A new US healthcare pilot is drawing attention because it moves AI beyond advisory use and into a regulated decision-making workflow. Nolla Health says people in Utah can use its app to scan their faces, have an AI system assess acne severity and receive an AI-generated prescription for treatment.

According to the reported rollout, physician oversight is being phased. For the first 100 patients, two physicians will approve each AI-generated prescription before it is issued. For up to 500 patients, physicians would review prescriptions after they are issued, and later move to reviewing a sample of at least 10% of cases. The development was reported by Bloomberg and covered by The Verge.

What happened

Nolla Health announced a pilot programme in Utah that uses AI to analyse facial images for acne and autonomously write prescriptions. The programme is being introduced with staged physician involvement rather than immediate full autonomy.

Based on the source, this is a limited pilot in one US state, not a broad regulatory shift. The reported workflow and oversight model reflect the company’s announced operating approach for this programme. The source does not establish that the model has been independently validated beyond the pilot conditions described.

Why it matters for European businesses

For most European companies, this is not directly about acne treatment. The practical importance is that it shows how quickly AI systems are being positioned to take actions in regulated environments rather than simply making recommendations.

That matters to European businesses in sectors such as healthcare, insurance, finance, HR, legal services and compliance-heavy SaaS. When an AI system moves from assisting staff to generating outputs that trigger real-world decisions, questions become more important around:

• Human oversight: whether people approve decisions before or after action is taken.
• Accountability: who is responsible if the AI output is wrong, unsafe or discriminatory.
• Auditability: whether the business can document how a decision was reached.
• Risk controls: how edge cases, errors and escalation paths are managed.
• Regulatory classification: whether the AI use case falls into a higher-risk category under applicable rules.

For European organisations, the story is also a reminder that AI products developed in one market may influence customer expectations elsewhere. Vendors, startups and digital service providers may increasingly market autonomous AI workflows as a cost-saving model, even where European regulatory, clinical or professional rules require much stricter review.

Who may be affected

The most relevant groups are businesses operating in regulated or high-liability environments, including:

• digital health providers and healthtech startups
• software companies building AI workflow tools for regulated industries
• IT and compliance teams evaluating AI agents that can take operational actions
• founders and product leaders designing AI-enabled approval processes
• agencies and consultants advising clients on AI automation in sensitive sectors

Even outside healthcare, the same governance questions apply when AI is used to approve loans, screen job applicants, make insurance assessments, generate legal documents or automate security and compliance actions.

What companies should consider

European businesses exploring AI automation in sensitive processes should treat this case as a governance example rather than a model to copy directly.

• Map where AI is only assisting versus acting: the compliance and liability profile changes significantly when AI can issue, approve or trigger outcomes.
• Define human review clearly: decide whether oversight happens before execution, after execution or through sampling, and assess whether that is appropriate for the risk involved.
• Document accountability: make sure internal teams, vendors and professional supervisors know who is responsible for final outcomes.
• Check sector-specific obligations: healthcare, financial, employment and legal workflows may be subject to additional national and EU-level rules.
• Prepare evidence trails: retain logs, decision records and escalation paths so AI-supported actions can be reviewed if challenged.
• Test for failure modes: edge cases, biased outputs, poor-quality input data and unsafe recommendations become more serious when the system acts autonomously.

For SMEs, the broader lesson is straightforward: the value of AI automation is increasing, but the controls around autonomous decision-making matter most in regulated and customer-facing processes. Cost savings alone are not enough if the business cannot justify how the system is supervised, documented and corrected when errors occur.