casualty Competitive Loss Cost Rating Act, 36 O.S. §§ 981-998, "requires that property/casualty (P/C) insurance rates not be excessive, inadequate, or unfairly discriminatory WHEN the Oklahoma Insurance Commissioner finds the Oklahoma insurance market is no longer a competitive market. Oklahoma law requires that rates in a competitive market shall not be inadequate or unfairly discriminatory", and that the insurer must assure AI-developed rates "do not result in insurance rates that do not comply with Oklahoma law with respect to all forms of property and casualty insurance—EXCLUDING those listed in 36 O.S. § 983(1) through (5)". Both edits are accurate to the statute, and both matter. SCOPE: 36 O.S. § 983 provides that the Act "applies to all forms of property and casualty insurance written in this state by insurers licensed in this state" but "shall not apply to: 1. Reinsurance; 2. Life insurance; 3. ACCIDENT AND HEALTH INSURANCE; 4. Insurance of vessels or craft, their cargoes, marine builders' risks, marine protection and indemnity, or other risks commonly insured under marine, EXCLUDING INLAND MARINE, insurance as determined by the Commissioner; and 5. Title insurance." So the bulletin's rating hook does not reach accident and health business at all — which is the largest premium block in the state — nor life, reinsurance, ocean marine or title; inland marine stays in. STANDARD: 36 O.S. § 984(A) provides that "A competitive market is PRESUMED to exist for a line of insurance unless the Commissioner, after a hearing, issues an order stating that a reasonable degree of competition does not exist in the market", with the burden on the party asserting non-competitiveness and any such order expiring no later than one year after issue unless renewed after a further hearing and finding. § 985(A)(1) then provides that "No rate in a COMPETITIVE market may be determined to be excessive", and § 985(A)(3) narrows the discrimination test drastically for the default case: "No rate in a competitive market shall be considered unfairly discriminatory unless it classifies risk on the basis of RACE, COLOR, CREED, OR NATIONAL ORIGIN." § 985(F) repeats the classification bar. The practical consequence for an AI rating model in the default competitive market is that neither an excessiveness challenge nor a proxy-discrimination or disparate-impact challenge is available under the rating act itself — the statutory unfair-discrimination test is limited to explicit classification on those four bases — so the live rating-law risk is inadequacy under § 985(A)(2) (which itself requires BOTH that the rate be clearly insufficient to sustain projected losses, expenses and special assessments AND that it be unreasonably low with a monopolistic tendency), while the real AI-bias exposure routes through the unfair trade practice and unfair claims settlement statutes instead. THIS IS NOT STABLE — A LIVE PROCEEDING COULD FLIP IT FOR HOMEOWNERS: the Oklahoma Insurance Department's own Legal Division notices list carries "Notice of Hearing Pursuant to 36 O.S. § 984 as to whether the Oklahoma Homeowners Insurance Market is Noncompetitive", dated 07/14/2026, followed by a "Notice of Prehearing Conference" dated 07/31/2026, with the hearing announced for September 2026. Commissioner Mulready denied a request for such a hearing in April 2026 and then called an identical hearing on May 20, 2026 after legislators and the Attorney General publicly challenged his competitive-market position. If an order of non-competitiveness issues for homeowners, § 985(A)(1) turns the excessiveness test ON for that line, § 985(B) brings the full actuarial due-consideration list into play, and the narrowed § 985(A)(3) discrimination test ceases to shelter homeowners rating models — so any AI-driven homeowners rating or pricing programme in Oklahoma should be built to survive a standard that is not currently in force but is under active adjudication, and any such order lapses after one year unless renewed.

