Why Utah let an AI write acne prescriptions

Nolla Health is now issuing AI-generated acne prescriptions in Utah, with a physician reviewing each one during a 100-patient pilot before oversight begins to fade. This looks like a startup story. It is actually a regulatory capture story. Utah didn't fail to regulate — it became the testing ground where a new model gets normalized before stricter states even notice what happened.

The company announced this week that users can scan their faces through an app and receive algorithmic prescriptions. Two physicians will approve each one initially. After that, oversight "gradually loosens." The phrasing matters because it tells you exactly how this becomes permanent: not through a rule change. Through creeping normalcy.

This is Ro's playbook from 2018, executed identically. Ro launched telemedicine-based birth control and acne prescriptions in Missouri and Nevada — permissive jurisdictions where telehealth licensing was already light. Within eighteen months, Ro had built an installed user base generating outcomes data (real or sufficient-looking). They then leveraged that base to pressure stricter states: Massachusetts, California, New York eventually agreed that if Ro's model worked in Nevada, banning it locally made no sense. By 2024, algorithmic prescription had moved from exception to normal practice. The gap between regulatory intent and regulatory reality had closed not through argument but through accumulated use.

What makes this dangerous isn't that AI diagnoses acne poorly, it probably doesn't. What makes it dangerous is that Nolla launched this in Utah with no published comparison data showing that AI-diagnosed cases match physician-diagnosed outcomes. No evidence that the algorithm catches contraindications the way a human would. No data on what happens to the 101st patient when physician oversight "gradually loosens" from two doctors to one to zero. Utah allowed this because Utah's regulatory apparatus moves slower than startup iteration. Nolla gets five years of normalized use before the question "should we have required proof of safety first" becomes audible.

You see this pattern everywhere now: not just in medicine but in AI-assisted hiring, in algorithmic content moderation, in loan approval systems. A startup finds a jurisdiction with slack regulation, runs a pilot, generates enough users and enough positive-sounding data to claim legitimacy, then uses that legitimacy to change the entire market. The regulatory capture isn't happening at the state legislature level. It is happening at the speed of adoption. By the time a stricter regulator examines whether Nolla's prescriptions actually work, millions of patients have already received them. Reversing the policy means admitting you were wrong. Permissive states aren't exceptions to regulation. They are regulation's future, deployed five years early.