A plain-English reference to the enacted and pending laws governing AI use in healthcare — what each one does, when it takes effect, and who enforces it. Because of telehealth, the law that applies to an encounter is generally the law of the state where the patient is physically located.
Facts on this page are maintained against primary sources, reviewed on a recurring schedule, and were last reviewed on September 22, 2026.
Nondiscrimination in health programs/activities receiving federal financial assistance. The § 92.210(b)-(c) duty to make reasonable efforts to identify and mitigate discrimination risk from patient-care decision-support tools (including AI) took effect May 1, 2025.
Current posture: The rule is on the books and legally operative (45 CFR § 92.210, unamended). The October 2025 partial vacatur in Tennessee v. Kennedy (HHS notice, June 2, 2026) reached only the gender-identity provisions and did not touch § 92.210. No public OCR enforcement action under § 92.210(b)-(c) has been identified; absence of a reported action is not repeal: the general § 1557 nondiscrimination duty and its private right of action remain, and parallel state-law duties (CA, CO, IL) are unaffected.
Not AI-specific, but governs all PHI processed by AI tools. A Business Associate Agreement is required before any vendor (including an AI vendor) processes PHI; the Security Rule risk analysis must cover AI systems.
Enforcement: HHS OCR; civil and criminal penalties.
Revised final rule effective April 16, 2024; full compliance was required by Feb. 16, 2026. HHS OCR announced its Part 2 Civil Enforcement Program Feb. 13, 2026 and accepts complaints from Feb. 16, 2026 (enforcement aligned to HIPAA). Where an AI vendor processes Part 2 records, a QSOA and the required consents apply.
Enforcement: HHS/SAMHSA; aligned to HIPAA enforcement.
Diagnostic/therapeutic AI can be a regulated device. 1,500+ AI-enabled devices have been authorized; PCCP (predetermined change control plan) guidance governs post-clearance model updates.
Enforcement: FDA.
The 2026 National Health Care Fraud Takedown (announced June 2026) charged 455 defendants in connection with over $6.5B in alleged fraud. DOJ and CMS now use near-real-time data analytics to identify suspect billing and intercept payments.
Enforcement: DOJ, HHS-OIG, CMS, state Medicaid Fraud Control Units.
Standardized AI exclusion endorsements (ISO CG 40 47 broad; CG 40 48 Coverage B) entered the market for 2026 policy renewals; carrier filings are reported but adoption is not publicly confirmed and varies by carrier. The ISO forms are general liability forms; carriers in other lines (W.R. Berkley, Hamilton Select, Philadelphia Indemnity) have filed their own; no medical professional liability carrier adoption was found (checked 2026-09-26).
TRAIGA (HB 149) (in force since January 1, 2026): Texas Responsible Artificial Intelligence Governance Act. Providers using AI in care/treatment must disclose it to patients; prohibited manipulative/discriminatory uses. Enforcement: Texas Attorney General only; tiered civil penalties up to $200,000 per uncurable violation.
SB 1188 (in force since September 1, 2025): AI used in a diagnostic capacity must be disclosed; TMB licensure context; health-records data-location provisions. Enforcement: Texas Attorney General may sue for civil penalties under Health & Safety Code § 183.011: up to $5,000 per negligent violation, $25,000 per knowing or intentional violation, and $250,000 per violation where protected health information was knowingly or intentionally used for financial gain; Texas Medical Board licensure context.
AB 3030 (in force since January 1, 2025): Health facilities/clinics/physician offices using generative AI for patient clinical communications must include a disclaimer that the message was AI-generated and instructions to contact a human provider. Exempt when a licensed provider reviews the AI-generated message. Enforcement: Licensing boards / applicable health agencies (e.g., Medical Board, DMHC).
AB 489 (in force since January 1, 2026): Prohibits AI systems/chatbots from implying that care or advice comes from a licensed human — no use of licensed titles, license numbers, or clinical post-nominals by AI. Enforcement: Relevant licensing boards; violations treated as unlicensed-practice/discipline matters.
SB 1120 (Physicians Make Decisions Act) (in force since January 1, 2025): In health-plan utilization review, a licensed physician (not an algorithm alone) must make medical-necessity determinations. Enforcement: DMHC / CDI.
SB 243 (companion chatbots) (in force since January 1, 2026): Operators of companion-chatbot platforms must disclose non-human status, maintain protocols for responding to suicidal-ideation disclosures with referral to crisis services, and apply minor protections (content limits, break reminders). Annual reporting on companion-chatbot use and suicidal ideation begins July 1, 2027. Enforcement: Private right of action: injunctive relief plus the greater of actual damages or $1,000 per violation, plus attorneys' fees.
