State-by-State AI Consent Laws for Therapists: What Clinicians Need to Know in 2026

A practical breakdown of every US state law that now affects how therapists can legally use AI documentation tools. Covers Illinois Public Act 104-0054, New York S.8484, 40-plus bills across 25 states, all-party consent recording laws, and how your tool's architecture determines most of your compliance exposure.

Most therapists who start using AI documentation tools focus on the federal layer: Does the tool have a Business Associate Agreement? Is it HIPAA compliant? Those are legitimate first questions.

But there is a second layer that most therapists have not mapped: state law. Several states now have requirements around AI in psychotherapy that go beyond HIPAA, and 13 states have recording consent laws that apply directly to how ambient AI scribes work in a clinical session. The legal exposure varies enormously depending on where you practice, where your telehealth clients are sitting, and how your AI tool technically generates notes.

This guide is a practical state-by-state reference. It covers every law that currently applies, every bill likely to pass, and the one architectural question about your AI tool that determines most of your compliance risk.

Two Separate Legal Layers

Before diving into specific states, it helps to understand that therapists face two distinct layers of AI-related legal requirements in 2026. These layers are separate, they come from different legal histories, and they interact in ways that can compound your obligations.

Layer 1: AI-specific mental health laws. These are new. Illinois enacted the first one in August 2025. New York has a bill pending. More than 40 bills are moving through approximately 25 state legislatures as of 2026. These laws specifically regulate how AI may be used in psychotherapy services.

Layer 2: Recording consent laws. These are older statutes, originally written for telephone calls and in-person conversations, that govern whether you can record a conversation without everyone present consenting. They predate AI by decades, but they apply with full force to any AI tool that records or transcribes session content.

The key insight: these two layers interact. A tool that records sessions may trigger both layers simultaneously in some states. A tool that does not record sessions may sidestep the recording layer entirely while still having disclosure obligations under the emerging AI-specific layer.

Illinois Public Act 104-0054: The Country's First AI Psychotherapy Law

Illinois enacted Public Act 104-0054, known as the Wellness and Oversight for Psychological Resources Act, in August 2025. It is the first law in the United States to explicitly regulate AI use in psychotherapy services.

The law's core requirements:

Explicit written client consent before any AI-assisted recording or transcription. If your AI tool records session audio or generates a transcript for note-writing, each client must provide written consent before the session begins. A general technology disclosure in your intake forms does not satisfy this requirement. The law specifies explicit written consent tied to the specific use of AI for recording or transcription.

Civil penalties up to $10,000 per violation. This is the number therapists most frequently underestimate. The $10,000 figure is per violation, not a total cap. If you have been running an ambient recording tool with 20 clients in Illinois without documented written consent, the theoretical exposure is material.

AI tools are permitted but classified as "supplementary support." The law does not ban AI documentation tools. It establishes a supervised-use framework: AI may assist the therapist, but the therapist remains the clinical decision-maker. AI-generated notes must be reviewed and approved before they enter the clinical record.

What triggers the law and what does not. The written consent requirement in Public Act 104-0054 applies specifically to AI tools that "record or transcribe" sessions. A tool that does not record audio or create a transcript of session content operates differently under the law's framework. This distinction matters practically, and it is covered in detail below.

New York S.8484: The Bill to Watch

New York Senator Kristen Gonzalez introduced S.8484, the Oversight of Technology in Mental Health Care Act, in 2025. As of April 2026, it has not passed, but its trajectory deserves attention.

The bill would:

Prohibit autonomous AI therapeutic decision-making without therapist oversight
Require patient notification of the AI tool's purpose before any AI-assisted session recording or transcription begins
Mandate explicit informed consent before any AI tool is used to generate notes from session content

The framework closely mirrors Illinois Public Act 104-0054. If it passes, it would apply to one of the largest therapy markets in the country, including a substantial share of the telehealth population.

Even practitioners who do not currently have New York clients should understand this bill's direction: it reflects the regulatory intent that is spreading across states. Practitioners who build explicit written consent workflows now will not need to scramble when their state's version of this bill passes.

The recording consent layer predates AI entirely but applies directly to ambient AI documentation tools. US states fall into two categories under their wiretapping and electronic surveillance statutes:

One-party consent (37 states): Only one party to the conversation must consent to recording. As the therapist, your own consent is sufficient under state law. You can record sessions without your client's consent, strictly speaking, under state recording law. (HIPAA, ethics codes, and clinical practice standards create additional obligations, but state recording law itself does not require the client's consent in these states.)

