AI Therapy Notes and State Law: Your 2026 Compliance Guide

If you have been avoiding the topic of state AI law because it sounds complicated, the avoidance is now costing you something real. As of April 2026, four states have enacted AI-specific laws that directly affect how therapists may use AI documentation tools, and four more have bills advancing through legislatures. Civil penalties range from $10,000 to $250,000 per violation depending on the state.

Most of these laws affect ambient AI scribes (tools that record and transcribe your sessions) far more than generation-based documentation tools (tools where you write a post-session summary and the AI structures it). That distinction matters, and this guide explains exactly where the lines are drawn.

This is not a legal opinion. It is a practical overview of enacted legislation and advancing bills that every therapist using AI documentation tools should understand heading into the second half of 2026.

---

The Critical Distinction: Recording Versus Generation

Before the state-by-state breakdown, one concept organizes almost everything else in this guide.

Ambient AI scribes record your session audio in real-time. They listen, transcribe, and use that transcript to generate a clinical note. The tool processes audio during or immediately after the session.

Generation-based documentation tools do not record anything. After the session ends, you type or dictate a brief clinical summary of what happened. The AI takes that summary and structures it into a formatted progress note using your template. No session audio is ever captured.

State laws in Nevada, Illinois, Colorado, California, and Louisiana all contain carve-outs for what they call "supplementary support" activities, which include preparing client records. Generation-based tools fall squarely within that carve-out. The recording and transcription consent requirements in those laws apply specifically to tools that record sessions.

Rhode Island's HB 7538 is the one exception worth knowing: it would require notification for any AI documentation tool, including generation-based ones. That bill is discussed in detail below.

---

Enacted State Laws (In Effect Now)

Nevada: AB 406 (Effective July 2025)

Nevada was among the first states to enact AI-specific legislation for behavioral health settings, and because it passed quietly, many therapists in Nevada are unaware it applies to their practice.

What it does:

Nevada AB 406 requires that any AI-generated record used in a behavioral health or mental health context must undergo independent clinician review before it enters the clinical record. The reviewing clinician must be the treating provider or a qualified supervisor. The law defines independent review as a meaningful clinical evaluation, not a cursory sign-off.

The statute also establishes that AI tools used for "supplementary support" in preparing client records are permitted without prior authorization, but the review requirement applies to the output of any such tool.

Penalties: Civil penalties for violations involving patient safety or records integrity apply under Nevada's existing healthcare records statutes, with fines calibrated to the severity of the breach and whether protected health information was involved.

What this means in practice:

If you practice in Nevada and use any AI tool to generate or assist with clinical notes, you must review and approve each note before it is filed. This is the standard workflow for generation-based tools, where the therapist writes the summary and reviews the AI-structured output before saving. Ambient tools that auto-generate notes and push them toward the record without a formal review step are the higher-compliance-risk category under AB 406.

A sample scenario: Maria, a licensed clinical social worker in Las Vegas, uses a generation-based AI tool. She writes her post-session summary, reviews the structured note the AI produces, makes two small edits, and signs it. That sequence satisfies AB 406's independent review requirement naturally. The workflow she already follows is compliant.

---

Illinois: Public Act 104-0054 / WOPRA (Effective August 2025)

Illinois enacted the most detailed AI psychotherapy law in the country. The Wellness and Oversight for Psychological Resources Act (WOPRA) specifically defines how AI may be used in mental health services.

What it does:

WOPRA classifies AI documentation tools as "supplementary support" and permits their use. However, if the tool involves recording or transcribing a session, the therapist must obtain explicit written informed consent from the client before any recording or transcription begins. The consent form must describe what AI is being used, what the data is used for, and how long it is retained.

A HIPAA authorization is not a substitute. WOPRA requires a separate, AI-specific consent document that clearly addresses the recording or transcription process.

Penalties: Civil penalties of up to $10,000 per violation. Each session recorded without consent is a separate violation.

What this means in practice:

If you use an ambient scribe in Illinois, you need a signed AI consent form from every client before you activate the tool for that client's sessions. If a client declines consent, you cannot use the ambient tool with them.

If you use a generation-based tool, no additional written consent is required under WOPRA. The law's consent trigger is the act of recording or transcribing. Typing a post-session summary and having the AI structure it does not involve either.

Practical note on timing: WOPRA has been in effect since August 2025. If you have been using an ambient scribe in Illinois since then without obtaining WOPRA-specific consent forms, you may already have exposure. Retroactive correction is possible: obtain consent from active clients now, and update your intake documentation going forward.