SB 503 (clinical decision support: bias) (enacted — takes effect January 1, 2027): Developers of clinical decision support systems must make reasonable efforts to mitigate known or reasonably foreseeable risks of biased impacts and give deployers a statement of intended uses and supporting documentation. A deployer - a health facility, clinic, physician’s office or office of a group practice that uses such a system - must regularly monitor the systems it has identified and take reasonable and proportionate steps to mitigate those risks. Compliance is not a defense to a claim of unlawful discrimination. Enforcement: The act names no enforcing agency, penalty or private right of action.
AB 1979 (licensed judgment retained) (enacted — takes effect January 1, 2027): A health facility, clinic, physician’s office or office of a group practice must take reasonable steps to ensure a licensed health care provider retains the ability to exercise independent professional judgment when care is informed by a clinical decision support system, and may not use AI to direct, guide, supervise or instruct unlicensed personnel in a clinical function the law reserves to a licensed person, or to perform that function itself (supervised trainees excepted). Separately, a business offering a consumer health care chatbot to manage health information or for diagnosis, treatment or management of a condition is treated as a provider of health care under the Confidentiality of Medical Information Act. Enforcement: Medical Board of California or Osteopathic Medical Board for physicians; licensing-board injunction or restraining order (Bus. & Prof. Code sec. 125.5) where the conduct is unlicensed practice; other remedies preserved.
SB 26-189 (AI Act, revised) (enacted — takes effect January 1, 2027): Signed May 14, 2026; repeals and reenacts the Colorado AI Act as an automated-decision technology (ADMT) disclosure-and-rights framework effective Jan 1, 2027. Duties: notify on AI interaction; disclose an adverse ADMT outcome (within 30 days); correct inaccurate personal data; provide meaningful human review. Enforcement: Colorado Attorney General; no private right of action.
HB 26-1195 (psychotherapy AI) (in force since August 12, 2026): Bars regulated mental-health professionals from letting AI conduct therapeutic communication with clients or generate treatment plans without their real-time involvement and review; marketing an AI system as equivalent to licensed psychotherapy is a Colorado Consumer Protection Act violation. Enforcement: Licensing regulators + Colorado Consumer Protection Act.
HB 26-1139 (AI in coverage decisions) (enacted — takes effect January 1, 2027): AI/algorithms may not be the sole basis for coverage denials or delays; a licensed professional must review adverse determinations. Enforcement: Colorado Division of Insurance.
WOPR Act (HB 1806) (in force since August 1, 2025): Bars AI from providing therapy or making independent therapeutic decisions without oversight by a licensed professional. A licensed professional may not let AI make independent therapeutic decisions, communicate therapeutically with clients, generate treatment recommendations or plans without the professional’s review and approval, or detect emotions or mental states.
SB 1580 (Tenn. Code Ann. § 33-1-205) (in force since July 1, 2026): A developer/deployer may not advertise or represent an AI system as, or as able to act as, a qualified mental-health professional.
AB 406 (in force since July 1, 2025): Prohibits representing AI as able to provide mental/behavioral-health care as a professional; restrictions in school settings.
AI Policy Act (SB 149) + HB 452 (in force since May 1, 2024): Consumer-protection-style AI disclosure obligations; HB 452 adds mental-health chatbot rules.
LD 2082 (AI in mental-health services) (in force since July 29, 2026): Licensed mental-health professionals may use AI only for administrative and limited supplementary tasks; barred from using AI for therapeutic communications, treatment decisions, or independent patient interaction. Patient consent is required before using ambient-listening or AI recording tools. Enforcement: Maine professional-licensing framework.
LD 1727 (Chatbot Disclosure Act) (in force since September 24, 2025): Businesses using AI chatbots to communicate with consumers in trade or commerce must disclose that the user is not interacting with a human where a reasonable consumer could be misled. Applies to patient-facing chatbots outside licensed clinical contexts. Private right of action. Enforcement: Maine Unfair Trade Practices Act - AG enforcement and private suits.
Act 156 (H.816) (in force since June 17, 2026): Mental-health services must be delivered by mental-health professionals, not independently by AI systems. AI may be used only where a mental-health professional reviews and approves the services; FDA-authorized software-based products (e.g., digital therapeutics) are permitted when prescribed or recommended by a professional.
