Is Using AI for Therapy Notes Legal in Your State? A 2026 Compliance Guide

A state-by-state breakdown of AI therapy note laws in 2026, including Illinois Public Act 104-0054, Texas SB 1188 and TRAIGA, Louisiana HB 475, and the emerging regulatory distinction between AI documentation tools and AI therapy delivery. Includes recording consent state map and a compliance checklist.

The short answer is: yes, using AI to help write therapy notes is legal in every U.S. state as of April 2026. But the rules around how you use it vary considerably depending on where you practice and which type of tool you use.

If you use an ambient recording tool (the AI listens to your session and generates notes automatically), you are operating under a different legal framework than if you use a generation-based tool (you type a post-session summary and the AI structures it). That distinction is now encoded in state law in Illinois, and the legal architecture is being mirrored across more states every quarter.

Over 250 AI healthcare bills have been introduced across 34 or more states since 2025. Most therapists are tracking none of them. This guide covers what you actually need to know.

Why the Legal Landscape Changed So Quickly

Until 2025, AI documentation tools operated in a compliance vacuum. The only frameworks that mattered were HIPAA (for data handling), professional licensing board ethics codes, and wiretapping law (for recording consent). None of those were designed with AI scribes in mind.

That began to change when Illinois passed the first state law specifically governing AI use in psychotherapy. Other states followed. By early 2026, the legal landscape for AI therapy documentation had two distinct tracks: laws regulating AI-assisted documentation, and laws prohibiting or regulating AI-delivered therapy.

These two tracks are often confused by therapists reading news headlines, which is part of why so many practitioners are uncertain about whether their tools are legal. Knowing which track your tool falls under clarifies most of the compliance picture.

The Two-Track Regulatory Framework

Track 1: AI Documentation Tools (Permitted, Subject to Disclosure and Review Requirements)

Tools in this category help clinicians write notes, structure session summaries, and produce clinical documentation. The AI does not make clinical decisions. It assists with the documentation task after or during a session.

Examples: ambient AI scribes, generation-based note tools, transcription services that produce structured notes.

Legal status: Permitted in all 50 states, subject to HIPAA, recording consent law, and (in some states) state-specific AI disclosure requirements.

Track 2: AI Therapy Delivery (Increasingly Regulated or Prohibited)

Tools in this category provide therapeutic services directly to clients, often without a licensed human clinician involved. This includes AI chatbots that conduct therapy sessions, AI-driven treatment protocols, or any application that represents itself as providing psychotherapy.

Legal status: Maine enacted a prohibition in April 2026. Missouri and Minnesota are advancing similar frameworks. This category is where most state legislatures are directing their concern about AI "replacing" therapists.

Why this matters to you: Most of the concerning AI mental health headlines are about Track 2, not Track 1. If your AI tool helps you write your notes and never interacts with your client, you are using a Track 1 tool. The legislative concern about AI harming clients is not directed at your note-writing workflow.

State-by-State Breakdown: What You Need to Know

Illinois: Public Act 104-0054 (Enacted August 2025)

Illinois is the most important state to understand because it was first and because other states are watching it as a model.

What it does:

The Wellness and Oversight for Psychological Resources Act (WOPRA) classifies AI documentation tools as "supplementary support." Using them is permitted. But if the AI involves recording or transcribing a client session, the therapist must obtain explicit written informed consent from the client before any recording or transcription takes place.

The law does not prohibit AI-assisted documentation. It requires that clients know their session is being recorded or transcribed for AI note generation.

Penalties: Civil penalties up to $10,000 per violation.

What this means in practice: If you use an ambient recording tool in Illinois and do not have signed client consent specifically covering AI transcription, you are out of compliance. If you use a generation-based tool where you type a summary after the session (no recording, no transcription), the written consent requirement for recording does not apply to your workflow.

A sample scenario: Dr. Marcus, an LCSW in Chicago, uses an ambient AI scribe. Under WOPRA, he needs a client consent form that explicitly names the AI transcription process. His existing HIPAA-required privacy notice is not sufficient; it covers data handling, not the act of recording. He needs a separate AI-specific consent document.

