An AI Can Now Prescribe Your Acne Treatment. Who's Liable If It's Wrong?

A startup in Utah now lets an AI look at photos of your face and write an acne prescription. For the first 100 patients, two doctors approve every prescription before it goes out. After that, the AI sends prescriptions on its own, and doctors check afterward. The photo analysis isn't the surprising part. The surprising part is how little has been tested about who answers for a wrong prescription, even though the state put some guardrails in writing.

This matters because products like this are shipping now, ahead of settled rules. Below: what the product actually does, what Utah actually approved, and three questions you can ask of any AI product that makes real decisions about you.

What Nolla Health actually ships

Nolla Health's pilot works like this. You submit photos and your medical history through the Nolla Derm app. An AI assesses how severe your acne is, and if you qualify, it writes a prescription that you pick up at a pharmacy or get delivered.

Physician oversight loosens in three stages:

• Stage one, the first 100 patients: two licensed physicians independently approve every AI prescription before it reaches you.
• Stage two, up to 500 patients: the AI issues prescriptions directly, and a physician reviews every case afterward, at least weekly.
• Stage three: physicians review a sample of at least 10% of prescriptions each month, plus every case with an escalation or a side effect.

The headline version ("AI prescribes drugs") also hides how narrow the task is. According to reporting by Bloomberg, The Verge and MobiHealthNews:

• The AI can only choose from eight topical treatments, creams and gels from a fixed list.
• It only treats adults with mild or moderate acne.
• Anything the AI can't confidently decide goes to a physician. So do severe acne, pregnancy, anyone who might need oral medication, and other conditions the pilot excludes.

So the AI isn't inventing treatment plans. It's making a sorting call. Think of a post office machine that reads an address, drops the letter into one of eight bins, and hands anything smudged to a person. The AI scores your severity and matches you to one option from a short menu that doctors already cleared.

That's a far less dramatic story than the headlines. It's also why the liability question is so interesting. Even a narrow sorting decision can be wrong. When it is, someone has to answer for it.

Utah didn't approve "AI prescribing"

Skim the coverage and you'd think Utah opened the door to AI prescribing in general. It didn't. Zachary Boyd, whom Utah appointed to lead its Office of Artificial Intelligence Policy, described it to the Los Angeles Times as a narrow exception: one company, one use, inside the state's AI Learning Lab, a sandbox that relaxes specific state rules so companies can test AI products under supervision.

For this pilot only, Utah waived the rule that a prescription has to come from a licensed human prescriber. The rule itself still applies to everyone else. The state's AI policy office is explicit that taking part in the sandbox does not mean Utah approved, endorsed or vouched for the product.

This matters because exceptions travel badly. "Utah lets AI prescribe drugs" is a sentence that spreads. "Utah exempted one acne startup from one rule, under conditions" is not. And there is no federal framework behind it.

The liability question nobody has tested

If you assumed a federal rule already covers this, here's the surprise. There isn't one. A federal bill, the Healthy Technology Act, would let AI prescribe drugs, but only if both the state and the Food and Drug Administration (the federal agency that decides which drugs and medical devices can be sold in the US) sign off. It was referred to a House committee and has not come to a vote.

Utah did write some guardrails of its own. According to the Los Angeles Times, the state required special malpractice insurance covering AI-generated prescriptions and built duty of care terms into Nolla's contract. That gives a court something to work with. It doesn't tell you how a court would rule.

Now picture the failure case. The AI rates someone's acne as moderate when it's actually severe. Instead of routing them to a human, it matches them to a topical cream, and their skin gets worse or scars. Who is responsible?

• The startup, which built and runs the AI?
• The state, which granted the exception?
• The physicians who approved the list of eight treatments, or who reviewed the case afterward?
• The insurer, under the malpractice policy Utah required?

The honest reading of the sources: there are guardrails on paper, but none of them has been tested in a real dispute yet. That's the real story. This isn't a hypothetical future risk. It's a product people can use today, in a space where the answer to who pays for a mistake hasn't been worked out in practice.

Three questions to ask any AI product that decides for you

1. Is the approval a rule or an exception? A general rule applies to every company and has been debated publicly. An exception covers one company, often under conditions you'll never see in a headline.
2. Who is named as responsible when it's wrong? Read the terms of service. If a product makes real decisions about your health but its terms say it isn't medical advice, that's the gap in writing.
3. What happens to the cases it isn't sure about? A careful product sends uncertain cases to a qualified human and tells you when that happens. If you can't find out, assume nobody checks.

You can hand this check to an AI chat tool with web search turned on. Paste this in and fill in the brackets:

I'm considering using [product name]. It uses AI to [what it does, for example: prescribe medication, approve loans, review contracts].

Help me check three things:
1. Is its regulatory approval a general rule or a narrow exception for this one company? Who granted it?
2. According to its terms of service, who is responsible if the AI's decision is wrong?
3. What happens to cases the AI is unsure about? Does a qualified human review them?

Link a source for every claim. If you can't find a source for something, say so clearly instead of guessing.

The last line matters. Without it, the AI may fill gaps with confident guesses, which is exactly the problem you're trying to spot.

Why this keeps happening

States move faster than federal rulemaking. A state can grant an exception for one product in months. Federal law takes years, as the stalled bill shows. So the first real example of something new often comes from a single state's exemption.

Then the narrative takes over. A regulator approves one specific, bounded product. Headlines describe a whole category ("AI can prescribe now"). Competitors and investors read the headline, not the exemption. A narrow exception starts working like a national precedent, even though legally it's nothing of the kind.

Expect this pattern anywhere a state is willing to grant an exception before liability law catches up: health, money, legal advice. The products will be real and often carefully limited. The answer to who pays for mistakes will lag behind.

The gap isn't the AI's judgment. It's that nobody has tested who answers for that judgment when it's wrong. Before you hand your photos, records or money to the next AI service that makes decisions about you, run the prompt above and read who the terms say is responsible.