All-party consent (13 states): Every participant must consent before any recording begins. These states are:

State	All-Party Consent	AI-Specific Law
California	Yes	No (monitoring bills)
Connecticut	Yes	No
Delaware	Yes	No
Florida	Yes	No
Illinois	Yes	Yes (Public Act 104-0054)
Maryland	Yes	No
Massachusetts	Yes	No
Michigan	Yes	No
Montana	Yes	No
New Hampshire	Yes	No
Oregon	Yes	No
Pennsylvania	Yes	No
Washington	Yes	No

Illinois appears on both lists. It is the only state in 2026 that carries both an all-party consent recording statute and an AI-specific psychotherapy law. Practitioners with Illinois clients face the highest compliance burden of any US jurisdiction.

For therapists in the remaining 12 all-party consent states: the AI-specific law is not yet in place, but the recording consent requirement is. Using an ambient AI scribe that captures session audio in these states without explicit client consent may constitute a recording law violation independent of any AI-specific regulation.

The 40-Plus Bills Moving Through State Legislatures

Illinois and New York are the most prominent examples, but they are not outliers. Manatt Health's AI Policy Tracker documents more than 40 AI mental health bills moving through approximately 25 state legislatures as of 2026.

The common themes across these bills:

Informed consent before AI records, transcribes, or processes session content
Therapist review and approval of AI-generated notes before they enter the clinical record
Prohibitions on autonomous AI clinical decision-making
Disclosure requirements separate from general technology disclosure language

The direction is consistent. More states will add consent requirements in 2026 and 2027. A 50-state legislative review published in PMC (article PMC12578431) confirms that explicit informed consent requirements for mental health AI remain rare nationally but are accelerating.

The practical implication for every therapist, regardless of state: building a proper AI consent workflow now costs little and protects you when your state's bill passes. Waiting for a state mandate to take effect creates a compliance gap that is particularly visible to licensing boards.

How Your Tool's Architecture Determines Your Compliance Exposure

This is the part that most compliance discussions skip. The consent burden is not uniform across AI documentation tools. It depends directly on how your specific tool generates notes.

Ambient recording tools capture session audio in real time or record sessions for later processing. The AI generates a note from the session audio or transcript. Examples include tools that require microphone access during sessions, browser-based in-session listeners, and post-session audio upload workflows. These tools generate notes from a recording of the session.

Under Illinois Public Act 104-0054, an ambient recording tool requires explicit written client consent before each client's sessions. Under the recording consent statutes in the 13 all-party consent states, using an ambient tool without client consent may violate state recording law directly.

Generation-based tools work differently. The therapist writes a summary of the session after it ends. The AI structures that written input into a formatted clinical note. No audio is captured during or after the session. No transcript of the session is created. The source material is the therapist's own post-session written summary.

Under both the Illinois law and the recording consent statutes in all-party consent states, the highest-friction requirement is triggered by "recording or transcribing" a session. A generation-based tool does not record the session and does not transcribe it. The therapist's written summary is not a recording of the session; it is the therapist's own memory and clinical impressions rendered in text.

This architectural distinction does not eliminate all consent obligations. Clients generally have a right to know that AI assists in the documentation of their care. Best practice calls for an AI disclosure in informed consent paperwork regardless of tool type. But the specific requirement for explicit written consent tied to session recording does not apply to a tool that does not record.

The practical result: therapists using generation-based tools in all-party consent states face a much lower compliance burden than therapists using ambient recording tools in the same states.

A Fictional Example: Dr. Sonia and Her Multi-State Practice

Dr. Sonia is a licensed psychologist in Pennsylvania who also holds PSYPACT authority to see telehealth clients in other participating states. She sees clients in Pennsylvania, New Jersey, Texas, and occasionally in Illinois and California.

Her current documentation tool: an ambient AI scribe that activates during telehealth sessions, captures audio, and generates a SOAP note afterward.

Pennsylvania: All-party consent state. Dr. Sonia needs her Pennsylvania clients' explicit consent before using the ambient tool.

New Jersey: One-party consent state. State recording law does not require client consent for the recording itself, though disclosure is still best practice.

Texas: One-party consent state. Same analysis as New Jersey.

California: All-party consent state. For any client physically located in California during a telehealth session, Dr. Sonia needs explicit consent even though she is not licensed in California. Under the general rule for multi-state telehealth, the more restrictive state's law applies.

Illinois: All-party consent state plus Public Act 104-0054. Dr. Sonia needs explicit written consent for her Illinois clients that specifically addresses AI-assisted recording and transcription, compliant with the language of the Act. Civil penalties up to $10,000 per violation apply.

If Dr. Sonia switched to a generation-based documentation tool, her Pennsylvania, California, and Illinois consent obligations for the recording layer would not apply. She would still disclose AI use in her intake paperwork, but the explicit written consent for recording or transcription would not be required because there is no recording or transcription occurring.