Texas: Two-Layer Compliance (Effective 2025 and 2026)

Texas has enacted two separate AI laws that together create overlapping obligations for therapists. No other state yet has this level of stacked requirement.

Texas SB 1188 (effective September 1, 2025):

This law focuses on AI used for diagnostic or treatment recommendation purposes. Healthcare practitioners must review all AI-generated records in a manner consistent with medical records standards. In practical terms: if AI generates a note that enters the clinical record, the treating clinician must document that they reviewed and approved it.

The law also requires that electronic medical records processed by third-party vendors be hosted on U.S.-based servers. Data cannot be physically offshored.

Penalties range from $5,000 to $250,000 per violation, depending on intent and whether protected health information was used for financial gain.

Texas TRAIGA (HB 149, Texas Responsible AI Governance Act, effective January 1, 2026):

This is a broader disclosure law. It requires clear and conspicuous disclosure to patients whenever AI is used in their care, not only when recording or transcription is involved.

What this means in practice: Texas therapists using any AI documentation tool face two obligations: (1) disclose to clients that AI is being used (TRAIGA), and (2) review and approve each AI-generated note before it enters the clinical record (SB 1188). The review step is already standard practice in generation-based workflows where the therapist writes the session summary first; the AI structures it, and the therapist reviews before saving. That sequence naturally satisfies SB 1188's review requirement.

The stacking of TRAIGA disclosure plus SB 1188 review creates the most compliance-dense environment of any state for AI documentation. Ambient tools face three friction points: recording consent best practices, TRAIGA disclosure, and SB 1188 review. Generation-based tools face one: TRAIGA disclosure.

Louisiana: HB 475 (Advanced April 2026)

Louisiana's bill adds a verbal notification requirement specific to recording. Before any AI transcription begins, the provider must verbally notify the patient that their visit will be recorded and transcribed by AI.

This applies in addition to Louisiana's existing wiretapping rules. Louisiana is a one-party consent state under federal law, meaning a therapist could legally record a session without client permission at the federal level. HB 475 overrides that permissiveness in the clinical context: even if recording is technically legal, verbal notification is now required when AI transcription is involved.

Generation-based tools are exempt from HB 475 entirely. There is nothing to notify about if there is no recording.

New York: S.8484 "Oversight of Technology in Mental Health Care Act" (Proposed, 2025)

Introduced by Senator Kristen Gonzalez, this bill would prohibit autonomous AI therapeutic decision-making and require patient notification of AI use and explicit informed consent before AI assists with session recording or transcription for note-writing purposes.

As of April 2026, S.8484 has not passed. It mirrors Illinois' WOPRA framework. Given New York's size (it is one of the top three therapy markets in the country by practitioner count), its passage would substantially expand the number of therapists operating under explicit AI consent requirements.

Track it. Even if you are not in New York, the passage or failure of S.8484 will signal whether the Illinois model becomes a national template.

Maine: LD 2082 (Enacted April 2026)

Maine enacted LD 2082 in April 2026, which prohibits offering therapy or psychotherapy services through AI unless a licensed professional is involved.

This is a Track 2 law. It targets AI chatbots that provide therapeutic services directly to clients, not tools that help therapists write notes. If you are a licensed clinician using AI to structure your progress notes, LD 2082 does not affect you.

Missouri: SB 1444 and Minnesota: HF 3893 (Advancing, 2026)

Both Missouri and Minnesota are advancing legislation that mirrors Maine's Track 2 framework: prohibit AI from representing itself as a mental health professional or delivering therapy services without a licensed human clinician directing care.

Again, these are AI-therapy laws, not AI-documentation laws. Your note tool is not in scope.

Recording consent law is a separate legal layer from AI legislation and from HIPAA. It determines whether you can legally record a session at all, with or without AI involvement.

In 31 states, one-party consent applies. As the therapist (a party to the session), your consent to record is legally sufficient under state law.

