← Healthcare SiteEnforcementLegislationWho This Is ForPricingGet Certified
AI Governance Shield™
Behavioral Health Division

Behavioral health AI is the most actively legislated AI use case in the country. The wave isn’t coming. It’s here.

Five states are now law within twelve months — Tennessee, Maine, Illinois, California, Colorado. Missouri and New York advancing. The first state-AG investigations are open. The first plaintiff settlements are public. If you have patients in any covered state via telehealth, the law follows your patients — not your office. Tennessee SB 1580 takes effect July 1, 2026. Maine signed April 13. Your malpractice carrier may not cover any of it.

Get Certified Before July 1Free Risk Assessment →
SB 1580 — Exposure Per Practice
$5K
Per violation — base fine under Tennessee Consumer Protection Act
3×
Treble damages if violation is willful or knowing
$4.5M
Realistic exposure — 300 patients × $15K trebled × 6 months
∞
No annual cap on fines. No limit on private lawsuits. They stack.

"Both reckless use of AI and failure to use beneficial AI
can fall below the standard of care."

Federation of State Medical Boards — May 2024 Guidance

Tennessee SB 1580

This Is Not a $5,000 Fine.
This Is Compounding, Uncapped Liability.

A practice might look at $5K per violation and calculate the risk is manageable. Here's what that calculation actually looks like.

“It’s Only $5K — I’ll Take My Chances”
The Penalty Math Practices Aren’t Running
50 patients/month × 6 months = 300 violations × $5K = $1.5M base. Trebled if willful: $4.5M. And that’s before private lawsuits.
+ Details
Base Calculation
50 patients/month × 6 months undetected = 300 violations
300 × $5,000 = $1,500,000
Treble Damages (Willful)
If violation is knowing or willful: 3× multiplier
$1.5M × 3 = $4,500,000
Private Lawsuits Stack On Top
Each patient can sue individually for actual damages + attorney’s fees. 300 patients = 300 potential lawsuits. No class action — each requires separate defense.
AG Enforcement Runs Parallel
Tennessee AG enforces via Consumer Protection Act — simultaneously with private suits. They don’t preempt each other. Both channels stack.
Realistic total exposure: $5M–$10M+ — before accounting for uninsured liability from carrier exclusions. Compare to $3,500 certification.
Enforcement Channels
Who Enforces This — And How It Compounds
Tennessee AG + every affected patient. Two enforcement channels, both active, both stacking.
+ Details
Tennessee Attorney General
Enforces via Consumer Protection Act (§ 47-18-109). Receives complaints, investigates, initiates legal proceedings. Can seek injunctions stopping your use of AI tools entirely.
Private Right of Action
Individual patients sue directly. Must show: AI was represented as qualified professional, they relied on it, actual damages occurred. Attorney’s fees awarded to prevailing plaintiffs.
No Class Actions — That’s Worse, Not Better
TCPA framework prohibits class actions. But 300 individual lawsuits are more expensive to defend than one class action. Each requires separate counsel, discovery, and resolution.
Treble Damages Mechanism
Under § 47-18-109, if violations are “willful or knowing,” courts award triple actual damages. Using AI without governance and awareness of SB 1580 = arguable willfulness.
The Coverage Gap
Your Malpractice Carrier May Not Cover This
Verisk rolled out AI exclusion endorsements January 2026. If your carrier adopted one, you bear the full cost of an SB 1580 claim.
+ Details
Standard Exclusions Now Exist
Verisk (the organization that writes standard policy language for most U.S. insurers) published AI exclusion endorsements: CG 40 47, CG 40 48, CG 35 08. Any carrier can attach these at renewal.
Carriers Already Filing Their Own
W.R. Berkley: Absolute exclusion — bars any claim involving AI use, deployment, or governance.
Hamilton Select: Excludes “actual or alleged use of generative AI.”
Philadelphia Indemnity: Excludes AI-generated professional content.
The Compound Effect
SB 1580 violation + carrier exclusion = fully uninsured liability. You pay the $4.5M+ in fines, the private lawsuit damages, and the defense costs — all out of pocket.
How Certification Changes This
Carriers are beginning to assess AI governance at renewal. Documented certification = evidence your carrier evaluates to narrow or remove exclusions. Same pattern as cybersecurity insurance 2019–2021.
Cascading Risk
What Happens to Your License
SB 1580 violation → AG enforcement → potential licensing board investigation → disciplinary action against your medical license.
+ Details
SB 1580 Doesn’t Revoke Licenses Directly
The statute itself doesn’t include license suspension. But it doesn’t need to. The enforcement cascade does that work.
The Cascade Pattern
AG enforcement action → public record → state licensing board opens investigation → board finds conduct inconsistent with professional standards → discipline, probation, or suspension.
HIPAA Precedent
This is exactly how HIPAA violations trigger license action. OCR enforcement routinely leads to state board investigations. SB 1580 enforcement will follow the same pattern.
Reputational Destruction
AG actions and private lawsuits become public record. Even before any board acts, the reputational damage to a behavioral health practice is severe. Patients leave. Referrals stop.
Reference Point