Oklahoma already regulates algorithmic personal-lines scoring by statute, and neither Bulletin 2024-11 nor the NAIC model mentions it. 36 O.S. § 952(8) defines an "insurance score" as "a number or rating that is derived from an ALGORITHM, computer application, MODEL, or other process that is based in whole or in part on credit information for the purposes of predicting the future insurance loss exposure of an individual applicant or insured" — a definition that captures a machine-learning model as squarely as it captures a 2003-vintage scorecard. The act applies to "personal insurance" only, defined at § 952(9) as private passenger automobile, homeowners, motorcycle, mobile-homeowners and noncommercial dwelling fire policies and boat, personal watercraft, snowmobile and recreational vehicle policies, individually underwritten for personal, family or household use, and by § 951 it does not reach commercial insurance. Within that scope the duties are hard law, not guidance. PROHIBITED INPUTS, § 953(1): an insurer shall not "Use an insurance score that is calculated using income, gender, address, zip code, ethnic group, religion, marital status, or nationality of the consumer as a factor" — note that ADDRESS and ZIP CODE are named, which forecloses the most common geographic proxy in a credit-based model. NO SOLE-BASIS AUTOMATION, § 953(2)-(4): an insurer shall not deny, cancel or fail to renew a personal insurance policy solely on the basis of credit information without consideration of another applicable underwriting factor independent of credit information and not prohibited by § 953(1); shall not base renewal rates solely upon credit information; and shall not take adverse action solely because the consumer lacks a credit card account. DATA CURRENCY AS A LEGAL DUTY, § 953(6)-(7): an insurer may not take adverse action based on credit information unless it obtains and uses a credit report or insurance score calculated within ninety (90) days from the date the policy is first written or renewal is issued, and may not use credit information unless it recalculates the score or obtains an updated report at least every thirty-six (36) months, with an on-request reunderwrite and rerate at annual renewal (not more than once in a twelve-month period) and four enumerated exceptions in § 953(7)(c). PROHIBITED NEGATIVE FACTORS, § 953(8): consumer-initiated and insurance-related credit inquiries, medical-industry-coded collection accounts, and clustered home-mortgage or automobile-lending inquiries made within thirty days of one another may not be used as negative factors. EXTRAORDINARY-LIFE-EVENT EXCEPTIONS, § 953.1: on written request on a Commissioner-provided form, the insurer shall provide reasonable exceptions to its rates, rating classifications, company or tier placement or underwriting rules for a consumer whose credit information was directly influenced by a declared catastrophe, serious illness or injury to the consumer or an immediate family member, death of an immediate family member, divorce or involuntary interruption of legally owed support, identity theft, involuntary unemployment of three months or more, overseas military deployment, or other events determined by the Commissioner. EXPLAINABILITY ON ADVERSE ACTION, § 956: the insurer must notify under 15 U.S.C. § 1681m(a) AND "Provide notification to the consumer explaining the reason for the adverse action. The reasons must be provided in sufficiently clear and specific language so that a person can identify the basis for the insurer's decision ... Such notification shall include a description of up to four factors that were the primary influences of the adverse action. The use of generalized terms such as 'poor credit history', 'poor credit rating', or 'poor insurance score' does not meet the explanation requirements of this subsection." MANDATORY MODEL FILING, § 957: "Insurers that use insurance scores to underwrite and rate risks MUST FILE their scoring models or other scoring processes with the Insurance Department. A third party may file scoring models on behalf of insurers", and any such filing "is considered trade secret under Section 85 et seq. of Title 78" — so the confidentiality objection to filing a proprietary model is already answered by statute. § 955 requires an application-stage disclosure that credit information may be obtained and supplies safe-harbour wording; § 958 requires the insurer to indemnify, defend and hold agents harmless for actions taken following the insurer's instructions; § 959 bars consumer reporting agencies from selling lists derived from insurance credit inquiries.