---

Texas: Two-Layer Compliance (Effective September 2025 and January 2026)

Texas is the most compliance-dense state for AI documentation because two separate laws stack on top of each other.

Texas SB 1188 (effective September 1, 2025):

This law governs AI used for diagnostic or treatment recommendation purposes in healthcare settings. For therapists, the practical effect is clear: if AI generates a record that enters the clinical file, the treating clinician must review and approve that record in a manner consistent with medical records standards.

SB 1188 also requires that electronic medical records processed by third-party vendors be hosted on U.S.-based servers. Data cannot be physically stored or processed outside the United States.

Penalties: $5,000 to $250,000 per violation, depending on intent and whether protected health information was used for financial gain.

Texas TRAIGA / HB 149 (Texas Responsible AI Governance Act, effective January 1, 2026):

TRAIGA is a broader disclosure law. It requires clear and conspicuous patient notification whenever AI is used in their care. Unlike SB 1188, TRAIGA is not limited to diagnostic or treatment AI. It applies to any AI use in the clinical context, including documentation AI.

What this means in practice:

Texas therapists using any AI documentation tool now have two obligations running simultaneously.

The first is disclosure: you must notify clients that AI assists with their documentation. This can be a brief written notice in your informed consent paperwork, a verbal acknowledgment documented in the record, or both. TRAIGA does not specify a particular consent form format, but the disclosure must be clear enough that a reasonable patient would understand what AI is doing in their care.

The second is review: every AI-generated note that enters the clinical record must be reviewed and approved by you before filing. For generation-based tools, this is the normal workflow. For ambient tools, you need a documented review step between note generation and record entry.

The stacking effect: Texas is the only state as of April 2026 where both a disclosure requirement (TRAIGA) and a review requirement (SB 1188) apply simultaneously to all AI documentation tools. Ambient scribes face the most friction: recording consent best practices, TRAIGA disclosure, and SB 1188 review documentation. Generation-based tools face one friction point: TRAIGA disclosure.

---

Advancing State Bills: What to Monitor

The following bills had not yet been enacted as of April 2026, but each was advancing through a state legislature. If any of these pass, the compliance picture in those states changes significantly.

Colorado: HB 1195 (Advancing)

Colorado's bill mirrors Illinois' WOPRA framework in its core structure. It would require written client consent before any AI recording or transcription of a session begins. The bill includes the same "supplementary support" carve-out that exempts generation-based tools from the consent requirement.

If HB 1195 passes, Colorado therapists using ambient scribes will face the same consent workflow that Illinois therapists already navigate. Generation-based tool users in Colorado would not need to change their workflow.

Colorado has one of the largest per-capita psychologist populations in the country, and its bill is being watched as a potential template for other Western states.

California: SB 903 (Advancing)

California is the largest U.S. therapy market by practitioner count. SB 903 would impose written client consent requirements for AI recording or transcription of therapy sessions, closely following the Illinois model.

California is also an all-party consent state under existing wiretapping law, which means ambient AI scribes already require client consent to legally record a session before any AI-specific law comes into play. SB 903 would layer AI-specific consent requirements on top of that existing recording consent obligation.

If SB 903 passes, a California therapist using an ambient scribe would need to satisfy three distinct consent obligations: California's existing all-party consent wiretapping requirement, the SB 903 AI-specific consent form, and HIPAA authorization for data handling if applicable. Generation-based tools would remain exempt from all three recording-related consent requirements.

Given California's size and legislative history, SB 903's passage or failure will likely be the most consequential single vote in AI therapy documentation law in 2026.

Rhode Island: HB 7538 (Advancing, Stalled in Senate)

Rhode Island's bill is the outlier in this group and deserves specific attention because it would affect generation-based tool users in a way no other bill currently does.

HB 7538 would require that any therapist using any AI tool in their documentation process notify their clients of that use. The bill does not limit its notification requirement to tools that involve recording or transcription. If the AI structures your notes, you would need to tell clients.

This is the same direction Texas took with TRAIGA, but Rhode Island's bill frames it as a notification requirement specific to psychotherapy rather than a general AI disclosure law. As of April 2026, the bill had advanced out of committee but stalled in the Senate. Whether it passes in the current session or returns in 2027 is uncertain.