How This Compares to HIPAA — The Framework Practices Already Know

HIPAA
Up to $73,011 per violation (Tiers 1–3)
Annual cap: $36K–$365K (most practices)
Private right of action: No
Enforcement: Government only (OCR)
Tennessee SB 1580
$5K per violation (trebled: $15K)
Annual cap: None
Private right of action: Yes — every patient
Enforcement: AG + individual lawsuits
HIPAA is expensive but bounded. SB 1580 is unbounded. And unlike HIPAA, every patient is a potential plaintiff.
Enforcement Signals

State AGs Are Already Moving.
Federal Agencies Are Converging.

Behavioral health AI is no longer a future regulatory question. The first state attorney general investigations are open. The first plaintiff settlements are public. The federal agencies are aligning. Click each item below for the full picture.

Texas Attorney General · Active Investigation
Meta AI Studio + Character.AI — Deceptive Trade Practice
The Texas AG is treating chatbot copy as a deceptive trade practice. Every BH product surface — intake screens, marketing copy, chatbot system prompts — is now directly enforceable.
+ Details
The emphasis on “misleading marketing” under the Texas Deceptive Trade Practices Act converts every customer-facing AI text into a directly enforceable surface. Practices should review every intake screen, marketing page, chatbot system prompt, and email template for language that could read as a clinical claim. The certification audit explicitly walks every one of these surfaces.
Multistate AG Coalition · Coordinated Action
Joint Letter on AI Companion Apps
A multistate AG coalition issued a joint letter raising concerns about AI companion apps and minor safety. When one AG charges, others follow.
+ Details
The pattern signals coordinated state-AG enforcement — not isolated state action. Coalitions historically lead to parallel filings across multiple jurisdictions in the same quarter. For BH practices serving telehealth patients across multiple states, exposure compounds across every covered jurisdiction at once. The certification documents jurisdiction-by-jurisdiction governance posture as a defensive shield against parallel enforcement.
Plaintiff Precedent · First Settlement
Character.AI / Google — Setzer Family Settlement
The first publicly settled BH-AI case has landed. The plaintiff bar now has a model: AI characterized as therapeutic, alleged harm, recoverable damages.
+ Details
Once the playbook exists, replication accelerates — especially in Tennessee where SB 1580 lowers the proof burden, and California where AB 489 already provides a private right of action. Plaintiff lawyers now have a settled-case template to point to, which dramatically reduces the friction of bringing the next case. The certification creates documented evidence that distinguishes your governance posture from the defendant's, which is what actually drives early settlement-vs-litigate decisions.
Underwriting Watch · Carrier Direction
First Publicly Filed BH-AI Exclusion Endorsement
Carriers are circulating BH-specific underwriting questionnaires. The first publicly filed BH-AI exclusion endorsement is the leading indicator we are tracking.
+ Details
The questionnaire activity is the leading indicator before formal exclusion filings. When the first BH-AI exclusion endorsement is publicly filed, the coverage gap closes overnight on every renewal that follows — just as cybersecurity exclusions cascaded from 2019 to 2021. Documented certification at renewal is the evidence carriers evaluate to narrow or remove exclusions; it is the same pattern that softened cybersecurity-exclusion language for documented-program practices.
Federal Convergence

State Action Is Not the Only Pressure.
Federal Agencies Are Aligning.