In 11 states plus the District of Columbia, all-party consent is required. Every participant in a conversation must consent before it can be legally recorded. Those states are:

California
Connecticut
Delaware
Florida
Illinois
Maryland
Massachusetts
Michigan
Montana
New Hampshire
Oregon
Pennsylvania
Washington
District of Columbia

If you practice in one of these jurisdictions and use an ambient recording AI scribe without explicit client consent, you may be violating state wiretapping law before any AI-specific regulation even comes into play.

The telehealth complication: If you conduct telehealth sessions across state lines, the more restrictive state's law controls. A therapist licensed in a one-party consent state who sees a client located in California should be following California's all-party consent rules for that session. If you have a mixed-state telehealth caseload, all-party consent is the safest practice-wide standard regardless of where you are sitting.

The Scale of What Is Coming

These specific state laws are the visible tip of a much larger legislative wave. As of early 2026:

Over 250 AI healthcare bills have been introduced across more than 34 states
A 50-state legislative review published in 2026 (PMC12578431) confirms that explicit informed consent requirements for AI in mental health settings remain rare nationally but are accelerating
Every session of most state legislatures in 2025 and 2026 has included at least one AI healthcare bill

The trend line is unambiguous: state regulation of AI documentation tools will increase. What Illinois enacted in 2025 is likely to appear in 10 to 15 additional states within two to three years. The specifics will vary, but the direction is consistent: disclosure requirements, consent requirements, and clinician-review requirements will become standard.

Planning for this compliance trajectory now costs less than retrofitting your practice after a violation.

What Type of AI Tool You Use Changes Your Compliance Exposure

The single most important compliance variable for most therapists is whether their tool involves session recording.

Ambient Recording Tools

These tools listen to your session in real-time and generate a note from the audio. They are the tools most affected by the state laws described above.

Compliance exposure:

All-party consent states: client consent to recording required before tool use
Illinois: explicit written consent for AI transcription required
Louisiana (pending): verbal notification of recording required
Texas: TRAIGA disclosure + SB 1188 review documentation
New York (if S.8484 passes): explicit consent required

For therapists practicing in all-party consent states with trauma-focused, SUD, or legally-involved populations, the recording consent burden is not trivial. Some clients will decline. Some clients' circumstances make consent problematic (active litigation, domestic violence, protective orders against recording).

Generation-Based Tools

These tools take a written post-session summary and structure it into a formatted clinical note. No audio is recorded. No session transcript is created.

Compliance exposure:

Recording consent laws: not applicable (no recording)
Illinois WOPRA: not applicable (no transcription)
Louisiana HB 475: not applicable (no recording)
Texas TRAIGA: disclosure still required (AI is being used in care)
Texas SB 1188: clinician review requirement, which is the normal workflow

The generation-based workflow is structurally exempt from the highest-friction compliance requirements because those requirements were written to govern session recording. A tool that generates notes from text written by the clinician after the session does not record anything.

This is not a legal gray area. The Illinois law explicitly refers to "recording or transcribing" sessions. Louisiana's HB 475 explicitly refers to recording. If there is no recording, those provisions do not activate.

Practical Compliance Steps for 2026

If You Use an Ambient Recording Tool

Check your state's recording consent requirements. If you are in one of the 11 all-party consent states plus DC, client consent is already legally required before any recording begins.
Add AI-specific language to your informed consent document. A generic HIPAA privacy notice does not satisfy Illinois WOPRA or New York S.8484. You need a form that specifically names the AI tool, describes what is recorded, explains how the data is processed, and gets the client's signature.
Verify your vendor's data handling practices. Texas SB 1188 requires U.S.-based server hosting for third-party vendors. If your AI tool processes data offshore, you may have a Texas compliance problem before any note-quality consideration.
Build a review-and-approval step into your workflow. Texas SB 1188 requires documented clinician review of AI-generated records. A workflow where AI generates a note and it auto-populates the chart without your explicit review may not satisfy this requirement.
Track pending legislation in your state. The Manatt Health AI Policy Tracker (manatt.com) is a reliable resource. Set a calendar reminder to check it quarterly.

