State AI-in-healthcare laws in 2026: disclosure, chatbot and AI-therapy rules app builders must follow

As of October 2026, there is no single US law on AI in healthcare, but several states already impose concrete rules on the apps you build: Texas and California require patients to be told when AI is involved in their care or messages, California bars AI from implying it is a licensed clinician, and Illinois, Nevada and Utah restrict or regulate AI that acts like a therapist. Colorado’s broad AI Act never took effect; it was replaced in May 2026 by a narrower law that starts on 1 January 2027. Below: each law with its primary source, then the features to build for chatbots, AI scribes and patient messaging.

1. The Laws at a Glance, With Sources

These are the laws we verified against statute text or legislature records as of 12 October 2026. It is not a complete list; see section 6 for other 2026 laws.

This guide summarises statutes for product teams. It is not legal advice; check the current text with counsel before you launch.

2. Texas: TRAIGA and SB 1188

TRAIGA (HB 149): tell patients before care starts

The Texas Responsible Artificial Intelligence Governance Act took effect on 1 January 2026. Subsection 552.051(f) reaches private healthcare directly: if an AI system is used “in relation to health care service or treatment,” the provider must tell the patient or their personal representative “not later than the date the service or treatment is first provided,” or, in an emergency, as soon as reasonably possible. The disclosure must be clear, conspicuous and in plain language, with no dark patterns (a hyperlink to a separate page is allowed). The Attorney General enforces it after a 60-day cure period, with civil penalties of $10,000 to $12,000 per curable violation and $80,000 to $200,000 per uncurable one.

SB 1188: review AI-created records and disclose diagnostic AI

SB 1188 took effect on 1 September 2025. Section 183.005 lets a practitioner use AI for diagnostic purposes, including recommendations on diagnosis or treatment, only if they act within the scope of their licence, the use is not otherwise prohibited, and they review all records created with AI in line with Texas Medical Board standards. A practitioner who uses AI this way “must disclose the practitioner’s use of that technology” to patients.

The same bill requires electronic health records containing patient information to be kept physically in the US or its territories, including records held by cloud providers, from 1 January 2026. Your hosting region, backups and any AI vendor that stores records all need to be in the US.

3. California: AB 3030, AB 489 and SB 243

AB 3030: disclaimers on AI-written patient messages

Since 1 January 2025, Health and Safety Code section 1339.75 has required health facilities, clinics, physician offices and group practices that use generative AI to create patient communications about clinical information to include two things: a disclaimer that the message was generated by AI, and clear instructions for reaching a human provider or other appropriate person. Where the disclaimer goes depends on the medium:

• Letters and emails: prominently at the beginning of each communication.
• Chat and other continuous online interactions, including video: displayed prominently throughout the interaction.
• Audio: spoken at the start and at the end.

It does not cover administrative messages such as appointment scheduling or billing, or messages a licensed or certified provider reads and reviews before they are sent. Physicians who don’t comply answer to the Medical Board of California or the Osteopathic Medical Board; facilities face their licensing regulators.

AB 489: AI must not look like a licensed clinician

AB 489 was chaptered on 11 October 2025 and took effect on 1 January 2026. It makes California’s bans on misusing professional titles enforceable against anyone who develops or deploys AI: an AI system may not use, in its advertising or functionality, any term, letter or phrase that indicates or implies its care, advice, reports or assessments come from a licensed person. Each use is a separate violation, enforced by the relevant licensing board (see the Senate Judiciary analysis). That rules out a chatbot called “Dr. Ava,” an “RN” badge on an AI triage assistant, and AI reports signed as if a clinician wrote them.

SB 243: companion chatbots

SB 243, also effective 1 January 2026, covers “companion chatbots” built to sustain a relationship with the user. It requires AI disclosure, a suicide and self-harm protocol, safeguards for minors and, from July 2027, annual reports to the Office of Suicide Prevention, and gives harmed users a private right of action. A narrow intake bot is unlikely to qualify; a wellness “coach” that remembers the user and checks in on their mood may.

4. AI Therapy: Illinois, Nevada and Utah

Three states took three different approaches to AI that behaves like a therapist. If your app touches mental health, this is where the strictest rules are.

Illinois: a ban on AI therapy

The Wellness and Oversight for Psychological Resources Act (HB 1806, Public Act 104-0054) was signed on 1 August 2025 and took effect immediately. According to the Illinois Department of Financial and Professional Regulation, which enforces it, the Act bars using AI to provide therapy or make therapeutic decisions, while letting licensed professionals use AI for administrative and supplementary support. That support may not include independent therapeutic decisions, therapeutic communication with clients, unreviewed treatment plans, or detecting emotions or mental states. Recording or transcribing a session with AI requires the client’s informed consent. Fines reach $10,000 per violation. Religious counselling, peer support and self-help materials that don’t claim to offer therapy are excluded.

Nevada: no AI presented as a mental health provider

Nevada’s AB 406 took effect on 1 July 2025. It prohibits offering an AI system programmed to provide what would be professional mental or behavioural health care if a human provided it, and prohibits saying, or programming the system to say, that it can provide that care or that it is a therapist, counsellor or similar provider. Licensed providers may use AI only for administrative tasks such as scheduling and billing, and schools may not use it in place of counsellors or psychologists.

Utah: rules for mental health chatbots, not a ban

Utah allows mental health chatbots but regulates them. HB 452 (Utah Code 13-72a), effective 7 May 2025, covers generative-AI chatbots presented as able to provide mental health therapy; scripted tools like guided meditations are excluded. A covered chatbot must disclose that it is AI and not human before first use, after seven days of inactivity and whenever asked; must not sell or share a user’s health information or input except in narrow cases; and must label in-chat advertising and not target ads on what users say. Fines reach $2,500 per violation, and suppliers that file and follow a written safety policy get an affirmative defence against unlicensed-practice claims. Separately, Utah’s AI disclosure statute, as amended in 2025 by SB 226, requires people in licensed occupations to disclose prominently when they use generative AI in a “high-risk” interaction, which includes collecting health information.

