Colorado’s New AI Law for Therapists:
What Mental Health Practices
Need to Change Now
Artificial intelligence has already made its way into many therapy practices. Sometimes it is obvious, such as an AI scribe recording a session and creating a draft note. Sometimes it is already built into scheduling systems, billing platforms, EHRs, intake tools, or programs that organize information and suggest language.
Colorado has now drawn a much clearer line around how those tools may be used in psychotherapy.
Colorado House Bill 26-1195, which took effect August 12, 2026, does not ban therapists from using AI. It allows AI to support administrative and certain supplementary tasks, including preparing records and therapy notes. It also requires the clinician to remain responsible for reviewing AI-generated work and limits AI from functioning as the therapist.
The law creates several immediate requirements for Colorado mental health professionals. Practices must provide clients with written information about restrictions on AI in psychotherapy during the initial client contact. Therapists who use AI to record or transcribe sessions must provide a specific written disclosure and obtain revocable written consent before the initial use. AI may not independently engage clients in therapeutic communication, and AI-generated therapeutic recommendations or treatment plans require clinician review and approval.
For many practices, complying with the law will involve more than adding one sentence to an existing consent form. The requirements touch intake, informed consent, technology review, clinical documentation, staff training, and the way AI-generated information moves through the practice.
Does Colorado’s New Law Ban Therapists From Using AI?
No. Colorado’s law permits mental health professionals to use AI for administrative support and supplementary support while keeping the clinician responsible for the work produced.
The law defines administrative support as work that assists with delivering psychotherapy but does not involve therapeutic communication. Examples include managing appointments and reminders, processing billing and insurance claims, and drafting logistical communications that do not contain therapeutic advice.
Supplementary support moves closer to the clinical workflow without allowing AI to replace clinical judgment. The law specifically includes preparing and maintaining client records, including therapy notes; organizing referrals and resources; collecting structured information such as intake responses, mood ratings, symptom frequency, sleep, activity, and medication adherence; and analyzing data to identify progress or trends when the clinician reviews the results.
This distinction matters because many therapists are not trying to turn treatment over to a chatbot. They are trying to reduce the time spent writing notes, organize information more efficiently, or make routine administrative work more manageable. Those uses are not automatically prohibited.
They are also not automatically compliant simply because they fall into an allowed category. The clinician remains responsible for reviewing the output, and the AI use must comply with HIPAA and other applicable state and federal privacy and security laws. An AI-generated note that is never reviewed, a vendor that does not appropriately safeguard protected health information, or a workflow that sends client information somewhere the practice has not evaluated can still create serious compliance problems.
AI may assist with the work. It does not inherit the therapist’s professional responsibility for it.
What Must Colorado Therapists Give Clients During Initial Contact?
Colorado therapists must provide clients with written information during the initial client contact explaining the law’s prohibitions on using AI in psychotherapy.
This is broader than the separate consent requirement for recording or transcribing sessions. The signed law places the initial-contact requirement within the restrictions governing AI that provides, directs, or guides psychotherapy, clinical intervention, counseling, diagnosis, treatment planning, or other activities that constitute psychotherapy.
In practical terms, Colorado practices need a written client-facing notice that explains the boundaries around AI in psychotherapy. That notice should not suggest that AI will never be used if the practice uses it for permitted administrative or supplementary support. It should explain that AI will not independently provide psychotherapy, engage in unsupervised therapeutic communication, or create therapeutic recommendations or treatment plans without clinician review and approval.
Because the law says this information must be provided during initial client contact, practices should look at the beginning of the client relationship rather than assuming it can wait until the first therapy session. Depending on the practice’s workflow, initial contact might occur through an inquiry form, consultation process, intake portal, scheduling communication, or another early step.
The requirement should be built into a consistent process. In a group practice, it should not depend on each clinician remembering to explain it differently.
When Is Written Consent Required for an AI Scribe or Transcription Tool?
Before an AI system records or transcribes a therapeutic session, the client or the client’s legally authorized representative must be informed in advance, in writing, that AI will be used and the specific purpose for which it will be used. The client must also provide written consent.
Colorado defines this consent more narrowly than a general technology acknowledgment. It must be clear, explicit, affirmative, specific, unambiguous, written, and revocable. Electronic consent is allowed. Consent cannot be buried inside broad terms of use that combine AI language with unrelated information, and it cannot be obtained through deception or passive interaction with digital content.
The client must have a real choice. A practice cannot deny psychotherapy because the client refuses to consent or later revokes consent.
