Classifying AI Spend for Medical Loss Ratio Reporting by Health Plans

Start with the category definitions, not the technology

The medical loss ratio is the share of premium spent on health care and quality initiatives, as opposed to administration, marketing and profit. As of October 2026, an individual-market issuer under 45 CFR 158.210(c) must pay a rebate if its MLR for the reporting year is below 80 percent. Medicare Advantage plans are subject to an 85 percent requirement. Every dollar classified outside the numerator categories therefore has a direct effect on the reported ratio, which is why classification of AI spend deserves a written method.

Incurred claims under 45 CFR 158.140 center on payments to or received by providers for covered clinical services or supplies, including capitation, plus specified reserves and experience rating refunds. The same section lists costs that must not be included, such as medical record copying, attorneys' fees, subrogation vendor fees, and compensation of quality assurance analysts, administrative supervisors and medical record clerks. Software that supports claims handling is not a payment for clinical services, so AI tooling is rarely a credible incurred claims item.

Quality improvement activities are governed by 45 CFR 158.150. One criterion is that the activity be grounded in evidence-based medicine, widely accepted best clinical practice, or criteria issued by recognized professional medical associations, accreditation bodies, government agencies or other nationally recognized health care quality organizations. The full criteria in the regulation must all be met, and the burden of showing that falls on the plan. In Medicaid managed care under 42 CFR 438.8, the numerator is incurred claims plus quality improvement expenditures plus fraud prevention activities, so fraud prevention is a distinct element there. Plans should confirm for each line of business whether the applicable rule recognizes it separately. Anything that fits no numerator category is a non-claims administrative cost.

How common AI use cases map to candidate categories

The mapping below is analysis, not regulatory classification. It indicates where a use case is more or less likely to support a numerator category and where the documented rationale carries the most weight.

• Claims adjudication support: Weakest fit for quality improvement. CMS declined to allow claims adjudication system costs in QIA, so this is most likely a non-claims administrative cost.
• Utilization management: Unclear. Default to administrative treatment unless a specific function meets every QIA criterion. Document human clinical review of adverse determinations.
• Care management outreach: Clearest QIA candidate, if the outreach is grounded in evidence-based or recognized clinical criteria and each remaining criterion is met.
• Fraud detection: Candidate for fraud prevention where the applicable rule recognizes it, as in Medicaid managed care. Otherwise treat as administrative unless another category is supported.
• Member service automation: Generally administrative. A narrow clinical-quality function inside the service workflow may qualify, but it must be isolated and documented.

Where the rules leave judgment calls

The first judgment call is claims-related AI. The CMS position from 2011 rulemaking allowed a capped amount for ICD-10 conversion while refusing to let issuers include claims adjudication system costs in QIA. The regulation also addresses establishing or maintaining a claims adjudication system, including health information technology upgrades designed primarily or solely to improve claims payment capabilities or meet regulatory claims-processing requirements. An AI tool that speeds claim review or payment integrity should be screened against that language before anyone proposes QIA treatment.

The second is utilization management. For Medicare Advantage, algorithms, software or AI may assist coverage determinations, but using them in isolation without meeting the final rule's requirements is prohibited, and adverse determinations must be reviewed by a physician or other qualified medical professional. That requirement does not decide MLR treatment, but it shapes how the function must be described. A tool that supports a clinician's review is a different activity from one that issues determinations, and the classification file should say which one the plan operates.

The third is bundled functions. A single vendor platform may combine outreach, member messaging and claims support. Classification should follow the function, not the contract. Where a product serves several functions, the plan needs either a separation of costs by function or a conservative treatment of the whole, with the reasoning recorded. In every case, the written rationale, the approver and the date matter as much as the conclusion.

Apportioning shared infrastructure and vendor costs

AI spend is rarely clean. A shared model platform, an inference service billed by usage and an internal build team can each serve several use cases, lines of business and legal entities. Under 42 CFR 422.2420, any basis adopted to apportion expenses must be the one expected to yield the most accurate results, and it may result from special studies of employee activities, salary ratios, premium ratios or similar analyses. The standard is accuracy, not convenience, so a flat split chosen because it is easy to compute is hard to defend.

The same section requires expenses that relate solely to the operations of one reporting entity, such as personnel costs for adjusting and paying claims, to be borne by that entity and not apportioned across a group. For a shared AI platform, that means entity-specific attribution is needed wherever the usage can be identified.

The rules do not specify whether AI usage records can serve as an allocation base. That is a plan judgment. If usage is used, the plan should document why it is the most accurate available measure, how it was validated against other methods, and how vendor invoices, internal build labor and cloud charges are each traced to use cases. Keep the methodology document, the supporting study and each period's inputs together so the allocation can be reproduced.

Evidence of what ran, under which controls, in which use case

A classification is only as strong as the proof that the function operated as described. If a plan classifies a care management outreach tool as quality improvement, an auditor may ask which AI functions actually ran, what they were permitted to do, and whether they stayed within that use case. Financial records alone do not answer those questions.

Trussed enforces policy in the execution path for individual AI interactions and tool calls, with actions that include allow, redact, block, rate limit and escalate for human approval. Policy is enforced at runtime, not reviewed after the fact, and the enforcement produces audit-ready evidence mapped to HIPAA, including the audit controls requirement at 164.312(b). That evidence can show which interactions and tool calls occurred, which policy applied and what decision was made, and it supports attributing interactions to the use case a plan has defined.

The limits are important. Trussed does not classify spend, determine MLR treatment or perform financial allocation. Those decisions stay with the plan's compliance and finance teams. The evidence is an input that helps substantiate the operational facts behind a classification, such as the function that ran, the controls in force and the human approval step for sensitive actions. Trussed runs in production with healthcare organizations and can be deployed self-managed in the customer's cloud, with configurable retention and data residency, which matters when evidence must remain available for review.