You might file a pilot for acne cream under small news. Before you do, set two Utah documents side by side. They carry the same two signatures, five months apart.
The first is dated April 21, 2026. The day before, 11 of the 14 members of Utah's Medical Licensing Board had asked that a prescription-renewal pilot run by a company called Doctronic, which they said they learned of only after launch, be "immediately suspended pending further discussion." Mark Steinagel, director of the Division of Professional Licensing (DOPL), and Zach Boyd, director of the Office of Artificial Intelligence Policy, declined, and assured the board: "The AI system is strictly prohibited from handling controlled substances, modifying treatment plans, or initiating new prescriptions."
The second, signed by Boyd on September 21 and Steinagel on September 22, lets an app from Nolla Health "issue orders for first-time topical acne prescriptions and renewals" to Utah adults. "All prescriptions issued under the pilot," it adds, "will be transmitted under the NPI of the overseeing physician." (An NPI, or National Provider Identifier, is the ID number that identifies a prescriber.)
To be fair to April, that sentence described Doctronic's renewal pilot, and it is still true of Doctronic; it was never a statewide rule. But it was the answer the board got when it asked the state to stop, and five months later the same two offices signed off on one of the three things it ruled out. In short: if you're an adult in Utah with mild to moderate acne, an app can now start your first prescription, with two physicians checking each one before it goes out — for now.
So what exactly did Utah sign?
Utah's AI office runs a regulatory sandbox, which, in Boyd's words as quoted by KSL, lets a company "run a business model that is kind of different from the normal regulations for a little while" so the state can judge the results. As of October 13, 2026, the public record of those agreements lists Nolla's and Doctronic's pilots as active; Legion Health's, August AI's and Expect Fitness's as approved but not yet started; master agreements with University of Utah Health and Intermountain Health, with no pilot approved; and expired ones with Dentacor and ElizaChat.
What does Nolla's agreement relax? DOPL agreed to "forgo any enforcement action," for this function only, under the laws against practicing a licensed profession while "not licensed to do so" and the unlawful- and unprofessional-conduct sections of the medical, osteopathic and pharmacy acts, a protection that extends to the physicians who rely on the system. Utah's telehealth law bars prescribing "based solely on" an online questionnaire; the app is "deemed not in violation" if it follows the agreement's protocols. And the requirement that a telehealth provider hold an active license "shall not apply" to it.
Most of this is standard sandbox machinery. Doctronic's 2025 agreement carries the same two telehealth carve-outs. August AI's refill agreement, signed in early October, puts the NPI of an "accountable prescriber of record" on each refill, and the office's Doctronic page says "there is always a physician's name attached to a prescription authorization." A doctor's number is standard across Utah's AI prescription pilots — what is new is the first prescription.
How does the software choose? Per the company's proposal, which the agreement adopts, a vision model grades your acne from photos of your face, and "a large language model (LLM) inference layer" picks a formula "from the approved formulary." The company stresses that the prescription flow has "no free-text interface" (a language model choosing from a fixed menu, in other words).
What keeps a human in the loop? Stages. In Stage 1 (at least four weeks and 100 patients), "each prescription during Stage 1 is reviewed by two independent Utah-licensed physicians" before it is sent. In Stage 2 (at least eight weeks; "Minimum patients: 500 (cumulative)"), the "AI submits directly" and a physician reviews every case afterward, at least weekly. Stage 3 ("Minimum patients: 750 (cumulative)") moves to a monthly review of "a minimum of 10% of enrollment volume," plus every escalation and adverse event. Each step needs the office's "prior written approval," and the yardstick is spelled out: "Physician agreement with AI recommendations is the primary safety metric for the pilot."
Even the state describes the pilot two ways. Its October 5 announcement spoke of "AI-assisted visual evaluations and treatment pathways for mild-to-moderate acne, under specialist oversight"; the agreement covers technology "that autonomously issues orders for first-time topical acne prescriptions." The first is where the pilot starts, the second where it is built to go. Nolla's chief executive, Luis Wenus, was plainer: "Our AI can now make that prescribing decision itself," he said, according to the Daily Caller. (In Stage 1, two physicians still approve each one first.) The agreement calls itself "a grant of regulatory mitigation only," not an endorsement.
Isn't acne the safest place to start?
It may be, and the case deserves a hearing. The pilot is limited to adults with mild to moderate acne and to "a short list of creams and gels set out in the agreement." "It does not prescribe oral medication or isotretinoin, and it does not treat severe acne," the state says, and pregnancy, breastfeeding or a weakened immune system stops the process. Boyd calls acne "comparatively low risk."
The process changed after April, too. According to Bloomberg, as Quartz reported, Boyd said the state had carved out a "narrow exception" for Nolla, which he said was the first company to engage with the Utah Medical Licensing Board before receiving authorization; KSL reported him saying board members were included in the process to develop the pilot program. The board now has a working group with the AI office, and one of April's signers — William Hamilton, M.D. — sits on it. "Utah can lead the world in safety and in implementing this amazing technology," he said, according to Fierce Healthcare.