The law does not require the practice to obtain a new signature before every session. Consent is required before the initial use of the AI system on or after August 12, 2026. New consent is needed if the purpose or manner of use materially changes.
That last part is easy to overlook. A practice may begin by using a tool only to create a transcript and later enable session summaries, treatment suggestions, progress analysis, or other features. The vendor may also change how the system functions or where information is processed. A signed consent form should not become permission to expand the workflow indefinitely without another review.
Practices need a way to recognize when the purpose or manner of AI use has changed and determine whether the client must receive new information and provide new consent.
Can AI Communicate Directly With Therapy Clients in Colorado?
The law does not allow an AI system to engage in therapeutic communication with a client unless the therapist, AI system, and client are participating synchronously in real time.
Colorado defines therapeutic communication broadly. It includes interactions intended to understand or reflect a client’s thoughts, emotions, or experiences; provide therapeutic strategies or interventions; offer emotional support or reassurance in response to distress; collaborate on treatment goals; or provide behavioral feedback intended to address a mental or behavioral health condition.
Reviewing the interaction later does not count as synchronous participation.
This distinction has practical consequences for client-facing chatbots, automated between-session messages, AI-generated responses to journal entries, and tools that respond to symptoms or distress. A feature may look like homework support or a convenient check-in while crossing into therapeutic communication through the way it responds to the client.
The label attached to the feature is less important than what the tool actually does. Calling something wellness support does not make it nontherapeutic if it is responding to a particular person’s distress with individualized guidance intended to affect a mental health condition.
Colorado does include an exception for certain self-help, homework, navigation, coaching, meditation, journaling, psychoeducation, goal-setting, progress-tracking, session-preparation, session-summary, mood-monitoring, mindfulness, breathing, crisis-resource, safety-planning, and similar wellness tools. To fall within that exception, the technology cannot diagnose or treat mental health disorders and must clearly disclose that it is not a substitute for clinical care.
Therapists recommending these tools still need to evaluate what the technology actually does, what information it collects, how client information is handled, and whether its real-world use matches its description.
Can AI Generate Treatment Plans or Clinical Recommendations?
AI may generate therapeutic recommendations or treatment plans only when the regulated professional reviews and approves them.
That is more than glancing at a generated document before placing it in the record. The clinician is responsible for determining whether the content is accurate, clinically appropriate, individualized, consistent with the client’s actual presentation, and supported by the information available.
AI systems can produce polished clinical language that appears complete even when the underlying content is generic, unsupported, or wrong. A treatment plan can look more sophisticated after AI rewrites it while becoming less connected to the client. Group practices also need to consider whether clinicians are editing AI-generated content consistently or beginning to rely on the tool as the default clinical decision-maker.
The law keeps responsibility where it belongs. The therapist may use AI to assist with the work, but the therapist must make and approve the clinical judgment.
Colorado’s law draws a line between AI assisting the therapist and AI acting as the therapist. AI may support administrative work, documentation, structured tracking, and other limited tasks. It may not independently engage clients in therapeutic communication or make unreviewed treatment recommendations. The question is not simply whether AI is being used. It is what role the practice is allowing AI to perform.
Does HIPAA Compliance Make an AI Tool Compliant With Colorado Law?
No. HIPAA compliance and compliance with Colorado’s AI requirements overlap, but they are not interchangeable.
An AI vendor might offer a business associate agreement and still lack the workflow features a Colorado therapist needs. The system may not support specific, revocable client consent. It may introduce new uses without making those changes clear. It may generate clinical recommendations without an obvious review step. It may retain recordings, transcripts, prompts, or generated content in places the therapist does not see during ordinary use.
The new law expressly requires AI use to comply with applicable privacy and security laws, including HIPAA. That makes the privacy review essential, but it does not replace the clinical and consent requirements in HB 26-1195.
For an AI scribe, the practice needs to understand more than whether the vendor will sign a BAA. The practice should know whether audio is recorded, whether a transcript is created, how long each is retained, what enters the designated record set, whether information is used to train or improve the system, who can access it, how outputs are reviewed, and what happens when a client revokes consent.
Generating the note may be the most visible part of the process. The less obvious compliance work is tracking what happens to the information before and after that note appears.
What Should Colorado Solo Practices Update Now?
A solo practice may have fewer people involved, but the workflow still needs to be documented and repeatable. The therapist should be able to explain which AI tools are used, what each tool does, what client information enters the system, what disclosures and consent apply, how outputs are reviewed, and how the practice responds when a client declines or revokes consent.
