State-by-State Guide to AI Documentation Consent and Recording Laws for Therapists in 2026

A practical breakdown of state AI consent laws, recording statutes, and compliance requirements for mental health practitioners using AI documentation tools in 2026. Covers Illinois Public Act 104-0054, New York S.8484, all-party consent states, and how your tool's architecture determines your compliance burden.

If you are a licensed therapist in Illinois, California, or Florida who recently started using an AI documentation tool, there is a real chance you have not heard of a law that already applies to you.

Since August 2025, Illinois has had the first state law in the US explicitly regulating AI use in psychotherapy. New York has proposed its own version. More than 40 AI mental health bills are moving through 25 state legislatures as of 2026.

This guide gives you a state-by-state breakdown of what you need to know, what your compliance obligations actually are, and why your tool's technical architecture determines most of your legal exposure.

Why State Law Matters More Than You Think

Most therapists know they need a Business Associate Agreement (BAA) before using any AI tool that touches protected health information. That is table stakes under HIPAA.

But HIPAA is federal law with a federal floor. State laws can add requirements on top of that floor, and several states are doing exactly that right now, specifically around AI use in mental health settings.

There are two distinct legal layers to understand:

AI-specific mental health laws (new, state-by-state, targeting how AI is used in psychotherapy)
Recording consent laws (older, established, governing whether you can record a conversation without everyone's consent)

These two layers interact in ways that create very different compliance obligations depending on how your AI documentation tool actually works.

Illinois Public Act 104-0054: The First State AI Psychotherapy Law

Illinois enacted Public Act 104-0054, the Wellness and Oversight for Psychological Resources Act, in August 2025. It is the first law in the United States to explicitly define and regulate the use of AI in psychotherapy services.

Here is what the law requires:

Explicit written client consent before any AI-assisted recording or transcription. If you use a tool that records or transcribes a session for note-writing purposes, your Illinois client must provide written consent before the session begins. This is not a disclosure buried in your intake paperwork. The law specifies explicit written consent.

Civil penalties up to $10,000 per violation. This is not a warning system. Each violation carries a potential $10,000 civil penalty. If you have been running an ambient recording tool with 20 clients in Illinois without explicit written consent, the exposure is material.

AI tools are classified as "supplementary support." The law permits AI documentation tools. It does not ban them. But it draws a clear line: AI may assist the therapist, but it may not operate autonomously in the therapeutic relationship. The therapist remains the clinical decision-maker, and AI output must be reviewed and approved before entering the clinical record.

What this means practically: If you are an Illinois-licensed therapist using any tool that records audio, generates transcripts, or converts session audio into notes, you need a written client consent workflow in place. If you have been treating AI notes like a private administrative tool, Illinois law now treats them as a regulated clinical technology.

New York S.8484: The Proposed Federal Companion

New York Senator Kristen Gonzalez introduced S.8484, the Oversight of Technology in Mental Health Care Act, in 2025. As of this writing, it has not passed, but it warrants attention for several reasons.

The bill would:

Prohibit autonomous AI therapeutic decision-making (AI cannot make clinical recommendations without therapist oversight)
Require patient notification of the AI's purpose before any AI-assisted session recording or transcription
Mandate explicit informed consent before any AI tool is used for note generation from session content

The framework mirrors Illinois closely. If New York passes this bill, it would affect one of the largest therapy markets in the country, with significant overlap with the national telehealth population.

What to do now: Even if you practice in New York and S.8484 has not passed, the proposed language tells you where the state's regulatory intent is heading. Practitioners who build written consent workflows now will be ahead of a compliance requirement that is almost certain to arrive.

Separate from AI-specific legislation, every US state has a wiretapping or recording consent statute that predates AI documentation tools but applies to them directly.

These laws fall into two categories:

One-party consent states (31 states): Only one person in the conversation needs to consent to recording. As the therapist, your own consent is sufficient to record your sessions legally under state law.
All-party consent states (11 states + DC): Every participant in the conversation must consent before any recording begins.

The all-party consent states are:

California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Oregon, Pennsylvania, and Washington.

For therapists in these states, using an AI tool that records or transcribes sessions without explicit client consent is not just an ethics concern. It may be a violation of state wiretapping or electronic surveillance law.

This layer predates AI entirely. But it now applies with full force to any AI tool that operates by capturing, transcribing, or processing session audio in real time or after the session from a recording.

Important: The "recording" that triggers all-party consent laws is not just audio recording. Courts in several states have applied similar standards to transcription, because a transcription captures the substance of a private conversation in the same way a recording does.

How These Two Legal Layers Interact

Here is where it gets complicated for telehealth practitioners.

PSYPACT and Multi-State Practice

PSYPACT is the Psychology Interjurisdictional Compact, which allows licensed psychologists in participating states to provide telehealth services across state lines. Similar compacts exist for other licensure types.

The critical rule: when state laws conflict across a telehealth session, the more restrictive state's law controls.

If you are licensed in Texas (one-party consent) and your client is physically located in California during a telehealth session, California's all-party consent law applies to that session. If you have any telehealth clients in all-party consent states, the practical answer is to adopt the most restrictive standard practice-wide rather than tracking each client's location session by session.

Illinois appears on both lists. If you have any Illinois clients, you face both the specific written consent requirement of Public Act 104-0054 and the state's all-party consent recording statute.

The consent obligations compound. This is the most heavily regulated jurisdiction in the US for AI-assisted therapy documentation as of 2026.

What Your Tool's Architecture Determines

This is the part most compliance discussions skip.

The consent burden attached to AI documentation tools is not uniform. It depends directly on how the tool generates notes.

