Informed Consent for AI in Therapy 2026: Legal Requirements, Ethical Standards, and Practical Implementation

In 2026, informed consent for AI in therapy is no longer a best-practice recommendation. It is a legal requirement in multiple states, an explicit ethical obligation under updated professional codes, and a clinical necessity given that 77% of psychologists report their patients are using AI independently.

The therapist who treats AI disclosure as a checkbox on an intake form is now exposed to licensing board discipline, malpractice liability, and consumer protection enforcement. The therapist who treats it as a meaningful clinical conversation—documented, tool-specific, and revocable—protects both their patients and their practice.

This article provides the legal framework, ethical standards, and practical implementation guidance that practicing clinicians need to obtain defensible informed consent for AI use in 2026.

The 2026 Legal Framework — State-by-State Requirements

Colorado HB 1195 (Effective August 12, 2026)

Colorado's law establishes the most detailed requirements for AI consent in psychotherapy. Under HB 1195, when a client's therapeutic session will be recorded or transcribed through an AI system, the regulated professional must disclose in advance the use of an AI system and the purposes for its use, and must obtain written, informed consent from the client .

The law permits AI use only for administrative or supplementary support, provided the regulated professional maintains responsibility for reviewing any AI outputs . AI may not interact with clients in therapeutic communication without synchronous, real-time professional involvement, nor generate treatment recommendations without professional review and approval . Violations may result in discipline by the appropriate licensing board .

Rhode Island S2197 (Effective June 22, 2026)

Rhode Island's Oversight of Artificial Intelligence Technology in Mental Health Care Act requires that patients be informed in writing that AI will be used, told the specific purpose, and provide revocable consent before AI is used in recorded or transcribed therapeutic sessions . Consent is defined as an affirmative written agreement . The law also prohibits AI from making independent therapeutic decisions or determining treatment plans .

Other States with Active AI Therapy Legislation

Common Legal Requirements Across Jurisdictions

Despite variation, five core requirements emerge across all enacted laws:

1. Written, not verbal, consent: Verbal consent is insufficient. A signed document is required.

2. Specific purpose disclosure: Generic consent forms mentioning "technology" do not satisfy the requirement. The specific AI tool and its purpose must be disclosed.

3. Revocability: Consent must be revocable, and refusal or revocation cannot result in denial of psychotherapy services.

4. Professional oversight: AI may only be used for administrative or supplementary support, not independent clinical decision-making.

5. No AI as therapist: AI may not be marketed as, or function as, a substitute for licensed psychotherapy.

Professional Ethics — What the Codes Now Require

APA Ethical Guidance for AI in Professional Practice

The APA's Ethical Guidance for AI in the Professional Practice of Health Service Psychology establishes that psychologists have an ethical obligation to obtain informed consent by clearly communicating the purpose, application, and potential benefits and risks of relevant AI tools . AI use should be disclosed to patients, other providers, and third parties in a culturally and linguistically appropriate manner .

The guidance emphasizes several domains relevant to consent:

• Transparency and informed consent: Disclose AI use; communicate purpose, application, benefits, and risks.

• Data privacy and security: Ensure tools comply with HIPAA; advocate for robust cybersecurity.

• Accuracy and misinformation: Critically evaluate AI-generated content before applying it clinically; discontinue tools that produce misinformation.

• Mitigating bias: Evaluate AI systems for bias; prevent exacerbation of healthcare disparities.

CAMFT's Three Obligations

The California Association of Marriage and Family Therapists has articulated three obligations that travel together:

1. Disclosure: Informing clients that AI is being used

2. Informed Consent: Obtaining explicit permission

3. Informed Decision Making: Ensuring clients understand the implications

Clients have the right to opt out .

The Forensic Context Distinction

For clinicians involved in forensic work, the APA guidance draws a critical distinction: substantive use of AI—which materially influences opinions—requires proactive disclosure in court reports, while peripheral use (administrative support) only requires informed consent .

What Must Be Disclosed — The Essential Elements

The Frontiers "Facts Label" Framework

A multidisciplinary team from the American Psychiatric Association Committee on Mental Health Information Technology has proposed a standardized facts label for AI-enabled digital mental health technologies, composed of 8 sections :

1. Key identifying information

2. Intended use

3. Warnings

4. Risks and limitations

5. Model information

6. Clinical evidence

7. Accessibility and usability considerations

8. Privacy and security

This framework offers clinicians a structured way to evaluate and disclose AI tool characteristics to patients.

Core Disclosure Elements for Practice

Drawing on the legal and ethical sources, informed consent for AI in therapy must include:

1. That AI is being used. The patient must be explicitly told. Generic references to "technology" or "digital tools" are insufficient.

2. The specific tool and its purpose. Not "we use AI" but "we use [specific tool name] to transcribe sessions and generate draft progress notes, which I review and edit before finalizing."