At minimum, a Colorado solo practice should review:
-
its initial-contact materials and intake workflow;
-
its AI recording or transcription disclosure and consent;
-
the process for documenting, honoring, and revoking consent;
-
every AI feature used for notes, summaries, treatment planning, recommendations, messaging, or client support;
-
vendor privacy, security, retention, and data-use terms;
-
the method used to review and approve AI-generated clinical content; and
-
the availability of a non-AI alternative for clients who do not consent.
The goal is not to create paperwork for the sake of paperwork. It is to make sure the practice’s actual use of AI matches what clients are told, what the clinician intends, and what the law permits.
What Should Colorado Group Practices Update Now?
Group practices have an additional consistency problem. One clinician may use the approved AI scribe exactly as intended. Another may enable an optional feature, paste information into a separate tool, use AI to draft client messages, or assume the vendor’s consent language covers the practice.
Compliance cannot depend on everyone making their own interpretation.
The group needs to identify approved and prohibited AI uses, determine who may authorize a new tool or feature, standardize the client notice and consent process, train the workforce, and document how supervisors or leadership will monitor implementation. Policies should also address what happens when a clinician uses an unapproved tool or when an approved vendor changes its functions.
The practice should be able to trace the workflow from initial client contact through consent, AI use, clinician review, documentation, storage, and eventual deletion or retention. That is where written policy and day-to-day operations either match or begin drifting apart.
How Do Colorado’s Other New AI Laws Affect Mental Health Practices?
Two related Colorado laws help show where the state is drawing responsibility across the larger AI environment, although neither creates the same immediate intake obligations for ordinary therapy practices.
Colorado House Bill 26-1139 takes effect January 1, 2027, and focuses primarily on insurers and other entities using AI for utilization review. A medical-necessity denial cannot be issued solely from AI output without review by a qualified human professional. The law also prohibits certain payers from paying for psychotherapy delivered directly by AI while preserving human-delivered services supported by billing systems, EHRs, videoconferencing, messaging platforms, and other nontherapeutic tools.
For therapists, this provides an important distinction between AI assisting a human provider and AI functioning as the provider. It may also become relevant when challenging coverage decisions influenced by automated review.
Colorado House Bill 26-1263 regulates operators of publicly available conversational AI services. Beginning January 1, 2027, covered operators will face requirements involving AI disclosure, minors, suicide and self-harm protocols, and representations that AI output is equivalent to services from licensed professionals.
Most practices merely using a third-party tool will not become the operator of a conversational AI service. A practice that develops, brands, embeds, or offers a public-facing chatbot may need a closer legal review. Even when the law applies directly to the vendor, its requirements offer useful questions for practices evaluating client-facing tools: Does the system identify itself as AI? What happens when a user expresses suicidal ideation? Does it make claims that sound like therapy? Does it imply that client information receives protections comparable to therapist-client confidentiality?
Stay Updated on Compliance Changes
Compliance expectations are constantly evolving, and most providers don’t hear about changes until they become a problem.
If you want clear, practical updates you can actually use, you can join my email list below.
What Do Colorado Therapists Need to Do First?
The first priority is identifying every place AI is already present in the practice. That includes tools intentionally purchased as AI products and AI features added to systems the practice already uses.
Next, practices should update the written information provided during initial client contact and create or revise the specific disclosure and consent used before AI records or transcribes a session. Existing clients whose sessions will be recorded or transcribed by AI on or after the law’s effective date also need the required disclosure and consent before that use.
Practices should then compare their actual workflows with the law’s boundaries. Administrative and supplementary support remain available, but clinical responsibility stays with the therapist. Direct therapeutic communication cannot be handed to AI for later review. Treatment plans and therapeutic recommendations require human review and approval. Clients who decline recording or transcription must still be able to receive psychotherapy.
Colorado’s law does not require therapists to stop using technology. It requires practices to become much clearer about where technology is assisting, where it is influencing clinical care, and where the therapist must remain actively in control.
That is a useful distinction well beyond Colorado. AI can make parts of practice easier, but ease of use does not answer the compliance question. The real question is what the tool is doing inside the workflow and whether the practice can account for it.
Guardian Clinical Essentials Resources
Guardian Clinical Essentials is reviewing its Colorado-specific compliance resources and AI materials to incorporate the requirements of HB 26-1195 and the related Colorado AI laws.
If you are evaluating an AI tool for your practice, visit Guardian Clinical Essentials for practical HIPAA, AI, privacy, and compliance resources designed specifically for mental health professionals.
