Nolla Health’s Utah AI Medication Prescribing Sandbox

Utah’s October 5, 2026 agreement with Nolla Health lets an AI system issue first time prescriptions for eight topical acne formulations, yet the state waived only its own licensing rules, and FDA, pharmacy law, and patient lawsuits remain in force. A founder who reads the agreement as a legal green light has misread what a state can give. Utah can promise not to enforce its Medical Practice Act, its Pharmacy Practice Act, and its telehealth provision. It cannot promise anything on behalf of the Food and Drug Administration, a plaintiff’s lawyer, or a federal prosecutor.

Here is what the agreement covers. Magic Health, Inc. and Magic Health Services, LLC, which operate Nolla, may issue orders for adults aged 18 and older with mild to moderate acne and send them to a Utah pharmacist, for twelve months from the day the company gives notice that the technology is live. The service costs $4.99 per month, and the company raised $4.5 million from investors led by General Catalyst. A physician approves each of the first 100 prescriptions. The next 400 patients receive prescriptions the AI submits directly, reviewed weekly after the fact, and then physicians sample at least 10% of enrollment each month.

Does a state sandbox waive FDA rules for AI prescribing

A state sandbox waives no federal law. Section 201(h) of the Federal Food, Drug, and Cosmetic Act defines a medical device to include software intended for use in diagnosing or treating disease, and the 2016 Cures Act exempted only clinical decision support meant for a health care professional that does not analyze a medical image. Nolla’s system talks to a patient, scores acne severity from photographs, and chooses a product. FDA’s January 2026 revisions to its decision support guidance relaxed enforcement for some single recommendation tools, but they address professional users and exclude image analysis. The Utah agreement contains no FDA clearance claim, and the press accounts I reviewed mention none.

The drug side carries its own federal text. Section 503(b)(1) allows a prescription drug to be dispensed on the prescription of a practitioner licensed by law, and the AI holds no license. In the first stage a physician approves every order, which satisfies the plain words. After 100 patients, the physician reviews afterward. No court has decided whether that suffices, and the pharmacy that fills the order carries the first exposure. Compounding sharpens it: Section 503A exempts a compounded drug from approval only when a valid prescription for an identified patient exists, and the company reports a compounding partner and a $49.99 price for the medication. A pharmacy that loses the exemption sells an unapproved drug.

Who is liable when an AI prescribes the wrong drug

The company is liable, because Utah’s agreement says so. Section 4(D) preserves every remedy a patient holds under laws not waived, Section 8 makes the company indemnify the state, and Section 6(B)(3) forbids a terms of service clause that disclaims liability for physical or medical harm from the AI’s outputs. Section 20(B)(1) requires professional liability insurance for the full term. The state stepped out of the case on purpose.

The tort route is where the law has no answer yet. The Utah Health Care Malpractice Act, Utah Code Section 78B-3-401 and following, protects licensed health care providers with a two year limitation period, a prelitigation process, and damages limits. An AI software company holds no license, so a plaintiff may sue it in ordinary negligence and product liability and avoid those limits. Whether FDA authorization would shield it depends on the pathway: premarket approval preempts state tort claims under Riegel v. Medtronic in 2008, but a 510(k) clearance does not under Medtronic v. Lohr in 1996. A startup with no FDA pathway holds neither defense.

In thirty years of counseling technology companies, I have watched founders treat a regulator’s letter of comfort as if it bound a plaintiff’s lawyer. It never does. The comfort letter binds two Utah offices. Every other actor with a claim stays free to bring it.

What should a health startup resolve before asking a state to waive licensing rules

A startup should resolve FDA status first, because no state can supply it and the answer sets the product liability position. A written device determination, and for a high risk function a Q Submission to FDA, belongs in the file before the application. Drug sourcing comes second: the formulary needs a status for each entry, whether approved, over the counter, or compounded, and the pharmacy partner needs to accept the prescriber of record structure.

The medical board comes third, and Utah supplies the lesson. The Doctronic pilot, launched in January 2026 to renew prescriptions for 191 drugs, drew a letter on April 20, 2026 in which eleven of fourteen Utah Medical Licensing Board members asked for immediate suspension and said they had not been consulted. The state declined on April 21. Nolla reportedly consulted the Utah Medical Association and the American Academy of Dermatology before launch, and that record is part of why the agreement reads as a negotiated document.

Insurance and data follow. A carrier should confirm in writing that it covers an autonomous system’s decisions and has no artificial intelligence exclusion. The Federal Trade Commission collected $1.5 million from GoodRx and $7.8 million from BetterHelp in 2023 over health data sharing, and a $4.99 subscription generates exactly the data those cases concerned. Last, the startup should design the audit before the regulator does. A 10% monthly sample reaches a rare harm, such as an undetected pregnancy exposure to tretinoin, one time in ten, so the sample must be sized to the adverse event rate the company needs to catch.

The December 11, 2025 federal executive order on state artificial intelligence measures adds a durabilit