If You Use a Generation-Based Tool

Add AI disclosure to your informed consent. Even if recording consent laws do not apply to you, Texas TRAIGA and broader best practice guidance recommend disclosing that AI assists with structuring your clinical notes. A sentence in your informed consent document is sufficient.
Retain your review step. You are already reviewing the note before saving it because you wrote the source summary yourself. Document this as a standard workflow step. If Texas SB 1188 applies to you, this documentation protects you.
Keep the tool's privacy terms on file. Know whether your tool is HIPAA compliant, whether it signs Business Associate Agreements, and where your data is hosted. These are separate from recording consent questions but remain compliance requirements.
Check your licensing board. Several state licensing boards are developing or will develop guidance on AI use that may go beyond state law. The Illinois licensing board, for example, may issue practice standards that supplement WOPRA requirements.

Common Compliance Mistakes in 2026

Using a recording-based AI tool without updating your consent forms. The HIPAA privacy notice you already have does not cover AI transcription. Therapists who think their existing informed consent documentation covers AI tool use are often wrong, especially in Illinois and all-party consent states.

Treating "HIPAA compliant" as a full compliance answer. HIPAA governs data handling. State recording consent law is separate. Illinois WOPRA is separate. Texas TRAIGA is separate. A tool can be HIPAA-compliant and still put you at risk for violating Illinois' $10,000-per-violation penalty if you have not obtained written AI consent.

Assuming one-party consent means no consent is needed. Under federal wiretapping law, one-party consent means the therapist can authorize a recording without the client knowing. Illinois, Louisiana, and the pending New York legislation have added clinical-context obligations on top of this, regardless of which wiretapping framework would otherwise apply.

Conflating Track 1 and Track 2 news. If you read a headline about a state "banning AI in therapy," read carefully before changing your practice. Maine, Missouri, and Minnesota are targeting AI chatbots delivering therapy, not note-writing tools. The news is real; the implications for your documentation workflow are probably not what the headline implies.

Letting the tool review itself. Texas SB 1188 requires clinician review of AI-generated records. An auto-save-to-chart workflow does not satisfy this. The clinician must actively review the note.

A Note on NotuDocs and This Legal Framework

NotuDocs is a generation-based tool: you write a session summary after the appointment, and the AI structures it into your note format. There is no session recording, no audio transcription, and no real-time processing during the session.

This architecture means that Illinois WOPRA's recording consent requirement, Louisiana HB 475's verbal notification requirement, and all-party state recording laws do not apply to the NotuDocs workflow. The disclosure requirements (Texas TRAIGA and general best practice guidance) still apply, and the clinician review step is the normal way the tool works.

NotuDocs is not HIPAA compliant and does not sign Business Associate Agreements. If your practice, insurance panel, or agency requires a signed BAA before any third-party software can process client information, NotuDocs is not the right tool for you. That requirement filters before any of the state AI laws described in this guide.

2026 AI Therapy Documentation Compliance Checklist

Before You Start Using Any AI Documentation Tool

Identified whether your state has ambient recording laws that require all-party consent (see list above)
Confirmed whether your state has enacted specific AI mental health legislation (Illinois, Texas)
Verified whether your tool uses session recording/transcription (ambient) or post-session text entry (generation-based)
Confirmed the tool's data hosting location (required for Texas SB 1188 compliance)
Confirmed whether the tool signs Business Associate Agreements if required by your practice

Added AI-specific language to your informed consent form explaining that AI assists with structuring clinical notes
If using an ambient recording tool in an all-party consent state: added explicit recording consent language
If practicing in Illinois: added written consent specific to AI transcription of sessions
Stored signed consent forms in each client's file

Ongoing Workflow

Every AI-generated note reviewed and approved by the clinician before entering the clinical record
Review step documented as part of standard workflow (especially relevant for Texas SB 1188)
AI tool's data handling terms reviewed and stored on file
Licensing board checked for AI-specific guidance relevant to your discipline
State AI legislation tracker checked at least quarterly (Manatt Health AI Policy Tracker recommended)

For Telehealth Practices

Recording consent protocol follows the more restrictive of the therapist's state or the client's state
Intake documentation captures client location at each session (relevant for multistate licensing jurisdictions)
Considered whether to adopt all-party consent standards practice-wide to simplify compliance