This article is provided for educational and informational purposes and does not constitute legal advice. Laws, regulations, licensing requirements, and professional obligations may change. Mental health professionals should review the requirements applicable to their practice and consult qualified legal counsel when needed.
Frequently Asked Questions About Colorado’s AI Law for Therapists
Does Colorado HB 26-1195 apply to both solo and group practices?
Yes.
The law applies to individuals licensed, registered, certified, or otherwise lawfully permitted to provide psychotherapy services in Colorado. A therapist’s obligations do not change because they work independently or within a group practice. Group practices also need consistent procedures for disclosures, consent, approved AI tools, clinical review, and staff training.
Do Colorado therapists need client consent for every use of AI?
No.
HB 26-1195 specifically requires written consent when an AI system will record or transcribe a therapeutic session. The law allows AI to assist with certain administrative and supplementary tasks, but the therapist remains responsible for reviewing the output and complying with HIPAA and other applicable privacy and security requirements.
Other laws, professional obligations, contracts, or practice policies may create additional disclosure or consent requirements depending on how a tool is used.
Can a client refuse or revoke consent for an AI scribe?
Yes.
Consent must be clear, specific, written, affirmative, unambiguous, and revocable. A therapist cannot deny psychotherapy services because a client refuses to allow AI recording or transcription or later revokes consent.
Practices using AI scribes should have a non-AI documentation option available for clients who do not consent.
Is new consent required before every therapy session?
No.
The law requires consent before the initial use of the AI recording or transcription system on or after August 12, 2026. Consent does not have to be obtained before every subsequent session unless the purpose or manner of using the AI system materially changes.
A new feature, different use of the transcript, expanded data analysis, or significant change in how information is processed may require the practice to reevaluate the disclosure and obtain new consent.
Can AI create therapy notes or treatment plans under Colorado law?
AI may assist with preparing and maintaining therapy notes, but the therapist must review the output and remains responsible for the final record.
AI may also generate therapeutic recommendations or treatment plans, but those recommendations or plans cannot be used without review and approval by the therapist. AI can assist with the work. It cannot assume the clinician’s professional judgment or responsibility.
Must therapists provide the initial-contact AI notice if they do not use an AI scribe?
Yes.
The initial-contact requirement is separate from the consent required for AI recording or transcription.
During initial client contact, Colorado therapists must provide written information about the law’s restrictions on using AI in psychotherapy. The notice should explain that AI will not independently provide psychotherapy, engage in unsupervised therapeutic communication, or create therapeutic recommendations or treatment plans without clinician review and approval.
Related Articles in This AI + HIPAA Series
Therapists exploring AI documentation often have additional questions that extend beyond progress notes alone.
Related topics include:
- AI + HIPAA: Resources Hub & Next Steps
- Is AI HIPAA Compliant for Therapists?
- Can Therapists Use ChatGPT for Progress Notes?
- Does a Business Associate Agreement Make AI HIPAA Compliant?
- What AI Risks Belong in a HIPAA Security Risk Analysis?
- Can Therapists Paste Client Information Into AI Tools?
- What Should an AI Policy Include for a Therapy Practice?
- Can Group Practices Allow Staff to Use AI Documentation Tools?
- Are AI Therapy Note Tools Safer Than Recording Sessions?
- What Happens to Client Information After AI Processes It?
- Do You Need Client Consent to Use AI?
- Building AI for Therapy Practices: Behind the Scenes with Uriah Guilford
Other Compliance Articles Coming Soon…
- Can Therapists Use AI for Treatment Plans?
- How Should Therapists Document AI Use in Practice?
About the Author
Samantha Schalk, LMSW-C, LMSW-M, CAADC, CIMHP, BCP3
Samantha is a licensed mental health professional, private and group practice owner, and the founder of Guardian Clinical Essentials™.
She helps therapists and group practices understand how compliance, documentation, privacy, technology, and practice operations work together in real-world clinical settings. Her work focuses on turning complex requirements into practical systems, policies, workflows, and implementation strategies that providers can actually use.
Drawing from experience in both clinical practice and compliance consulting, Samantha specializes in helping mental health professionals build defensible, sustainable systems that support both quality care and regulatory compliance.
Learn more about Samantha and Guardian Clinical Essentials™.
Continue Exploring Guardian Clinical Essentials™
Looking for additional compliance, privacy, AI, documentation, and practice operations resources?
Explore the Guardian Clinical Essentials™ Resource Library for educational articles, implementation guidance, training opportunities, and practical resources designed specifically for mental health professionals.