Episode Details

Utah’s October 5, 2026 agreement with Nolla Health lets an AI system issue first time prescriptions for eight topical acne formulations, yet the state waived only its own licensing rules, and FDA, pharmacy law, and patient lawsuits remain in force. A founder who reads the agreement as a legal green light has misread what a state can give. Utah can promise not to enforce its Medical Practice Act, its Pharmacy Practice Act, and its telehealth provision. It cannot promise anything on behalf of the Food and Drug Administration, a plaintiff’s lawyer, or a federal prosecutor.

Here is what the agreement covers. Magic Health, Inc. and Magic Health Services, LLC, which operate Nolla, may issue orders for adults aged 18 and older with mild to moderate acne and send them to a Utah pharmacist, for twelve months from the day the company gives notice that the technology is live. The service costs $4.99 per month, and the company raised $4.5 million from investors led by General Catalyst. A physician approves each of the first 100 prescriptions. The next 400 patients receive prescriptions the AI submits directly, reviewed weekly after the fact, and then physicians sample at least 10% of enrollment each month.

Does a state sandbox waive FDA rules for AI prescribing

A state sandbox waives no federal law. Section 201(h) of the Federal Food, Drug, and Cosmetic Act defines a medical device to include software intended for use in diagnosing or treating disease, and the 2016 Cures Act exempted only clinical decision support meant for a health care professional that does not analyze a medical image. Nolla’s system talks to a patient, scores acne severity from photographs, and chooses a product. FDA’s January 2026 revisions to its decision support guidance relaxed enforcement for some single recommendation tools, but they address professional users and exclude image analysis. The Utah agreement contains no FDA clearance claim, and the press accounts I reviewed mention none.

The drug side carries its own federal text. Section 503(b)(1) allows a prescription drug to be dispensed on the prescription of a practitioner licensed by law, and the AI holds no license. In the first stage a physician approves every order, which satisfies the plain words. After 100 patients, the physician reviews afterward. No court has decided whether that suffices, and the pharmacy that fills the order carries the first exposure. Compounding sharpens it: Section 503A exempts a compounded drug from approval only when a valid prescription for an identified patient exists, and the company reports a compounding partner and a $49.99 price for the medication. A pharmacy that loses the exemption sells an unapproved drug.

Who is liable when an AI prescribes the wrong drug

The company is liable, because Utah’s agreement says so. Section 4(D) preserves every remedy a patient holds under laws not waived, Section 8 makes the company indemnify the state, and Section 6(B)(3) forbids a terms of service clause that disclaims liability for physical or medical harm from the AI’s outputs. Section 20(B)(1) requires professional liability insurance for the full term. The state stepped out of the case on purpose.

The tort route is where the law has no answer yet. The Utah Health Care Malpractice Act, Utah Code Section 78B-3-401 and following, protects licensed health care providers with a two year limitation period, a prelitigation process, and damages limits. An AI software company holds no license, so a plaintiff may sue it in ordinary negligence and product liability and avoid those limits. Whether FDA authorization would shield it depends on the pathway: premarket approval preempts state tort claims under Riegel v. Medtronic in 2008, but a 510(k) clearance does not under Medtronic v. Lohr in 1996. A startup with no FDA pathway holds neither defense.

In thirty years of counseling technology companies, I have watched founders treat a regulator’s