From Illinois to California, a fast-growing set of AI mental health laws governs how behavioral health providers and payers may use artificial intelligence.
Key Takeaways
- The rules depend on where the patient sits: A cluster of 2025 and 2026 state AI laws governs behavioral health, and compliance is set by the patient’s location, not the provider’s headquarters. A multistate operator can face several conflicting regimes at once.
- Three regulatory models have emerged: Illinois and Nevada bar AI from delivering therapy, Utah permits it with disclosure and a safe harbor, and California and New York require crisis detection backed by private lawsuits. Each model imposes different obligations on the same tool.
- Payer AI is a separate compliance front: Beyond clinical AI, states are governing how insurers use algorithms in coverage decisions, with Arizona requiring human review of AI-driven denials. Utilization management is becoming its own behavioral health compliance question.
- A federal preemption fight is underway: A December 2025 executive order directed federal agencies to challenge state AI laws and condition some funding on a lighter-touch approach. Providers should build to the strictest applicable standard while the courts sort out jurisdiction.
Consider a single mental-health chatbot offered by a small telehealth group. In Illinois, deploying it as a therapist is unlawful and can draw a five-figure fine. In Utah, the same tool is allowed if it discloses that it is software and follows the state’s chatbot rules. In California, effective January 1, 2026, its operator must screen for suicidal ideation and can be sued by users who allege harm. The product is the same. Its legal standing depends on where the patient logs in.
That is the terrain behavioral health has wandered into. Artificial intelligence moved through the field faster than most of the people running it expected: ambient tools that write the clinical note while the clinician listens, chatbots pitched as around-the-clock support, algorithms that decide whether a prior-authorization request lives or dies. Acuity has tracked the commercial side of this closely, from AI tools that draft the clinical note and triage families to platforms that automate clinic scheduling, billing, and intake to the revenue-cycle systems that predict whether a claim will be paid. The law arrived later, and it arrived in fragments. What exists now is not a national framework but a thickening patchwork of state statutes that together decide what a provider, a chatbot, or an insurer may lawfully do with AI, with the rules often flipping at the state line.
The operational catch inside that patchwork is one a surprising number of executives have not absorbed: these laws generally attach to the patient, not the provider. A telehealth group headquartered in one state but treating clients in six answers to six regimes at once. For a corner of medicine that embraced telehealth harder than most and now runs on multistate platforms, a question that looks technological is really jurisdictional.
Three Models for Regulating AI Therapy: Ban, Disclose, or Detect
Sort the statutes and three philosophies fall out. The first is prohibition. Illinois wrote the bluntest version, the Wellness and Oversight for Psychological Resources Act, in force since August 2025, which forbids AI from delivering therapy on its own or being marketed as a therapist unless a licensed professional stays in charge, and lets the state fine violators up to $10,000 each. Nevada’s Assembly Bill 406, live since July 2025, reaches even into the schools, barring AI from standing in for a counselor or psychologist. Both states leave room for clinicians to use AI at the administrative margins, the scheduling and the paperwork, but not to let it sit across from a patient.
The second philosophy is disclosure. Utah declined to ban the chatbots and asked honesty of them instead: House Bill 452 requires a mental health chatbot to state plainly that it is software, curbs how it can advertise, and limits what it may do with the intimate data users hand over. In exchange, Utah extends a safe harbor to operators who follow the rules, an approach the state’s dedicated Office of AI Policy frames as friendly to innovation rather than hostile to it.
The third philosophy is about catching a crisis. California’s Senate Bill 243, effective at the start of 2026, orders companion-chatbot operators to detect signs of suicidal thinking, point users toward help, disclose their non-human nature, and wall off minors, and it hands wronged users the right to sue. New York’s companion-model law, in force since November 2025, runs along similar lines. A second California statute forbids AI from talking as though a licensed human were in the room. The result is the three-way split from the top of this piece: the same product wearing a different legal costume in each jurisdiction.
AI Disclosure Rules Reach Clinical Care
None of this stays tidily inside the world of consumer apps. Texas, through its Responsible Artificial Intelligence Governance Act and a companion health law, both effective in January 2026, now requires providers to tell patients when AI has a hand in their care, though it says little about what that disclosure should contain. The broader wave is bipartisan and large: the Future of Privacy Forum counted dozens of chatbot bills across more than thirty states early in 2026, on top of the hundreds of health-AI measures introduced the year before. Several states, Washington and Oregon among them, want any consumer-facing mental health bot to recognize a crisis and surface a hotline. For a clinic rolling out an ambient scribe, the direction of travel is plain: get documented consent, and keep a licensed human who reads, corrects, and owns whatever the machine produces.
Payer AI and Insurance Denials: The Second Front
There is a second front, quieter and arguably more consequential to the bottom line, and it concerns the AI aimed at providers rather than the AI they wield. Insurers increasingly run prior authorization, claims review, and network upkeep through algorithms, and behavioral health has complained for years about denials it cannot see inside and networks that look fuller on paper than in a patient’s actual search for care. States are beginning to answer. Arizona now insists a human being review any AI-generated denial, and the model bulletin on insurer AI from the National Association of Insurance Commissioners, adopted by most state insurance departments, obliges carriers to keep documented control over the systems they turn loose. The compliance question, then, is no longer only about the AI a provider uses. It is also about the AI used against its claims.
Federal Preemption: The December 2025 Executive Order
The patchwork now has a federal antagonist. On December 11, 2025, the White House issued an executive order aimed at imposing a lighter-touch national approach, directing the Justice Department to assemble a task force to find and challenge state AI laws it considers obstructive, and telling the Commerce Department to dangle federal dollars in front of states willing to fall in line. Whether that gambit actually preempts the statutes described here will occupy the courts for a good while, and Congress has its own chatbot bills circling, most of them focused on children. Until the jurisdictional fog lifts, the prudent assumption is the boring one: the state laws still bind a provider wherever its patients live.
An AI Compliance Checklist for Behavioral Health Providers
So the near-term work is unglamorous. Map every point where AI touches a clinical or member interaction, then check it against the laws of every state you serve, not just the one on your letterhead. Default to the strictest rule in the stack: disclose that a user is talking to software, obtain consent when AI enters care, keep a human clinician signing off on anything AI drafts, an approach some vendors now build directly into their tools, and build crisis detection into anything a patient can talk to. Treat vendor assurances with the skepticism they have earned, because in nearly every one of these laws the legal exposure lands on the operator who deploys the tool, not the company that sold it, and because vendors can vanish or pivot with little warning, as clinics learned when an AI revenue-cycle vendor announced it was sunsetting its stand-alone services on ninety days’ notice.
The stakes stopped being theoretical some time ago. A wrongful-death suit filed early in 2026, alleging that an AI chatbot helped push a user toward suicide, did as much to move legislators as any policy paper, and the tools that draft notes, schedule visits, and screen intakes keep edging closer to the clinical judgment these laws are written to police. The technology is outrunning the statutes, and the statutes are outrunning most compliance departments. The organizations that come through this stretch intact will be the ones that treated AI governance as a discipline rather than a feature toggle.