Oklahoma has no AI-in-claims statute, but its Unfair Claims Settlement Practices Act already constrains automated adjudication in three specific ways an AI programme must be designed around. FIRST, THE GENERAL-BUSINESS-PRACTICE THRESHOLD. 36 O.S. § 1250.3(A) applies the Act "to all claims arising under an insurance policy or insurance contract issued by any insurer", and § 1250.3(B) provides that an act listed in § 1250.5 is an unfair claim settlement practice only if "1. It is committed flagrantly and in conscious disregard of this act or any rules promulgated hereunder; or 2. It has been committed with such frequency as to indicate a general business practice to engage in that type of conduct." A one-off model error is therefore not a UCSPA violation — but a model that errs systematically is by definition committed "with such frequency as to indicate a general business practice", which is why claims automation raises rather than lowers UCSPA risk. SECOND, THE HUMAN-REVIEWER REQUIREMENT FOR MEDICAL NECESSITY, which is the single most important provision in Oklahoma law for health-claims AI. 36 O.S. § 1250.5(10) makes it an unfair claim settlement practice to deny "payment to a claimant on the grounds that services, procedures, or supplies provided by a treating physician, hospital, or person or entity licensed or otherwise authorized to provide health care services were not medically necessary UNLESS the health insurer or administrator, as defined in Section 1442 of this title, FIRST OBTAINS AN OPINION FROM ANY PROVIDER OF HEALTH CARE LICENSED BY LAW AND PRECEDED BY A MEDICAL EXAMINATION OR CLAIM REVIEW, to the effect that the services, procedures or supplies for which payment is being denied were not medically necessary." An AI System cannot supply that opinion: the statute requires a licensed human provider whose opinion is preceded by a medical examination or claim review. The paragraph continues: where claims for mental health or substance use disorder treatments and services are under review, "the reviewing health care provider shall have appropriate, qualified, and specialized credentials with respect to the services and treatments"; on written request of a claimant, treating physician, hospital or authorized person or entity, the opinion "shall be set forth in a written report, PREPARED AND SIGNED BY THE REVIEWING PHYSICIAN", detailing which specific services, procedures or supplies were not medically necessary and "an explanation of that conclusion", to be mailed within fifteen (15) days after receipt of the written request; and "physician" for this purpose means a person licensed to practice medicine and surgery, osteopathic medicine, podiatric medicine, dentistry, chiropractic or optometry under Title 59. § 1250.5(11) closes the obvious workaround by making it an unfair claim settlement practice to compensate a reviewing physician "on the basis of a percentage of the amount by which a claim is reduced for payment" — an incentive-design constraint that reaches any scheme tying reviewer compensation to model-flagged savings. THIRD, THE CLAIM-FILE RECONSTRUCTABILITY DUTY at 36 O.S. § 1250.4(A): claim files "shall contain all notes and work papers pertaining to a claim in such detail that pertinent events and the dates of such events can be reconstructed", with a 20-calendar-day electronic response duty to Commissioner inquiries under § 1250.4(B) and a 30-day response duty to claimant communications under § 1250.4(C). The substantive § 1250.5 duties an automated pipeline is most likely to breach are paragraph 3 ("Failing to adopt and implement reasonable standards for prompt investigations of claims"), paragraph 4 ("Not attempting in good faith to effectuate prompt, fair and equitable settlement of claims submitted in which liability has become reasonably clear"), paragraph 1 (failing to fully disclose to first-party claimants benefits, coverages or other provisions pertinent to a claim), paragraph 2 (knowingly misrepresenting pertinent facts or policy provisions), and paragraph 16 (failing to pay, or requesting a refund of, payment for health care services where the plan or its agent already provided preauthorization or precertification and verification of eligibility, subject to fraud, preexisting-exclusion and unpaid-premium exceptions).

Oklahoma's Ensuring Transparency in Prior Authorization Act, enacted as HB 3190 (2024 Regular Session, Rep. Carl Newton and Sen. Jessica Garvin; approved by the Governor May 15, 2024; codified by Laws 2024, c. 303 at 36 O.S. §§ 6570.1-6570.11, effective January 1, 2025), contains no artificial-intelligence language at all — and constrains automated denial more tightly than several AI-specific acts do. 36 O.S. § 6570.3 provides that "A utilization review entity shall ensure that ALL adverse determinations are made by a physician or licensed mental health professional", who shall "1. Possess a current and valid nonrestricted license in any United States jurisdiction; 2. Have the appropriate training, knowledge, or expertise to apply appropriate clinical guidelines to the health care service being requested; and 3. Make the adverse determination under the clinical direction of one of the utilization review entity's medical directors who is responsible for the provision of reviewing health care services to enrollees of Oklahoma. All such medical directors must be physicians