5. Colorado: From the AI Act to SB 26-189

Colorado’s AI Act (SB 24-205), delayed from 1 February to 30 June 2026, was repealed and replaced before it ever applied. SB 26-189, signed on 14 May 2026, regulates “automated decision-making technology” (ADMT) used in consequential decisions, which include decisions about access to or eligibility for health-care services.

Deployers must give clear notice at the point of interaction and, after an adverse outcome, explain the system’s role within 30 days; consumers can correct their data and request meaningful human review. Developers owe deployers technical documentation from 1 January 2027. The Attorney General enforces it, with a 60-day cure period until 2030 and no new private right of action. A symptom checker is unlikely to be caught; software that helps decide whether a patient qualifies for a programme or level of care might be.

6. The 2026 Wave of Chatbot Laws

2026 was the busiest year yet for state chatbot laws. The one we reviewed in full is Washington’s HB 2225, signed on 24 March 2026 and effective 1 January 2027. It covers AI companion chatbots (not customer-service bots that don’t sustain a relationship). Operators must disclose that the chatbot is AI at the start and at least every three hours (hourly for known minors), stop it from claiming to be human, and run a published protocol that detects suicidal ideation, self-harm and eating disorders and refers users to crisis resources.

Law-firm trackers report many more 2026 enactments, including limits on AI use by mental health professionals in Maine, bans on presenting AI as a licensed professional in Tennessee and Delaware, and chatbot safety laws in Oregon, Idaho and Nebraska (see Holland & Knight’s May 2026 review). We have not checked those against enrolled text, so treat them as leads to verify. Many 2026 laws also target insurers’ use of AI in prior authorisation.

7. Implementation for Chatbots, Scribes and Patient Messaging

The requirements overlap, so build the strictest version once and switch it on by state.

Intake and triage chatbots: start with the disclosure component, neutral identity and “are you human?” rule, and keep the bot to collecting and routing information. Once it suggests diagnoses to patients, you also have an FDA question (see our FDA compliance overview). Our patient intake chatbot guide covers the HIPAA side.

AI medical scribes: notes drafted for a clinician aren’t patient communications, so AB 3030 usually doesn’t apply. Texas SB 1188 can: if the scribe proposes diagnoses or treatment, the practitioner must review the record and tell the patient AI is used. Build a sign-off step and a patient notice into the visit flow. See our AI medical scribe guide.

AI-drafted patient messages: in California the cleanest route is the review exemption, where a licensed provider approves each draft before it is sent. Unreviewed AI messages about clinical information each need the disclaimer and human-contact block. Keep drafts and approvals as evidence.

8. Where VertiComply Fits

VertiComply generates full-stack healthcare apps (web, plus native iOS and Android) with HIPAA safeguards on every plan: encryption, audit logging, role-based access control and session timeouts. Those give you the audit log for disclosures and sign-offs, and roles that separate who drafts from who approves; the disclosure wording and state logic are yours to decide with counsel. On paid plans (Pro $89/month, Business $249/month, Enterprise $349/month) we sign a business associate agreement on request; the Free plan has no BAA. VertiComply does not hold a SOC 2 or HITRUST attestation. See pricing for details.

Selling in Europe too? See our EU AI Act healthcare guide.

9. Frequently Asked Questions

Which states require disclosure when AI is used in healthcare?

As of October 2026, Texas requires providers to disclose AI used in health care service or treatment (HB 149, from 1 January 2026) and practitioners to disclose diagnostic AI (SB 1188). California requires a disclaimer on unreviewed generative-AI patient communications about clinical information (AB 3030). Utah requires disclosure for mental health chatbots.

Is AI therapy banned in any US state?

Yes. Illinois bans AI-delivered therapy under the Wellness and Oversight for Psychological Resources Act (HB 1806), in effect since 1 August 2025, and Nevada’s AB 406 prohibits offering AI as a provider of professional mental or behavioural health care. Utah does not ban mental health chatbots but regulates them, with disclosure, data-sharing and advertising rules.

Does California AB 3030 apply to AI scribes?

Usually not. AB 3030 covers generative-AI communications to patients about clinical information. A scribe that drafts notes for a clinician to review is not a patient communication. If AI-generated text is sent to a patient without a licensed provider reading and reviewing it first, AB 3030 applies and the message needs the disclaimer and instructions for reaching a human.

Can my chatbot be called “Dr.” or “Nurse” something?

Not in California, and it is risky everywhere. Since 1 January 2026, AB 489 bars AI systems from using terms, letters or phrases in their advertising or functionality that imply the care or advice comes from a licensed professional, and each use is a separate violation. Nevada bans describing AI as a therapist or counsellor. Use a neutral name and label the assistant as AI.

Is the Colorado AI Act in effect?

No. SB 24-205 was delayed to 30 June 2026 and then repealed and replaced by SB 26-189, signed on 14 May 2026. The replacement law regulates automated decision-making technology used in consequential decisions, including health-care services, and its main obligations start on 1 January 2027.

Do these state laws apply if my app is HIPAA compliant?

Yes. HIPAA governs how protected health information is used and secured; these laws govern how AI is presented and what it may do. You need both.

Last reviewed 12 October 2026. State AI laws are changing quickly; check each statute’s current text and effective date before relying on this summary. Nothing here is legal advice.