What this means if it passes: Therapists using generation-based tools in Rhode Island would need to include a disclosure in their informed consent documentation that AI assists with structuring their session notes. This is a low-friction step, but it is an additional documentation obligation. Most therapists would address it with a single sentence added to their existing informed consent form.

Louisiana: HB 475 (Advancing)

Louisiana's bill focuses specifically on the recording trigger. It would require healthcare providers to verbally notify patients prior to recording a session for AI transcription, even in a clinical setting.

Louisiana is a one-party consent state under existing law, which means a provider can legally record a conversation with their own consent. HB 475 would override that permissiveness for AI-transcribed sessions: even though recording is technically legal, verbal notification to the patient would be required before the AI transcription activates.

Generation-based tools are not affected. There is no recording to notify about.

---

The "Supplementary Support" Carve-Out Explained

Every enacted law described above (Nevada, Illinois, Texas) and most advancing bills (Colorado, California) include a carve-out that permits AI use in "supplementary support" activities, which include preparing client records.

This language is not accidental. Legislatures are drawing a deliberate line between two types of AI activity in clinical settings:

1. AI that interacts with the clinical encounter (listening to sessions, making diagnostic suggestions, generating interpretations during care) — regulated more heavily, subject to consent and disclosure requirements.

2. AI that supports the documentation task (helping a clinician structure their written summary of what happened) — permitted as supplementary support, subject to HIPAA and general AI disclosure obligations, but not subject to the higher-burden consent requirements designed for recording.

Generation-based documentation tools fall into the second category. Therapists who use them are performing the clinical work themselves (assessing, deciding, documenting what they observed) and using AI to structure that record. State legislatures have consistently treated this as a lower-risk activity than real-time recording of sessions.

Understanding this distinction is not just a legal technicality. It is the organizing principle of the entire regulatory landscape as it currently exists.

---

State Compliance Checklists

Use the checklist for your state. If you practice in multiple states via telehealth, apply the most restrictive state's requirements across your caseload.

If You Practice in Nevada

• Every AI-generated note is reviewed by you before it enters the clinical record
• Your documentation workflow includes a review step between AI output and filing
• If using a third-party AI tool, verify that data is handled in accordance with Nevada healthcare records law
• No AI-generated records are filed without clinician approval

If You Practice in Illinois

• For ambient scribes: every active client has signed an AI-specific consent form that describes recording, transcription, data use, and retention period
• The AI consent form is separate from your general HIPAA authorization
• New client intake includes WOPRA-compliant AI consent before any session with ambient recording
• If you use a generation-based tool: no additional consent is required under WOPRA, but document your review step for each note

If You Practice in Texas

• Your informed consent documentation includes a clear disclosure that AI assists with your clinical documentation (TRAIGA requirement)
• Every AI-generated note is reviewed and approved by you before entering the clinical record (SB 1188 requirement)
• Your AI tool's data is hosted on U.S.-based servers (SB 1188 requirement — verify with your vendor)
• If using an ambient scribe: recording consent, TRAIGA disclosure, and SB 1188 review are all documented

If You Practice in Colorado (HB 1195 Advancing)

• Monitor the bill's status at leg.colorado.gov/bills/HB26-1195
• If the bill passes: prepare a client consent form for AI recording/transcription if you use an ambient scribe
• If you use a generation-based tool: the bill's supplementary support carve-out covers your workflow; no consent form required for the recording requirement, but disclose AI use in general informed consent as a best practice

If You Practice in California (SB 903 Advancing)

• You are already in an all-party consent state: any ambient recording requires client consent under existing wiretapping law
• Monitor SB 903's progress — if it passes, a separate AI-specific consent form will be required for ambient scribes
• If you use a generation-based tool: all-party consent law does not apply (no recording); SB 903 carve-out for supplementary support covers your documentation workflow
• Disclose AI use in general informed consent as a best practice regardless of what SB 903 does

If You Practice in Rhode Island (HB 7538 Advancing)

• Monitor the bill's status in the Rhode Island Senate
• If the bill passes: add a one-sentence AI documentation disclosure to your informed consent form, regardless of whether you use an ambient or generation-based tool
• This applies to generation-based tools as well — HB 7538 does not limit notification to recording contexts

If You Practice in Louisiana (HB 475 Advancing)

• Monitor the bill's progress
• If it passes and you use an ambient scribe: add a verbal notification step at the start of each session before activating AI transcription; document that notification in the session record
• If you use a generation-based tool: verbal notification is not required (no recording or transcription)

