The Short Answer
Utah granted Nolla Health regulatory mitigation, not approval, for AI-issued first-time topical acne prescriptions. The agreement requires two independent physicians to approve every prescription for the first 100 patients, weekly review of all cases through 500, and sampling only after 750. The state bought an audit trail, which is the same control ibl.ai gives you when you own all the code and the data.
The headline version of this story is that a US state removed the physician from first-time prescribing. The agreement is public, and it says otherwise.
What Utah did is narrower, better documented, and more useful to anyone deploying clinical AI, because the thing the state asked for was evidence it could read.
Did Utah authorize AI to prescribe without physician review?
No. Review is staged by patient count, and the first stage requires two physicians per prescription.
The agreement between Utah's Office of Artificial Intelligence Policy, the Division of Professional Licensing, and Magic Health, Inc. with its subsidiary Magic Health Services, LLC, doing business as Nolla Health, sets out three stages.
| Stage | Minimum | Who submits the prescription | Physician review |
|---|---|---|---|
| Stage 1 | 4 weeks, 100 patients | AI submits to staging only | Every prescription approved before submission, by two independent Utah-licensed physicians |
| Stage 2 | 8 weeks, 500 cumulative | AI submits directly | Retrospective review of all cases, at least weekly |
| Stage 3 | 750 cumulative | AI submits within approved scope | Monthly sampling of at least 10% of enrollment, every adverse event or escalation reviewed in full |
Concordance is measured on 100 percent of cases in both Stage 1 and Stage 2. The gate criteria are numeric: 95 percent or better concordance, zero missed hard stops after QA, zero serious adverse events, and in Stage 1, 100 percent completion of physician pre-review.
Crucially, advancement is not automatic. The agreement states that Nolla "shall not commence any succeeding phase without the prior written approval of the Office."
Even the baseline that precedes Stage 1 has physicians in the loop: the AI generates recommendations and licensed physicians review, approve and submit, with reported baseline concordance of 95 percent or better over the preceding 12 weeks.
So "the AI prescribes and nobody checks" describes no stage of this pilot. The furthest-out stage still samples at least a tenth of enrollment every month, and reads every escalated case in full.
What exactly did Utah's agreement with Nolla Health permit?
A promise not to enforce, inside one narrow scope, for twelve months.
The instrument is regulatory mitigation.
The Division agrees not to bring an enforcement action for unlicensed or unprofessional conduct, or under the state's telehealth requirements, where Nolla's AI issues first-time topical acne prescriptions or renewals to eligible Utah residents aged 18 and older and transmits them to a Utah-licensed pharmacist.
The agreement is unusually direct about what it is not. In its own words, it "is a grant of regulatory mitigation only and does not constitute an endorsement or approval from the State of Utah or any of its political subdivisions."
The term runs twelve months from the Commencement Date, which the agreement defines as the date Nolla makes the technology available to customers and delivers written notice to the Office.
The clock starts on notice, not on signature. Nolla may request no more than two extensions of up to 12 months each.
Either party may terminate at any time and for any reason, and on termination Nolla is given 30 days to cease operations in Utah, which the agreement calls the Unwinding Period.
Nolla publicly launched under the agreement in early October 2026, at a pilot subscription of $4.99 per month, with a compounded formulation shipped from a pharmacy partner at a separate $49.99 charge.
Patients choose generic-to-local-pharmacy or compounded fulfillment, and the agreement notes the AI does not influence that selection.
What does Utah require Nolla Health to report, and to whom?
Monthly, quarterly and annual reports to the state, de-identified case-level data to independent auditors, and the quarterly reports go public.
This is the part most coverage skipped, and it is the reason the pilot is interesting rather than alarming.
Nolla must submit monthly, quarterly and annual reports to the Office at ai@utah.gov for the duration of the agreement, with contents specified in the agreement's Schedule A.
Subject to the Office's confidentiality obligations, the Office makes the quarterly reports available to the public as submitted. An outside reader gets to watch the concordance rate.
Separately, Nolla shares de-identified individual-level pilot data with third-party auditors vetted by the Office for external validation on a monthly, quarterly and annual basis, and must meet the minimum sample sizes the statistical protocol requires.