3. How data is handled. Where data is stored, whether it is used to train AI models, and what security measures protect it.

4. Risks and limitations. AI may produce inaccurate or fabricated information (hallucinations), may reflect algorithmic biases, is not suitable for crises, and lacks the genuine empathy of human connection.

5. The option to opt out. Patients must understand they can refuse or revoke consent at any time without losing access to therapy.

6. Who is responsible. The clinician remains responsible for all clinical decisions and for the accuracy of the final record.

Sample Consent Language

A defensible consent form should include language such as:

"I understand that [Practice Name] uses AI-assisted documentation tools to support clinical record-keeping. These tools transcribe session content to generate progress notes, which are reviewed, edited, and approved by my therapist before becoming part of my permanent record. I understand that:

• AI tools are used only for administrative and documentation support

• All AI-generated content is reviewed by a licensed professional

• My data is protected according to HIPAA and applicable state laws

• AI outputs may be inaccurate and are not used for clinical decision-making

• My data is not used to train AI models without my explicit separate consent

• I may refuse or revoke this consent at any time without affecting my access to therapy"

The Separate Consent Question — AI Training Data

One of the most ethically significant developments in 2026 is the recognition that consent for AI-assisted documentation and consent for using patient data to train AI models are not the same thing.

A 2026 comment in npj Digital Medicine argues that companies increasingly train AI models on therapy transcripts, often relying on lengthy terms of service to obtain assent. The authors argue that contractual assent is not informed consent and call for separate and explicit opt-in consent to train on patient data, along with patient-led governance .

The article draws a direct parallel to the Henrietta Lacks case, noting that patient data achieves a similar "immortality" once incorporated into AI systems, yet with even greater reach because data can be combined with other datasets to generate new inferences and create reidentification risks .

Practical Implication for Clinicians

Therapists must:

1. Understand whether their AI vendor uses client data for model training.

2. Obtain separate, explicit opt-in consent for any such use.

3. Be transparent with clients about how their data is used.

4. Verify that vendor agreements prohibit secondary use, including model training .

A signed Business Associate Agreement (BAA) is necessary but not sufficient. The BAA must specifically prohibit the vendor from training on your data .

Practical Implementation — A Step-by-Step Guide

Step 1: Inventory Your AI Tools

Before obtaining consent, know exactly what AI tools you use, what they do, and how they handle data. This includes:

• AI scribes and documentation tools

• AI-powered scheduling or billing tools

• AI chatbots or between-session support platforms

• Any AI-assisted treatment planning or diagnostic tools

Step 2: Update Informed Consent Documents

Your informed consent forms must explicitly address AI use. This is now required by law in multiple states . The consent must be tool-specific, written, and revocable.

Step 3: Have the Conversation

Informed consent is not a signature. It is a discussion. As SimplePractice guidance states: "This disclosure should not only include a line in your consent form but a discussion about their understanding of AI, how it's currently being used in your practice" .

The conversation should:

• Use plain language

• Explain the "why" (e.g., "This allows me to be more present with you during session")

• Make clear that AI drafts and the therapist reviews

• Explicitly offer the option to opt out

Step 4: Document Consent (and Refusal)

Documentation should include:

• The date consent was given

• The specific AI tool disclosed

• The patient's questions and your responses

• The patient's decision (including refusal or revocation)

• The fallback documentation method if consent is refused

Step 5: Establish an Opt-Out Workflow

Patients who decline AI-assisted documentation must still receive services. Have a clear alternative:

• Use a non-AI documentation method (manual notes, typed summary)

• Offer a short spoken or typed summary into the system after the visit without recording the patient

• Document the refusal and the alternative method used

Step 6: Review AI Outputs

Professional guidance consistently emphasizes that AI-generated clinical content must be reviewed and approved by a licensed clinician . Your consent language should reflect this, and your workflow must ensure it happens.

Documentation and Audit Protection

What to Document

For each patient using AI-assisted documentation:

1. Consent record: Signed and dated consent form specific to the AI tool used

2. Disclosure conversation: Note in the chart that the AI use was discussed and questions were answered

3. Tool identification: Name the specific AI tool (e.g., "SimplePractice AI Note Taker" or "Upheal")

4. Review attestation: Document that AI-generated content was reviewed and edited

5. Opt-out record: If the patient declined, document the refusal and the alternative method used

Labelling AI-Assisted Records

Guidance recommends that AI-assisted documents be labelled in the record . This ensures transparency for any subsequent reviewer—including auditors, supervisors, or the patient themselves if they request records.

The Audit Trail

In the event of a licensing board inquiry or malpractice claim, the consent record demonstrates that you:

• Disclosed AI use

• Obtained written consent

• Offered an opt-out

• Maintained professional oversight

Without this documentation, you cannot demonstrate compliance with the new legal requirements.