Four federal touchpoints since February have raised the BH AI bar. The state and federal frameworks are converging on the same patterns — documentation, oversight, disclosure, governance. Click each for context.

HHS-OIG · Issued Feb 3, 2026
Medicare Advantage Compliance Program Guidance
First major federal compliance-program guidance referencing AI use in healthcare workflows. Sets the documentation bar that payer audits and state board reviews will mirror.
+ Details
HHS-OIG’s February guidance is the first federal compliance-program document treating AI use as a discrete documentation domain. Practices that participate in Medicare or accept Medicare Advantage will be evaluated against this guidance at audit. State medical boards routinely incorporate OIG compliance-program standards into their own discipline frameworks — meaning the same documentation expectations cascade into state license actions.
CMS · Closed Mar 30, 2026
CRUSH RFI — AI in Healthcare
CMS Request For Information on AI in healthcare delivery closed March 30. The post-RFI guidance is the regulatory question of 2026 H2.
+ Details
The CRUSH (Comprehensive Review of Unduly Sophisticated Health-AI) RFI invited public comment on how AI in healthcare delivery should be governed under Medicare and Medicaid. The post-RFI rulemaking will set the documentation bar for any practice that bills Medicare/Medicaid — including governance posture, oversight architecture, audit trails, and disclosure protocols. Practices certified under a documented framework are positioned to demonstrate compliance with whatever specific rule emerges.
FTC · Issued Mar 11, 2026
FTC AI Policy Statement
FTC March 11 policy statement: misleading AI marketing claims are deceptive trade practices. Every state AG with a Consumer Protection Act now has a federal anchor.
+ Details
The FTC’s March policy statement explicitly characterizes AI marketing claims as enforceable under FTC Act § 5. State AGs with Consumer Protection Act parallel authority — which is most states — can now anchor their own enforcement to a federal articulation of the standard. The Texas AG investigation into Meta AI Studio and Character.AI is the first concrete state-level execution of this pattern. Expect more to follow.
FTC · Active Inquiry
Companion Chatbot Inquiry
FTC active inquiry into AI companion and chatbot products. The first federal-level investigative posture targeting the BH-adjacent AI category.
+ Details
FTC inquiries that mature into rulemakings define the federal floor. Outcomes here will set guardrails that state laws will incorporate — particularly on minor safety, deceptive marketing, and product representations as therapeutic. Behavioral health practices using AI scribes, intake chatbots, or any AI surface that interacts with patients are within the inquiry’s functional scope. The certification documents the same governance categories the inquiry is examining.
National Momentum

Tennessee Is First.
It Won’t Be Last.

Mental health AI legislation is accelerating across the country. Five states are now law within twelve months — Tennessee, Maine, Illinois, California, Colorado — with Missouri and New York advancing through their legislatures. Behavioral health AI is the most actively legislated AI use case in the United States.