The state's evidence standards, by Boyd and Alice Schwarze, supply the analogy behind staged review: new doctors "enter the workforce as residents before having demonstrated real-world clinical competency" and "gradually gain more autonomy." The office has added outside evaluators, though its page says, "The company being evaluated pays the evaluator directly" (evaluators must certify their independence and report safety concerns). And the company argues that doctors still initiate these prescriptions "primarily due to regulatory constraints rather than clinical complexity."
So far so good. Then why does the April letter matter?
What was April's sentence worth?
It was accurate, and it still is. As of October 13, 2026, Doctronic remains in Phase 1, where a licensed practitioner authorizes every request, and the office's FAQ for its renewal pilots still says, "During these pilots, an AI tool will never prescribe new medications." True, of those pilots.
But the board asked the state to stop a program and was answered with the terms of one contract. The next contract, built from the same template, had different terms. Is that a bait and switch? I don't think the record supports the charge — nothing in April bound September.
It was predicted, too. In January, explaining why the American Medical Association objected to the refill pilot, Robert Wachter, chair of medicine at UCSF, wrote that "once AI is allowed to prescribe a refill for an existing prescription, it's only a matter of time before the bar is lowered to allow for certain new prescriptions as well." The same month, the state's announcement quoted Sen. Kirk Cullimore, whose bill created the AI office, saying the Doctronic deal "reinforces the principle of 'doctor, not device,' ensuring automation supports, rather than replaces, human judgment." He was talking about refills. By September, the bar had been lowered.
China bet big on medical AI and wrote the opposite rule
What does it look like when a country deploying medical AI at scale answers the question the other way?
China had 3,756 internet hospitals at its health commission's September 2025 count, and they handled 130 million visits in 2024. By October 2025, Xinhua reported, its regulator had approved more than 110 deep-learning software products as highest-risk (Class III) medical devices, and a 2025 national plan targets AI-assisted primary care with basically full coverage by 2030.
Yet China's 2022 rules for online medical care, issued on a trial basis by the National Health Commission and still in force, start from the opposite premise. Article 21 reads "处方应由接诊医师本人开具，严禁使用人工智能等自动生成处方" — in translation, the attending physician personally issues the prescription, and using AI or similar means to generate prescriptions automatically is strictly prohibited. Article 13 says AI software may not stand in for the physician, and the rules encourage provinces to use AI to supervise online care: AI to watch the doctors, not replace them.
The rule has been repeated, not relaxed. Hunan's medical-insurance regulator repeated the ban in 2025 and tied it to insurance payment, even as, China Daily reported, "In clinical practice, DeepSeek is being used for decision support." Tianjin requires an online prescription to carry the physician's electronic signature and a pharmacist's approval before it takes effect. In May 2026, the national drug regulator told online platforms to identify and intercept AI prescriptions. Global Times reported the view of Zhuang Yiqiang, a former secretary of the Chinese Hospital Association, that an AI doctor is, in the paper's words, "first and foremost a machine, not a human being, so it is impossible for it to have the right to prescribe."
Now the fair counterpoint. China restrains AI prescribing, not AI; its plan even wants AI reviewing doctors' prescriptions. The rule is partly about fraud: Hunan's notice complains of fake prescriptions and drugs handed out before any prescription. It is stricter than many Americans might want: under Article 18, if a doctor judges a visit to be a first visit, the online consultation must stop, even when the doctor is human. And enforcement is imperfect. In 2025 a researcher told Science and Technology Daily, in a report People's Daily republished, that online care is harder to supervise, and the 2026 order to intercept AI prescriptions suggests, by my reading, that some still circulate.
So a doctor's name means different things. In China, it belongs to the doctor who issued the prescription. In Utah's design — by the last stage — it belongs to the physician overseeing the software.
Now picture the last stage
What follows is my extrapolation from the documents, not a forecast about Nolla or anyone else.
Say it is the summer of 2027 and the office has approved every stage (it may approve none). You scan your face, and a cream is ordered under the NPI of a physician whose network samples at least 10 percent of each month's cases, after the fact. In a month of a thousand patients, that could mean as few as a hundred reviews, plus escalations. All thousand prescriptions carry a doctor's number.
Then the list grows. Nolla's chief medical adviser, Zaid Fadul, said the service could one day reach patients "from 13 [years old] and up" if "the data proves out," according to KSL, and he told Inc., as SiliconANGLE reported, that the flu and uncomplicated urinary tract infections "are worth exploring." Each would need new terms, since this agreement covers acne only, but terms can last: the statute allows up to two extensions.
And the model travels. "Once we've proven it in Utah, then we can prove it everywhere," said Nirav Shah of Stanford's Clinical Excellence Research Center, one of the state's evaluators, which are paid by the companies they check. A bill in Congress, H.R. 238 from Rep. David Schweikert (R-AZ), would let AI count as a prescribing practitioner if "authorized pursuant to a statute of the State involved" and approved or cleared by the FDA; as of October 13, 2026, it has not moved since its referral to committee in January 2025. (Whether a sandbox agreement would even count is an open question.) Picture an AI prescriber proven in the friendliest sandbox and then offered everywhere.