All States: Baseline Compliance Regardless of Location

• Disclose AI use in your informed consent documentation — even in states without specific AI laws, client transparency is an ethical standard
• Review every AI-generated note before it enters the clinical record — this protects you clinically and satisfies the review requirements in Nevada and Texas regardless
• Verify your AI tool vendor's data hosting location if you practice in Texas (U.S.-server requirement)
• Keep records of any consent forms signed by clients for AI documentation, stored separately from session notes
• Update your informed consent documentation at least annually as this regulatory landscape continues to evolve

---

How to Talk to Clients About AI Documentation

One practical challenge that the state compliance picture surfaces is the client conversation. Therapists using ambient scribes who operate in consent-required states cannot simply add a checkbox to their intake form. The conversation matters, and for some clients it will require careful handling.

For ambient scribe users in consent-required states:

The consent conversation is most effective when it is matter-of-fact and specific rather than defensive. Something like: "After our session, I use an AI tool that transcribes the recording and helps me structure my clinical notes. The audio is processed and then deleted. I want to make sure you understand how this works and get your written consent before we start using it."

Clients who ask about privacy are asking a legitimate clinical question. Being specific about what is recorded, where it goes, and when it is deleted usually resolves the concern. Clients who decline can be accommodated by turning off the ambient tool for their sessions and using a generation-based approach instead.

For generation-based tool users:

The conversation is lighter. "I use a tool that helps me structure my notes after our session. I write a summary of what we covered, and the tool organizes it into a clinical format. Nothing from our session is recorded." In states without specific consent requirements for this workflow, many therapists include a brief note in their informed consent documentation rather than raising it conversationally in every intake.

In Texas, the TRAIGA disclosure is required regardless of tool type. A single sentence in your intake paperwork satisfies the obligation for generation-based tools.

---

What Is Coming Next

The regulatory picture for AI documentation tools in therapy will keep developing through 2026 and into 2027. The trajectory is clear even if the specific laws are not yet settled.

More states will pass recording consent and disclosure requirements for ambient scribes. The Illinois model is the template — multiple states have introduced bills that copy its "supplementary support" carve-out structure while adding local requirements.

Generation-based tools will face lighter compliance friction than ambient tools for the foreseeable future, because every major state's legislative approach has treated recording as the high-risk activity and structured documentation support as permitted.

Rhode Island's HB 7538 is the one exception to watch: if that notification-for-any-AI-tool approach spreads to other states, generation-based tool users will eventually face a light disclosure obligation in those states as well.

The practical guidance for now: whatever tool you use, build disclosure into your informed consent documentation, review every AI-generated note before filing it, and check the legislative calendar in your state at least twice a year. The compliance cost of staying current is low. The compliance cost of being caught behind is not.

---

Tools that support a review-first workflow, where you write the clinical summary and the AI structures it rather than generating content from session recordings, have a structural compliance advantage under every enacted state AI law as of April 2026. NotuDocs uses that generation-based model, which means its workflow already satisfies the independent review requirements in Nevada and Texas without adding procedural steps. That said, HIPAA compliance and BAA execution remain the first filter for any clinical AI tool, and therapists should evaluate those requirements independently of state AI law compliance.

---

Full Compliance Checklist Summary

For ambient scribe users:

• Identify all-party consent states in your practice geography
• Obtain AI-specific written consent from every client in all-party consent states and in Illinois
• Maintain signed consent forms separately from session notes
• Disclose ambient AI use in Texas (TRAIGA) and document disclosure
• Document your note review step in Texas (SB 1188)
• Prepare verbal notification workflow in Louisiana if HB 475 passes
• Monitor New York S.8484, Colorado HB 1195, and California SB 903

For generation-based tool users:

• Disclose AI use in your informed consent documentation (all states, as a best practice; required in Texas)
• Review every AI-structured note before filing (all states, clinically essential; required in Nevada and Texas)
• Verify U.S.-based data hosting if you practice in Texas (SB 1188)
• Monitor Rhode Island HB 7538 — the only advancing bill that would add a notification step for generation-based tools
• Update informed consent annually as new laws take effect

For telehealth practitioners with multi-state caseloads:

• Apply the most restrictive state's requirements across your entire caseload
• If any client is located in California, Illinois, Colorado (if HB 1195 passes), or another all-party consent state: treat that as the baseline for all clients
• Document client location at time of each telehealth session
• Verify your AI vendor's compliance posture in each state where your clients are located