Tennessee
SB 1580
Signed — Eff. July 1, 2026
First state healthcare AI law with private right of action. $5K/violation, treble if willful, no cap. Prohibits representing AI as qualified mental health professional.
Maine
LD 2082
Signed Apr 13, 2026
AI therapy ban — signed by Governor Mills. Prohibits AI systems from independently providing therapeutic services without licensed professional oversight.
Illinois
HB 1806
Enacted
AI barred from independent therapeutic decisions in behavioral health. $10K/violation. IHRA amendment effective January 2026.
Missouri
HB 2372
House Passed Apr 2 — Senate
Behavioral health AI governance requirements. Provider oversight mandated for any AI system involved in mental health assessment or treatment. Senate action before May 16 sine die deadline.
Colorado
HB 26-1195
In Effect Aug 12, 2026
Restricts AI in psychotherapy. Bans AI therapeutic communications, AI-generated treatment plans without licensed-clinician review, and marketing AI tools as licensed therapy. Patient written consent required for AI to record or transcribe sessions. Enforced by DORA professional licensing boards. This is the substantive Colorado AI obligation for BH practices — Colorado’s general AI Act (SB 26-189) largely exempts HIPAA-covered clinical AI use.
New York
S7263
Senate Calendar — Pre-Floor
Eliminates the disclaimer defense. A “not medical advice” disclaimer is not a defense if AI was represented as therapeutic. The single provision most likely to surprise BH operators who believe their existing disclaimers cover exposure.
California
AB 489
In Effect
GenAI disclaimers required. $1K/violation. Private right of action. Broader than mental health but directly applicable.
Multi-State
Telehealth Implications
Applies Now
If you have Tennessee patients via telehealth, SB 1580 applies to you regardless of where your office is. Same with Maine (effective Jul 1), Illinois, California.
The Pattern
Every bill requires governance, disclosure, oversight. The question is whether you’re certified before it’s mandatory.
The Sentinel Method

The Four-Element Behavioral Health Risk Matrix

Every BH-AI bill in the country — effective and pending — addresses the same four underlying risk vectors. Our certification assesses each one against your specific deployment. If your governance documentation answers these four elements, you are positioned for any state framework that lands. Click each element for what we examine.

Element 1 · Cited in TN, NY, NJ
License-Impersonation Risk
Does your AI present as a licensed mental health professional? The TN private right of action turns on this. NY S7263 prevents disclaimers from defending it.
+ Details
Our assessment maps every customer-facing AI surface against representation risk — intake screens, chatbot system prompts, email autoresponses, marketing copy, demo videos. We document where any text could read as a clinical claim, where any UI element implies clinical credentialing, where any patient-facing flow blurs the line between AI assistance and licensed care. The certification produces a documented surface-by-surface posture statement that defense counsel can rely on and a state AG would have difficulty re-characterizing.
Element 2 · Cited in IL, CA, ME
Decision-Autonomy Risk
Does your AI make independent therapeutic decisions? Illinois HB 1806 bars it at $10K/violation. Maine LD 2082 bans AI-only therapy.
+ Details
The certification documents the human-in-loop architecture: who reviews what, on what cadence, with what authority to override. We examine the technical and procedural boundaries between AI suggestion and clinician decision — and produce documentation that demonstrates these boundaries are real, audited, and consistently applied. This is the documentation Illinois IDFPR or any state AG would want to see if your governance posture were challenged.
Element 3 · Cited in IL, NH, NY
Emotion-Detection Risk
Does your AI infer or claim to detect emotional state? IL HB 1806 prohibits emotion-detection in BH workflows. NH SB 640 advances similar restrictions.
+ Details
The certification distinguishes legitimate sentiment-aware UX from prohibited emotional inference. We examine model architecture, training data, output handling, and what the AI’s outputs claim to represent — with documented boundaries on how outputs are used and what limits the system enforces. Some AI features look like emotion-detection but legally are not; some look benign but legally are. The certification draws the line in writing.
Element 4 · Cited in every active framework
Consent-and-Disclosure Regime
Does your patient know AI is involved, what it does, and what it cannot do? Every state framework requires it. NY S7263 says disclaimers alone are not a defense.
+ Details
The certification documents your disclosure language, consent capture mechanism, and the specific provisions that match each state’s framework — CA AB 489 GenAI disclaimer, TN SB 1580 representation prohibitions, IL HB 1806 patient notification, NY S7263 affirmative consent — plus the audit trail that survives an enforcement inquiry. Every covered customer-facing surface gets a documented disclosure-and-consent trace; the certificate becomes the artifact your defense counsel and your malpractice carrier can both reference.
Why Four Elements
Bills get drafted differently. Penalties vary. Definitions shift. But every framework reduces to the same four questions. Document your answer to each — and you are positioned for the framework that lands in your jurisdiction next.
Who Needs This

If You Deploy AI in Behavioral Health,
This Applies to You.