Alarmed, hopeful and somewhere in between
Who's worried? Mostly doctors, and mostly about the refill pilot, since Nolla's agreement is weeks old. "We were essentially told: 'Yes this is going on. And no, you don't have a say in it,'" the board's chair, Alan Smith, said, according to the Associated Press; he was speaking only for himself. The AMA's chief executive, John Whyte, said in January that medicine is "about judgment, context, and accountability." Public Citizen, which backed the board's call to suspend Doctronic, was blunter: "No software application holds a medical license." Eric Bressman, a Penn physician-researcher, warned of a playbook in which companies "deploy first while promising to study performance later." Doctronic says it is "participating in the process as designed, with defined safeguards, physician oversight of every prescription in the first phase of the program, and continued physician involvement throughout."
In between, Stanford's Michelle Mello wrote that the refill pilot "deserves thoughtful analysis—not dismissal out of hand." Wachter wrote, "Personally, I'd have no problem using this system to refill my Lipitor," but warned that "you can bet that the doctor will be the one being sued." Remember that when a doctor's number is on the order.
On the hopeful side, Hodan Omaar of the Center for Data Innovation argued that broad restrictions "block good AI too," and Samuel Hammond and Blaine Dillingham of the Foundation for American Innovation, a Washington tech-policy think tank, praised the sandbox for "side-stepping incumbent interest groups who can more easily lobby against reforms on a case-by-case basis," while flagging "risks of preferential treatment."
Put the watchdog and the think tank side by side and they describe the same mechanism (Public Citizen says the AI office "is not a medical licensing authority"; FAI praises a design that routes around incumbents), and they disagree only on whether that is the point or the problem.
What does this mean for you?
If the app is offered to you in Utah, read the disclosure. It must tell you that you're "interacting with generative artificial intelligence" in a temporary pilot under an agreement with the AI office, and you must acknowledge that before the AI does anything.
Ask for a human. You can message a licensed physician at any hour (the proposal puts typical replies within 24 hours) and request a free case review at any point.
Know the real price. It's $4.99 a month during the pilot; the compounded option is $49.99, or you can fill a generic at your own pharmacy, which the company says typically runs $10 to $40 at retail.
Ask your pharmacist. The pharmacy is told "the prescription was generated by artificial intelligence technology" and given physicians to call.
Read the terms you accept in the app. The agreement says pilot terms "shall not disclaim, limit, restrict, or exclude" the company's liability for physical, medical or legal harm from the outputs of the AI the agreement authorizes. Its public website terms, last updated July 26, 2025, cap its liability at $500; the in-app pilot terms aren't public, so check what you're shown. (In May, the office proposed striking a Doctronic clause saying the company "cannot be held liable for medical malpractice.")
Complain to the right office. Pilot concerns: email ai@utah.gov and "name the pilot." A clinician's conduct: the Division of Professional Licensing, the same division that agreed not to enforce certain rules here. Misleading claims: the Division of Consumer Protection; as the AI office's page puts it, "An agreement with this office is no defense to a consumer protection violation." You needn't live in Utah to write to the AI office.
Watch the reports. Nolla's first monthly report is due November 15, 2026, but the office treats such reports as protected records where the law allows; only the quarterly reports, the first around January 15, 2027, are promised to be "available to the public."
The lesson, as I see it
A reassurance is only as wide as the document it sits in. April's sentence was true about one pilot, it was given to a board that wanted that pilot stopped, and it said nothing about the next agreement. Every prescription under the new one carries a doctor's number — at Stage 1, two doctors read each one; at Stage 3, a doctor may never see yours.
What should you watch? Doctronic's term ends October 24, 2026; as of October 13, no extension had been posted. The office must report annually, before November 30, to a legislative committee. Any move to Stage 2 needs the office's written approval, so watch whether it is announced, and on what numbers. And watch Pennsylvania, whose State Board of Medicine sued Character.AI in May over what it alleges is "the unlawful practice of medicine and surgery" (the company's disclaimers say its characters "should be treated as fiction"); as of October 13, 2026, there is no ruling. Utah's board, the state's April reply noted, "serves in an advisory capacity."
My vote? Let the evidence decide how far the software goes, and decide it in the open: publish the monthly numbers on how often doctors agree with the AI instead of filing them as protected records, and give the board's working group a formal say before review drops from every case to a sample. If a doctor's number is going to stand for a decision software made, that deserves a debate in the Legislature, not just a scope line in a contract. If the numbers hold up, Utah will have something rare: evidence. If they stay in a drawer, it will have a precedent instead.
The HAIA Foundation exists to help the public understand the AI being written into their lives, one contract at a time. If you'd like to read the next one with us before the next stage is signed, subscribe.