Records held by the Office are subject to Utah's Government Records Access and Management Act, so the agreement itself and the required reports sit inside a public-records regime, with the Office classifying the application and reports as protected records only where law permits.
What can the AI not do under Utah's prescribing pilot?
Quite a lot, and the exclusions are written as automatic stops rather than guidance.
Eligibility is limited to adults aged 18 or older with mild to moderate acne, with severity determined by AI image assessment across a five-angle capture sequence at intake rather than by patient self-report.
Cases scoring above 3.5 on the IGA severity scale are automatically escalated to the overseeing physician for manual review before any prescription issues.
Cases classified as severe or nodulocystic at IGA 4.0 are hard-stopped and the patient is directed to in-person dermatological care.
Hard stops also cover pregnancy, intention to become pregnant or breastfeeding, known immunosuppression, severe kidney or liver disease, prior adverse reaction to any formulary medication, any presentation suggesting oral, systemic or isotretinoin-based therapy, a non-Utah delivery address, failed identity verification, and persistent insufficient image quality.
The escalation criteria are explicitly constant across all three stages. As the proposal puts it, stage gates govern the oversight level for non-escalated cases only.
Scope is bounded by formulary too: the mitigation covers topical acne treatments listed in the agreement's Schedule B, and nothing else.
Why does an AI prescribing pilot turn on observability rather than model quality?
Because the regulator could not evaluate the model, so it evaluated the record instead.
Nothing in the agreement asks about architecture, parameter count or benchmark scores.
Every obligation it imposes is a reporting or reconstruction obligation: concordance measured on 100 percent of cases, reviewed-case counts, missed hard stops after QA, serious adverse events, data handed to vetted auditors.
The proposal matches that shape, describing a system that "includes auditability, traceability, and physician escalation mechanisms throughout the care process."
This is the same pattern we traced in You Cannot Govern a Clinical Model You Cannot Observe, and the same reason single-turn benchmarks mislead on clinical agents, covered in Hospital AI Agents Fail the Actions, Not the Answers.
It also runs into a live infrastructure gap. The telemetry standard that would let an operator correlate an agent decision across its memory, model and tool layers is still unreleased, as we documented in AI Agent Observability Has No Standard to Buy Yet.
A pilot that must produce weekly 100-percent case review and public quarterly concordance figures cannot treat that as someone else's problem.
What should a health system take from Utah's AI prescribing agreement?
That permission followed the ability to produce evidence, and evidence is an infrastructure property.
Nolla did not get further than any competitor because of a better model. It got a twelve-month, narrowly scoped non-enforcement promise because it could commit to staged gates, numeric thresholds, auditor access and public reporting, and be held to them.
Any organization wanting to be on the authorized side of that line needs the same capacity: per-decision provenance, retrospective review at a defined sampling rate, escalation that is enforced rather than advised, and exports its auditors can read.
Those are properties of the stack you run, and they survive only if you keep them.
On ibl.ai you receive the source under a perpetual license and run it inside your own perimeter, so the audit trail, the retention policy and the export format are yours, including in a deployment with no outbound connectivity at all.
Utah's agreement is a reminder of which half of the AI question regulators are actually asking. It is not what the model can do. It is what you can show.
Sources: the parties, the "regulatory mitigation only and does not constitute an endorsement or approval" language, the scope of non-enforcement, the twelve-month term measured from the Commencement Date, the two-extension limit, the 30-day Unwinding Period, the reporting obligations to ai@utah.gov, the public release of quarterly reports, the OAIP-vetted third-party auditor data sharing, the GRAMA treatment, the Stage 1 to Stage 3 gates with their patient minimums and concordance criteria, the prior-written-approval requirement for stage advancement, the IGA 3.5 escalation and IGA 4.0 hard stop, the eligibility exclusions and the Schedule B formulary limit are all read directly from the agreement published by the Utah Department of Commerce, which includes Nolla's April 2026 pilot proposal as an exhibit. The October 2026 launch, the $4.99 subscription and the $49.99 compounded-medication charge are from that document and from Becker's Hospital Review. The brief's framing that the AI prescribes "without physician review" is corrected here against the agreement's own stage gates. No signature date is stated: secondary coverage reports one, and the extracted text of the published agreement does not carry it.