There are two architecturally distinct models:

Ambient recording tools (session-concurrent): The tool listens to or records the session in real time and uses the audio to generate a note afterward. Examples: tools that use in-session microphone access, browser-based ambient listeners, or session transcript workflows. These tools trigger all-party consent requirements in the 11 high-scrutiny states and the explicit written consent requirement under Illinois law. The session audio or transcript is the source material.

Generation-based tools (post-session text entry): The therapist types a brief summary of the session after it ends. The AI structures that written input into a formatted clinical note. No audio is captured. No transcript is created. The therapist's own written summary is the source material. These tools do not record the session and do not transcribe it.

The distinction matters legally because both Illinois Public Act 104-0054 and the recording consent statutes in all-party consent states specifically regulate the recording or transcription of a session. A tool that does not record or transcribe the session is not captured by the highest-friction requirements of those laws.

Generation-based tools reduce the compliance surface area materially. The therapist still has disclosure obligations (clients generally have a right to know if AI assists in their documentation), but the recording consent conversation is not required because there is no recording.

This is why the "no recording" feature of some documentation tools is not just a privacy differentiator. In 11 states plus DC, it is a compliance feature.

Practical Compliance Checklist by Jurisdiction

These states include Texas, New York (currently), Georgia, Colorado, Ohio, Minnesota, and most states not listed as all-party consent states above.

Review your AI tool's data processing agreement or BAA status (this is still a HIPAA requirement)
Add AI documentation disclosure to your informed consent intake forms (best practice even where not yet required)
Confirm whether your state psychology or counseling board has issued any AI guidance (several licensing boards are publishing guidance in 2026)
Monitor state legislative activity if you are in a state with active AI mental health bills

California, Connecticut, Delaware, Florida, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Oregon, Pennsylvania, Washington.

Determine whether your AI documentation tool records or transcribes sessions (ambient model) or processes only post-session text input (generation-based model)
If ambient: obtain explicit written consent from every client before using the tool in their sessions; document this consent in your records
If generation-based (post-session text only): recording consent laws are not triggered; add a general AI disclosure to your intake paperwork noting that AI assists with structuring your written notes
For telehealth clients: identify where each client is physically located during sessions; apply the more restrictive state's standard if they are in an all-party consent state

If You Practice in Illinois

Obtain explicit written consent from every client specifically authorizing AI-assisted documentation (this is required under Public Act 104-0054 regardless of tool type for any AI that touches session content)
If your tool records or transcribes sessions: double-check compliance with both the AI-specific law and the state's all-party consent statute
Review your consent document language against the specific language of Public Act 104-0054; general "we use technology" disclosures are not sufficient
Review AI-generated notes before signing them into the clinical record; the law requires therapist oversight of AI output
Document your review process

If You Are a Telehealth Practitioner Serving Multiple States

Audit your client base for clients physically located in all-party consent states during sessions
Adopt the most restrictive applicable standard practice-wide (treat all recording-adjacent AI tools as requiring client consent from every client)
For any client in Illinois: apply the full Public Act 104-0054 written consent requirement regardless of where you hold licensure
Build a consent renewal process: as state laws change, consent captured at intake may need to be updated

Whether required by law or provided as best practice, your AI documentation consent disclosure should cover the tool's recording behavior (does it capture audio or not), who accesses the output and for how long, whether a BAA or data processor agreement is in place, and your review process before notes enter the clinical record.

For generation-based tools, a single honest paragraph works well: explain that you write a post-session summary, AI structures it into a progress note, and the tool has no access to session audio. Clients who decline recording-based tools may still accept a generation-based workflow once they understand the distinction.

The 40+ Bills Moving Through State Legislatures

Illinois and New York are the most prominent, but they are not alone. More than 40 AI mental health bills are moving through approximately 25 state legislatures as of 2026, based on tracking by Manatt Health's AI Policy Tracker. Common themes include informed consent before AI records or transcribes sessions, therapist supervision and review of AI-generated content, and prohibitions on autonomous AI clinical decision-making.

The direction is consistent: more states will add consent and disclosure requirements in 2026 and 2027. The question is not whether additional states will regulate AI documentation tools, but how quickly and with what specific requirements.

A Note on NotuDocs

NotuDocs is a generation-based documentation tool: you type a post-session summary and the AI structures it into your preferred clinical note format. The tool does not record sessions and does not transcribe audio. This architecture means the recording consent layer discussed in this guide does not apply to its core workflow. NotuDocs is not HIPAA compliant and cannot sign Business Associate Agreements, so it is not appropriate for practitioners who require a BAA as part of their compliance framework.

Pre-Compliance Checklist: Before Your Next Session

Use this list to audit your current AI documentation setup against the 2026 legal landscape.

Tool architecture:

I know whether my AI documentation tool records or transcribes session audio, or whether it processes only post-session text I write
I have reviewed my tool's data processing documentation to confirm how session content is stored and for how long

Consent documentation:

My intake informed consent form discloses that I use AI-assisted documentation
If my tool records or transcribes sessions, I have explicit written consent from each client before using it in their sessions
If I practice in Illinois, my consent language specifically addresses AI-assisted documentation under the requirements of Public Act 104-0054

Jurisdiction check:

I have identified whether any of my clients (especially telehealth clients) are physically located in all-party consent states during sessions
I have confirmed whether my state licensing board has published AI documentation guidance in 2026

Ongoing monitoring:

I have a process for updating consent documentation when state laws change
I have checked whether my state has active AI mental health legislation pending

The regulatory floor for AI documentation in therapy is rising. Practitioners who build consent workflows now, understand how their tools work technically, and stay current with state-level legislation will handle any audit or licensing board inquiry with confidence. Those who treat "HIPAA-compliant" as the complete answer to every compliance question are running a legal risk that is becoming more concrete every legislative session.