Special Considerations

When Patients Use AI Independently

APA's 2026 survey found that 77% of psychologists say their patients report using AI. Many patients use AI chatbots and wellness apps between sessions without disclosing this. APA recommends proactively asking patients about their AI use and creating room to explore what they are finding, including normalizing AI use, exploring how it has been helpful or unhelpful, and discussing safety concerns .

High-Risk Populations

Patients with psychosis, severe dissociation, or acute suicidality may be at heightened risk from AI interactions. The Frontiers facts label framework notes that individuals seeking mental health support may be "especially susceptible to potential AI harms, such as misinformation, algorithmic bias, or data insecurity" . Consent discussions should address these vulnerabilities explicitly.

Minors and Dependent Adults

For patients under 18 or with impaired decision-making capacity, consent must be obtained from the parent, guardian, or legally authorized representative, in addition to any assent from the patient .

Telehealth and Multi-State Practice

If you practice across state lines, you must comply with the laws of the state where the patient is located. A patient in Colorado and a patient in Rhode Island may require different consent processes. Know the requirements for every jurisdiction in which you practice.

Conclusion

Informed consent for AI in therapy in 2026 is not optional. It is a legal requirement, an ethical obligation, and a clinical necessity. The laws are new, the guidance is evolving, and the risks of non-compliance—licensing board discipline, malpractice liability, consumer protection enforcement—are real.

The therapists who thrive in this environment are those who:

• Know the laws in their jurisdiction

• Understand the ethical requirements of their professional bodies

• Obtain written, tool-specific, revocable consent

• Obtain separate consent for any use of patient data to train AI models

• Document the disclosure conversation, not just the signature

• Have a clear opt-out workflow

• Review every AI output before it enters the record

This is not bureaucratic excess. It is the foundation of trust in an era where the therapy room is no longer a purely human space.

FAQ

Is verbal consent sufficient for AI use in therapy?

No. Multiple state laws now require written informed consent before AI recording or transcription of therapeutic sessions. Colorado HB 1195, Rhode Island S2197, and other state laws explicitly require written, documented consent. Professional ethics guidance increasingly recommends written documentation.

Do I need separate consent for AI-assisted documentation and for using patient data to train AI models?

Yes. Emerging guidance recommends separate and explicit opt-in consent for using patient data to train AI models. Consent for AI-assisted documentation and consent for data training should not be bundled. A 2026 npj Digital Medicine article argues that contractual assent through terms of service is not informed consent .

What if my patient refuses AI consent?

Patients have the right to refuse or revoke consent without being denied psychotherapy services. You must have an alternative documentation workflow—such as manual notes or a non-recorded summary method—for patients who opt out .

Which states have laws requiring AI consent in therapy?

As of 2026, states with active legislation include Colorado (HB 1195), Rhode Island (S2197), Illinois (WOPR Act), Nevada (AB 406), Tennessee (SB 1580), Maine, Vermont, and Utah. Additional states including California, New York, and Texas have pending or partial legislation .

What documentation is required to demonstrate compliance with AI consent laws?

Documentation should include: the signed and dated consent form specific to the AI tool used; a note that the disclosure conversation occurred; the specific tool name; the patient's decision (including refusal or revocation); the alternative documentation method if consent was refused; and evidence that AI-generated content was reviewed and edited by the clinician.

How often should I update my AI consent forms?

Review your AI consent forms at least annually and whenever you implement new AI tools, change vendors, or when new state laws take effect. The 2026 legislative wave is likely to expand in 2027. Stay current with your state licensing board and professional association guidance.

Does a signed BAA with my AI vendor satisfy the consent requirement?

No. A Business Associate Agreement addresses the vendor's obligations regarding protected health information. It does not replace the patient's right to informed consent about AI use. You need both a compliant BAA that prohibits model training on your data and documented patient consent .

References

1. https://leg.colorado.gov/bills/hb26-1195

2. https://webserver.rilegislature.gov/BillText26/SenateText26/S2197A.pdf

3. https://www.gtlaw.com/en/insights/2026/6/behavioral-health-law-ledger-june-2026

4. https://www.apa.org/topics/artificial-intelligence-machine-learning/ethical-guidance-ai-professional-practice

5. https://www.apa.org/topics/artificial-intelligence-machine-learning/ethical-guidance-professional-practice.pdf

6. https://www.simplepractice.com/blog/ai-ethics-mental-health-practice/

7. https://www.simplepractice.com/resource/inform-clients-using-ai-notes/

8. https://www.nature.com/articles/s41746-026-02843-8

9. https://www.frontiersin.org/journals/psychiatry/articles/10.3389/fpsyt.2026.1887887/full

10. https://novopsych.com/novonote-security/ai-policy-for-clinics-usa/

11. https://ensorahealth.com/blog/informed-consent-ai-usage-clinical-settings/

12. https://noustalk.com/blog/how-to-tell-clients-you-use-ai-for-notes