licensed in any United States jurisdiction." An AI System may support the review but cannot BE the adverse determination, and the determination must sit under a named, licensed medical director's clinical direction. § 6570.4 imposes a stricter, independent standard on APPEALS: every appeal must be reviewed by a physician or licensed mental health professional who holds a current valid unrestricted license, is "of the same or similar specialty as a physician or licensed mental health professional who typically manages the medical condition or disease" (board certification in the same or similar specialty, or training and experience that includes treating the condition and its complications and is sufficient to determine medical necessity or clinical appropriateness), "Not have been directly involved in making the adverse determination", "Not have any financial interest in the outcome of the appeal", and "Consider all known clinical aspects of the health care service under review", including pertinent and relevant medical records and any pertinent medical literature supplied by the provider. TIMEFRAMES AND DEEMED AUTHORIZATION, § 6570.6: a prior authorization or adverse determination must be made and notified within seventy-two (72) hours for urgent health care services and within seven (7) days for non-urgent services, in each case measured from obtaining all necessary information, where "necessary information" includes but is not limited to the results of any face-to-face clinical evaluation or second opinion that may be required; and § 6570.6(B) provides that for providers who submit all necessary information through the entity's authorized prior authorization system, "health care services are DEEMED AUTHORIZED if a utilization review entity fails to comply with the deadlines set forth in this section" — so an AI-assisted workflow that stalls does not merely risk a sanction, it grants the benefit. § 6570.6(C) requires the approval notice to state the duration or expiry date of the authorization. TRANSPARENCY AND CHANGE CONTROL, § 6570.2: current prior authorization requirements and restrictions "including written clinical criteria" must be readily accessible on the entity's website to enrollees and providers, described in detail but in easily understandable language; a new or amended requirement or restriction may not be implemented unless the website has first been updated to reflect it, and contracted providers credentialed to perform the service, and enrollees with a chronic condition already receiving the affected service, must receive notice "no less than sixty (60) days before the requirement or restriction is implemented" — which functions as a change-control gate on retraining or re-tuning a model that embodies the clinical criteria. FURTHER DUTIES: § 6570.5(A) requires a health benefit plan to implement and maintain a Prior Authorization Application Programming Interface as described in 45 C.F.R. Part 156 for plan years beginning on or after January 1, 2027, with providers required to hold compatible electronic health record or practice management systems by July 1, 2027; § 6570.5(C) requires the entity to staff inbound telephone lines at least eight hours a day during normal business hours, to receive inbound communications after hours, and to "Provide a treating provider with the opportunity to discuss a prior authorization denial with an appropriate reviewer". § 6570.7 bars prior authorization for pre-hospital transportation, emergency health care services and EMTALA transfers. § 6570.8 bars revoking, limiting, conditioning or restricting a prior authorization where care is provided within forty-five (45) business days of the provider receiving it, subject to five enumerated exceptions, and requires payment at the contracted rate. § 6570.9 fixes minimum validity periods for chronic-condition authorizations.

Oklahoma enacted a second, drug-specific prior-authorization act in the 2025 Regular Session: HB 1808 (Rep. Carl Newton, Sen. Dave Rader), which passed the House 88-7 and the Senate 42-1, went to conference, was adopted 80-7 and 42-0 on May 22, 2025, and BECAME LAW WITHOUT THE GOVERNOR'S SIGNATURE on May 29, 2025 — a disposition worth recording, since a bill that becomes law without signature is as binding as a signed one and is routinely missed by trackers keyed to gubernatorial action. It is codified by Laws 2025, c. 447 at 36 O.S. §§ 6570.50-6570.59, effective November 1, 2025. Its structure parallels the 2024 medical-services act but for prescription drugs, and it is the act that supplies an EXPRESS penalty. § 6570.50 defines "adverse determination" as a determination by a health carrier, pharmacy benefits manager (PBM), or its designee utilization review entity that a covered prescription drug "does not meet the health plan's or PBM's requirements for medical necessity, appropriateness, health care setting, level of care, or effectiveness" and is therefore denied, reduced or terminated, and defines "clinical criteria" expansively as "the written policies, written screening procedures, determination rules, determination abstracts, clinical protocols, practice guidelines, medical protocols, and any other criteria or rationale used by the utilization review entity to determine the necessity and appropriateness of prescription drugs" — language broad enough to capture a model's decision rules and