States Race to Write the Rules for AI Sandboxes in Health Care, and Lobbyists Are Racing Right Alongside Them

Imagine a new medical device that could help diagnose disease faster, but instead of going through the usual years of testing and approval, it gets a special pass to operate in a controlled trial run, with fewer guardrails and less oversight than normal. That is essentially what a regulatory "sandbox" does for artificial intelligence tools in health care. States are increasingly turning to this approach as a way to let AI companies test products on real patients while regulators watch from the sidelines, learning as they go.

The idea sounds reasonable on its face. Innovation moves fast, and rigid rules written years ago were not designed for software that can learn and change. But sandboxes also mean something else: a space where the rules are still being written, often behind closed doors, by people with very different stakes in the outcome.

That is exactly what is happening right now in statehouses around the country. Lobbyists, trade groups, and medical associations are working to shape how these sandboxes function, and the stakes could not be higher for patients who may not even know their care involves an experimental AI tool. The fight centers on a deceptively simple question: who gets to decide what counts as safe enough to test on people, and who answers for it when something goes wrong.

Who's Writing the Rulebook

Health care AI already touches an enormous range of decisions, from flagging which patients might be at risk of sepsis to helping doctors draft notes to recommending treatment plans. Some of these tools operate with a human checking every output. Others are moving toward more autonomous roles, making recommendations or even decisions with less direct physician involvement.

That shift toward autonomy is precisely why the regulatory fight matters so much right now. Trade groups representing AI developers have pushed for sandbox frameworks that offer broad flexibility, arguing that overly strict rules will chill innovation and keep useful tools out of clinics that need them. Groups representing physicians, including the American Medical Association, have pushed back, arguing that patients deserve stronger protections when autonomous clinical AI makes judgment calls that used to belong to trained doctors.

This is not a hypothetical disagreement. It is playing out state by state, with different legislatures reaching different conclusions about how much testing latitude to grant and how much transparency to require. Some proposals would require companies to disclose when a sandboxed AI tool is involved in a patient's care. Others focus more on data reporting requirements for developers, with less emphasis on what patients themselves are told.

The absence of a single federal standard is part of what makes this moment so chaotic. Without one clear national rulebook, companies operating across state lines face a patchwork of sandbox rules, each with its own definition of acceptable risk. That patchwork can be good for competition and experimentation. It can also create confusion about accountability when an AI tool approved for testing in one state causes harm in another, or when a company shops around for the state with the lightest-touch sandbox.

There is a real public health logic behind caution here. Health care AI differs from, say, an experimental ride-sharing app or a drone delivery pilot. When an algorithm errs in diagnosing a condition or recommending a treatment, the consequence is not a late package. It can be a missed cancer diagnosis or a wrong medication dose. The people most likely to be affected are often the ones least equipped to question the technology, including patients who are sick, scared, and trusting that their care team has already vetted the tools being used on them.

That is why the lobbying fight over sandbox design is not just an inside-the-Beltway or inside-the-statehouse story. It shapes whether patients get a say, whether companies face consequences for failures during the testing period, and whether the public even learns which tools are being piloted on them in the first place. Sandboxes, done well, can genuinely help regulators learn fast without exposing the public to needless risk. Done poorly, they can become a loophole that lets companies avoid scrutiny while calling it innovation.

Some public health advocates have drawn a comparison to how financial regulators handled fintech sandboxes a decade ago, where early flexibility sometimes gave way to consumer harms that took years to unwind. The hope among health policy watchers is that health care regulators learn from that history rather than repeat it, building in clearer exit ramps, stronger disclosure requirements, and faster feedback loops when something in the sandbox starts to go wrong.

Why It Matters

The outcome of this regulatory tug-of-war will shape the next generation of health care AI long before most patients ever hear the term "sandbox." Rules written now, often with far more industry input than public input, will determine how quickly autonomous AI tools move from pilot programs into everyday clinical practice, and how much say patients and doctors have along the way.

For health care workers, the stakes are professional as much as practical. Doctors and nurses are being asked to trust tools whose testing standards vary wildly from state to state, with little national coordination to fall back on. For patients, the stakes are even more personal. Most people have no idea whether the recommendation their doctor just gave came from decades of medical training, a quick AI-assisted lookup, or a tool still technically in an experimental testing phase.

Getting this right will not require halting innovation. It will require building sandboxes with real walls, not just regulatory suggestions, so that speed and safety are not treated as opposites. That balance, more than any single piece of legislation, will determine whether these experiments earn public trust or squander it.