For practitioners using ambient recording tools in regulated jurisdictions, or practitioners building compliant workflows ahead of anticipated legislation, here is what adequate written consent for AI documentation typically needs to cover:

Description of the AI tool. Name the tool and explain its function in plain language. Clients do not need to understand large language models, but they need to understand that their sessions are being processed by an external AI system.

What the tool does with session content. If the tool records audio, say so. If it creates a transcript, say so. If notes are stored on the tool's servers and for how long, include that.

Whether a BAA is in place. Clients in HIPAA-covered practices have an interest in knowing whether PHI protections apply to the external tool.

The therapist's review process. Illinois law specifically requires therapist review of AI-generated content before it enters the record. Your consent document should reflect that the note you sign is reviewed and approved by you, not submitted as raw AI output.

The client's right to decline. Clients should know they can decline AI-assisted documentation and what alternative process you will use if they do.

State-by-State Compliance Summary for 2026

Illinois

Highest compliance burden in the US.

All-party consent recording statute applies
Public Act 104-0054 requires explicit written consent for AI-assisted recording or transcription
Civil penalties up to $10,000 per violation
AI output must be reviewed by therapist before entering clinical record
Recommended action: Written consent form specific to AI documentation, reviewed against the text of Public Act 104-0054

California

All-party consent recording statute applies. No AI-specific mental health law in effect as of April 2026, but active legislative monitoring.

Ambient recording tools require client consent under Penal Code 632
Generation-based tools are not triggered by recording consent law
Recommended action: Explicit consent for ambient tool users; disclosure paragraph for generation-based tool users

Florida, Pennsylvania, Maryland, Massachusetts, Michigan, Washington, Oregon, Connecticut, Delaware, Montana, New Hampshire

All-party consent recording statutes apply. No AI-specific mental health law in effect as of April 2026.

Same analysis as California
Legislative tracking recommended: several of these states have active AI mental health bills under consideration

New York

One-party consent state currently. S.8484 pending.

No recording consent requirement for therapist-recorded sessions under current law
If S.8484 passes, explicit informed consent for AI-assisted note generation from session content would be required
Recommended action: Disclosure paragraph in intake forms now; monitor S.8484 progress; build consent workflow in advance

Recording law does not require client consent for therapist-recorded sessions. No state AI-specific law in effect.

HIPAA BAA requirement still applies for tools touching PHI
General AI disclosure in intake paperwork is best practice
Monitor state licensing board guidance: several licensing boards are issuing AI-specific guidance in 2026 independent of legislative action
Legislative tracking recommended: 40-plus bills across 25 states means your state may not remain in this category through 2027

Where Generation-Based Tools Fit

Tools like NotuDocs operate on a generation-based model: you write a brief post-session summary and the AI structures it into your preferred note format. Because no audio is recorded and no session transcript is created, the recording consent layer in the 13 all-party consent states does not apply to the core workflow. NotuDocs is not HIPAA compliant and does not sign BAAs, so it is not appropriate for practitioners who require a BAA as their baseline compliance requirement.

Pre-Session Compliance Checklist for 2026

Know your tool's architecture

Does my AI documentation tool record or transcribe session audio, or does it process only text I write after the session?
Have I reviewed the tool's data processing documentation to understand how session content is stored and for how long?

Know your jurisdictions

Have I identified every all-party consent state in which any of my clients are physically located during sessions?
Do I have any Illinois clients? If yes, is my consent process compliant with Public Act 104-0054?
Do I have any New York clients? If yes, am I monitoring S.8484's progress?
Have I checked whether my state licensing board has issued AI documentation guidance in 2026?

Consent documentation

Does my intake informed consent form disclose that I use AI-assisted documentation?
If my tool records or transcribes sessions, does each client have a signed written consent specifically authorizing that, before their sessions begin?
Does my consent document describe the tool, explain the recording behavior, and describe my review process before notes enter the record?

Telehealth-specific

For telehealth clients, do I know where each client is physically located during sessions, not just where they reside?
Have I adopted the most restrictive applicable standard practice-wide, rather than tracking each client's jurisdiction session by session?

Ongoing monitoring

Do I have a process for updating consent documentation when state laws change?
Am I monitoring my state legislature for AI mental health bills?

The compliance picture for AI documentation tools is shifting faster than most continuing education programs have updated their content. Practitioners who understand the two-layer structure (AI-specific laws plus recording consent laws), know which category their tool falls into architecturally, and have explicit written consent workflows in place are largely protected against the current wave of state legislation. Those who are treating "my tool says it's HIPAA compliant" as the complete answer are carrying risk they may not realize they have.