thresholds. § 6570.51 requires online accessibility for prescription drug prior authorization requirements and formularies; per the Oklahoma Insurance Department's own Bulletin No. 2025-04 (September 30, 2025, covering HB 1808 and HB 1811), plan formularies must be posted online and, BY OCTOBER 1, 2026, all health plans must annually submit a secured webpage link for the plan's formulary to the Insurance Commissioner via SERFF. § 6570.52 requires adverse determinations to include alternative covered prescription drugs. § 6570.53 requires that all appeals be reviewed by a physician, pharmacist or licensed mental health professional holding a current valid unrestricted license, of the same or similar specialty as one who typically manages the condition, who was "Not have been directly involved in making the adverse determination", has no financial interest in the outcome, and considers all known clinical aspects including pertinent medical records and literature supplied by the provider — with appeals from a pharmacist reviewable by another licensed pharmacist. § 6570.54 sets sharper clocks than the medical-services act: prior authorization or adverse determination within TWENTY-FOUR (24) HOURS for urgent prescription drugs and within FOUR (4) BUSINESS DAYS for nonurgent, measured from obtaining all necessary information, with the same deemed-authorization default in § 6570.54(B) where the provider submitted through the entity's authorized system and the entity misses the deadline, and the same duty in § 6570.54(C) to state the duration or expiry of an approval. § 6570.55 bars prior authorization for prescription drugs administered as part of emergency health care services. § 6570.56 fixes validity periods for chronic-condition drug authorizations. § 6570.57 preserves continuity of prior authorizations across health plan changes, allowing the entity to perform a simultaneous review during the continuity window. § 6570.59 provides that "This act shall apply to the Oklahoma Medicaid State Plan." A companion 2025 act, HB 1811 (also effective November 1, 2025), reduced the time a provider has to submit a prior authorization request for continued inpatient chronic-condition care from 72 hours to twenty-four (24) hours prior to termination of the previously approved authorization. NEITHER ACT CONTAINS ANY ARTIFICIAL-INTELLIGENCE, ALGORITHM OR AUTOMATED-DECISION LANGUAGE — confirmed against the statutory text and against the Department's own bulletin summarising both bills.

Oklahoma has the second-largest Native American population in the US. The Five Civilized Tribes (Cherokee, Choctaw, Chickasaw, Creek, Seminole) operate significant commercial enterprises (gaming, healthcare, retail). AI deployed on tribal land by tribal enterprises is subject to tribal law, not state law. Federal laws (FTC, EEOC, FCRA) still apply on tribal land through federal jurisdiction. Enterprises must clarify applicable legal framework before deploying AI in tribal business operations.

Monitor oklegislature.gov for new AI legislation. Beyond the enacted HB 1364 (AI-generated nonconsensual intimate images), Oklahoma has seen repeated ELECTION synthetic-media / deepfake bills that, as of August 2026, were NOT enacted — HB 3825 (2024) and HB 3299 (2026) advanced through committee but were not confirmed signed, and SB 894 (2025) was conditional/pending. Treat those as pending, not law, until confirmed signed. RESOLVED WATCH ITEMS — do not re-open these as pending: SB 1521 (AI chatbot disclosure/minor-safety/AG enforcement/civil penalty) and HB 3544 (ban on social-AI-companion chatbots for under-18s) both passed their chambers by unanimous or near-unanimous votes but DIED at the 2026-05-14 sine die adjournment without reaching the Governor. Two further AI bills also died in the 59th Legislature, each verified on the Legislature's own BillInfo action log rather than on a tracker: HB 1916 (2025, Rep. Alonso-Sandoval), which would have created a "Responsible Deployment of AI Systems Act" with an AI Council, an AI Regulatory Sandbox Program and an AI Workforce Development Program, never moved past "Second Reading referred to Rules" on 2025-02-04 and shows no 2026-session action; and HB 3675 (2026, Rep. Provenzano), "Health insurance; review agents; artificial intelligence system; adverse determinations", was withdrawn from both the Insurance and the Commerce and Economic Development Oversight committees on 2026-02-11, referred to Rules, and moved no further. Oklahoma consequently has NO AI-specific insurance or utilization-review statute; the operative constraints are the general ones (36 O.S. § 6570.3 physician-made adverse determinations, § 1250.5(10) licensed-reviewer medical-necessity opinions, §§ 950-959 credit-based scoring-model filing) modelled elsewhere in this entry. WATCH ITEM WITH A DATE: the Oklahoma Insurance Department noticed a hearing under 36 O.S. § 984 on 2026-07-14, with a prehearing conference noticed 2026-07-31 and the hearing announced for September 2026, on whether the Oklahoma HOMEOWNERS insurance market is noncompetitive — an order of noncompetitiveness would switch on rate standards (excessiveness, and the full unfair-discrimination test) that do not currently apply to homeowners rating models. Oklahoma's energy sector and tribal enterprises may drive sector-specific AI regulation. Oklahoma legislature meets annually February–May.