Psychiatric practices using AI scribes
Therapy practices with AI scheduling or intake
Behavioral health groups with EHR AI tools
Telehealth mental health platforms
Substance abuse treatment centers using AI
Any practice with Tennessee patients via telehealth
Pricing

Choose Your Certification Tier

Same proven framework as healthcare. Mental health compliance module included in all tiers.

Tier 1
Solo
1–3 providers, 1 AI system
$3,500
one-time assessment
Full behavioral health governance assessment. SB 1580 compliance documentation. Certification report + governance policies + implementation tools.
Get Certified
Most Common
Tier 2
Group
4–20 providers, multiple AI systems
$8,000
one-time assessment
Multi-system assessment + SB 1580 compliance documentation + vendor governance review + multi-state behavioral health regulatory mapping.
Get Certified
Tier 3
Enterprise
20+ providers, multi-site
$25,000+
custom scope
Board-ready reporting + multi-state behavioral health regulatory mapping + annual recertification pathway + dedicated governance advisor.
Get Certified
50% deposit to begin. Balance due upon report delivery. Certification valid 12 months. Renewal pricing reduced for returning clients.
Active Monitoring

What We’re Watching — Next 30 Days

The legislative and enforcement landscape changes weekly. This block is refreshed biweekly as part of our research cadence. What is on our active watchlist today:

NY S7263 — Floor Vote
Passed Senate third reading; awaiting floor vote (calendar position 70 as of May 2026). A floor vote would deliver the no-disclaimer-defense provision — the single most consequential provision yet for BH operators relying on existing disclaimers.
MO HB 2372 — Senate Action
Missouri Senate must act before the May 16 sine die deadline. Either passes — making Missouri the fifth state law in twelve months — or dies and reintroduces next session.
NH SB 640 — House Action
New Hampshire’s parallel emotion-detection prohibition. Active in the House. If it advances, NH becomes the next likely “effective” state inside the twelve-month window.
CA AB 1988 / AB 2023 / SB 1119 / SB 903
Four California bills with BH-relevance moving through floor calendars. CA already has AB 489 in effect; these would deepen the state framework.
First BH-AI Malpractice Exclusion Filing
Public filing of the first BH-specific AI exclusion endorsement is the leading indicator we are tracking. Carriers are circulating questionnaires; the endorsement filing is the trigger that closes the coverage gap on every renewal.
First AG Charging Decision Under TN SB 1580 or IL HB 1806
The first state-AG charging decision under either active statute will set the enforcement template every other state AG follows. We update this page within 48 hours of any first-charge announcement.
Last refreshed: May 1, 2026. Sentinel Risk Group operates a biweekly research cadence on behavioral health AI legislation, enforcement, and underwriting signals. This watchlist is updated as items resolve.

SB 1580 takes effect July 1, 2026.

Every day without governance is another day of compounding exposure. Certification takes weeks, not months. Start now.

Get Certified Before July 1

Disclaimer: The information on this website is provided for general informational purposes only and does not constitute legal, financial, insurance, or compliance advice. AI Governance Shield™ certification is an independent governance evaluation service and does not guarantee regulatory compliance, insurance coverage, legal protection, or immunity from enforcement actions. Applicable laws, regulations, and insurance policy terms vary by jurisdiction and are subject to change. Specific penalty amounts, enforcement provisions, and statutory requirements referenced on this site reflect publicly available information as of the date of publication and may have been amended. Practices should consult qualified legal counsel for advice specific to their circumstances. Sentinel Risk Group is not a law firm, insurance company, healthcare provider, or government agency.