H 7349A / S 2197A (R.I. Gen. Laws ch. 40.1-5.5) (in force since June 22, 2026): Therapy or psychotherapy services (including via internet-based AI) may be offered only by licensed professionals. Licensed providers may use AI only for administrative or supplementary support; written, revocable patient consent is required where a session is recorded or transcribed. AI may not make independent therapeutic decisions or determine treatment plans. Exemptions: religious counseling, peer support, public self-help materials, FDA-cleared tools, IRB-approved research. Enforcement: RI Executive Office of Health and Human Services investigates; confidentiality penalties per sec. 5-37.3-9.
S 2570A / H 7538A (AI-documentation notification) (in force since June 22, 2026): Healthcare providers and facilities that use AI to document an in-person or telehealth visit must notify the patient that AI is being used for that sole purpose, and must review the AI-generated documentation for accuracy after the visit. "Healthcare provider" is defined broadly (physicians, physician assistants, dentists, RNs, LPNs, APRNs, nursing assistants, and any other professional licensed by the director of the department of health). Enforcement: No enforcement mechanism is specified in the act.
HB 475 (Act 649, AI-transcription disclosure) (in force since August 1, 2026): Licensed health-care professionals must verbally disclose to the patient, before recording any part of an appointment or treatment, the use of any recording device, software, or service that transcribes using AI (ambient scribes). Final enacted version requires disclosure, not written consent.
§ 934.03 (all-party recording consent) (in force): All-party consent for recording implicates ambient-scribe / AI recording of encounters — patient consent is required. Private right of action.
| Jurisdiction | Measure | Status |
|---|---|---|
| Alabama | SB 63 (AI in prior authorization) | In force since October 1, 2026 — binds health benefit plan providers and their internal or contracted utilization-review entities. |
| Hawaii | SB 3001 (Act 248, AI Disclosure and Safety Act) | In force since July 14, 2026 — binds conversational-AI and companion-chatbot operators. |
| Illinois | HB 3773 (Human Rights Act - AI in employment decisions) | In force since January 1, 2026 — binds employers (a practice is bound as an employer, not as a provider). |
| Iowa | H.F. 2635 (AI in prior authorization) | In force since July 1, 2026 — binds health plans and utilization-review organizations. |
| Maryland | HB 820 (2025) (AI in utilization review; adverse-decision reporting) | In force since October 1, 2025 — binds carriers, pharmacy benefit managers and private review agents. |
| Utah | SB 150 (AI scope-of-practice limit) | In force since May 6, 2026 — binds the Utah professional-licensure review pathway, not a practice duty. |
| Washington | SB 5395 (AI in prior authorization) | In force since June 11, 2026 — binds health plans and utilization-review entities. |
| Colorado | HB 26-1263 (Chatbot Safety Act) | Enacted — takes effect January 1, 2027. |
| Georgia | SB 444 (AI in insurance coverage decisions) | Enacted — takes effect January 1, 2027. |
| New York | RAISE Act (S6953B/A6453B) | Enacted — takes effect January 1, 2027. |
| Oregon | SB 1546 (AI companions) | Enacted — takes effect January 1, 2027. |
| Rhode Island | AI Companion Models Act (S 2195A / H 7350A) | Enacted — takes effect January 1, 2027. |
| Utah | SB 319 (preauthorization AI) | Enacted — takes effect January 1, 2027. |
| Washington | HB 2225 (companion-chatbot disclosure) | Enacted — takes effect January 1, 2027. |
| California | SB 1119 (companion chatbots: children’s safety) | Enacted — takes effect July 1, 2027. |
| Georgia | SB 540 (Conversational Artificial Intelligence Safety Act) | Enacted — takes effect July 1, 2027. |
| Idaho | SB 1297 (Conversational AI Safety Act) | Enacted — takes effect July 1, 2027. |
| Nebraska | LB 525 (Conversational AI Safety Act) | Enacted — takes effect July 1, 2027. |
| Illinois | SB 3114 (Transparency in Downcoding Act) | Enacted — takes effect January 1, 2028. |
| New York | S7263/S7263A (AI chatbot impersonation of licensed professionals) | Pending — recommitted to Senate Rules, June 5, 2026; not law. |
| New York | S9051B (AI companions - protections for minors) | Passed both chambers June 2026; not delivered to the Governor — not law. |
| California | AB 1988 (PAUSE Act — companion chatbots: crisis interruption pauses) | Died at the Aug. 31, 2026 close of session; not law. |
| California | AB 2023 (companion chatbots: children’s safety) | Died at the Aug. 31, 2026 close of session; not law. |
| California | SB 903 (mental health professionals: AI) | Vetoed Sept. 30, 2026; not law. |
| Florida | SB 482 (AI Bill of Rights) | Died in the 2026 session; not law (a refile is being watched). |
| Missouri | SB 1019 (behavioral-health AI provision) | Not enacted — the AI section was dropped before final passage. |