AI in the Therapist’s Chair? California Says No—and Backs It Up With $10,000 Penalties

California is drawing a hard line: artificial intelligence may schedule a therapy appointment, but it may not conduct one. Licensed professionals who allow AI to make independent therapeutic decisions, interact directly with patients, or detect emotions and mental states may face fines of up to $10,000 per violation, and that liability extends to the entities that employ or contract with them. SB 903 also imposes consent requirements that go well beyond HIPAA, requiring purpose-specific, written, and revocable authorization before any AI tool may record or transcribe a session. Organizations outside California should pay close attention: behavioral health has drawn early legislative focus in multiple states, and SB 903 is likely to serve as a template for practice-specific AI regulation nationwide.

This is the fourth installment in our series on California’s 2026 health care AI legislation. Each installment covers a single bill; this one addresses SB 903, which restricts the use of AI in psychotherapy and imposes written consent requirement. This installment examines the uses of AI that SB 903 forecloses in therapeutic settings, the administrative and supplementary uses that remain available, consent required before AI may record or transcribe a session, and why the bill’s consent regime operates independently of, and more prescriptively than, HIPAA authorization.

In This Series

• Part One: Background and Prohibition on AI Independently Performing Licensed Clinical Functions (AB 1979)
• Part Two: Bias Identification and Mitigation for Clinical Decision Support Systems (SB 503)
• Part Three: New Liability and Worker Protection Framework for AI-Driven Clinical Decision Support Systems (AB 2575)
• Part Four: Regulation of AI in Psychotherapy Services (SB 903)
• Part Five: The Right to Human Customer Service Act (AB 1609)
• Series-Wide Action Items for Health Care Organizations

Part Four: Regulation of AI in Psychotherapy Services (SB 903)

What it does: SB 903 regulates the use of AI in providing or facilitating psychotherapy services. The bill restricts how licensed professionals may use AI in therapeutic settings, and violations may result in fines up to $10,000 per violation.

Key compliance obligations:

• Psychotherapy must be provided by a licensed professional. No individual, corporation, or entity may provide, advertise, or offer psychotherapy services in California unless a licensed professional conducts those services. Advertising or purporting to offer psychotherapy through companion chatbots is prohibited.
• AI may not perform core therapeutic functions. Licensed professionals are prohibited from allowing AI to make independent therapeutic decisions, directly interact with clients in therapeutic communications (except where the therapist is using an FDA-approved and HIPAA-compliant product), generate therapeutic recommendations or treatment plans without professional review and approval, or detect emotions or mental states.
• Written consent is required for AI recording or transcriptions. Before AI may record or transcribe a therapeutic session, the provider must provide written notice and obtain the patient’s written consent. To be valid, consent must be:
  • Written, informed, voluntary, and purpose-specific – provided after receiving a written description of the AI tool and its intended use;
  • Unambiguous and express – not buried in general terms of service;
  • Documented in the patient’s record; and
  • Revocable at any time, without affecting the patient’s right to care.

Notably, the bill expressly excludes from the definition of valid consent: acceptance of broad terms of use, merely hovering over or muting/pausing/closing digital content, or agreement obtained through deceptive design patterns.

• Employers and contracting entities share compliance responsibility. Organizations that require or authorize licensed professionals to use AI are independently responsible for ensuring AI use complies with SB 903 and directing the licensed professional to use AI in a compliant manner.

Exceptions: Licensed professionals may use AI for administrative support (e.g., scheduling, billing, logistical communications) and supplementary support (e.g., preparing records, organizing referrals), provided they maintain full responsibility for all outputs. The bill also exempts religious counseling, peer support services, self-help educational materials, AI used solely for training or simulation purposes, and academic or nonprofit research.

Effective date: January 1, 2027, if the bill becomes law.

Analysis: The legislation defines “licensed professional” broadly to include licensed clinical psychologists, licensed clinical social workers, licensed professional clinical counselors, licensed marriage and family therapists, registered or certified alcohol or drug counselors, psychiatric mental health nurse practitioners, and other state-authorized therapy providers. For providers that have integrated AI-enabled mental health triage or support tools, the bill’s consent-for-recording requirements create consent obligation that operates alongside (and is more prescriptive than) HIPAA’s general authorization framework.

The same analysis reaches entities that are not the treating professional but sit in the session workflow:

• Specialty pharmacies conducting behavioral health adherence outreach
• Insurers and managed care organizations operating behavioral health triage and crisis lines
• PBMs administering behavioral health carve-out programs
• Digital therapeutic, telebehavioral health, and ambient documentation vendors whose platforms perform the recording, transcription, or emotion-inference functions the bill restricts

For these entities, the exposure is largely contractual and reputational rather than direct, because the licensed professional carries the statutory duty; however, non-provider entities should expect to support session-specific written consent capture, disable emotion and mental state inference by default, and evidence FDA clearance and HIPAA compliance for any feature that interacts directly with clients.

Beyond consent mechanics, providers should also weigh whether they want therapeutic interactions transcribed or recorded at all, because a verbatim record of a session is a discoverable artifact that can be used against the clinician in a licensing investigation or malpractice action. This is a calculus familiar to businesses weighing AI-enabled transcription tools, where the concern is that vendor access to privileged communications may waive attorney-client privilege and that the resulting transcript becomes a discoverable record of counsel’s advice.

If enacted, this bill is likely to serve as a blueprint for legislatures looking to introduce practice-specific AI requirements in other specialties.

Practical takeaways:

• Audit AI Deployments. Map AI tools used in connection with psychotherapy services, classify them by function (administrative, supplementary, or clinical), and identify gaps in compliance.
• Redesign Consent Workflows. General consents to care are not sufficient. Develop purpose-specific consent mechanisms describing the purpose of the AI so that any AI recording or transcription of a therapeutic session is supported by consent that is affirmative, documented, and revocable, rather than by a general consent form.
• Establish Human-in-the-Loop Protocols. Confirm that no AI tool is generating therapeutic recommendations or treatment plans without professional review, interacting directly with clients absent an FDA-approved and HIPAA-compliant product, or performing emotion or mental state detection.
• Review Marketing and Product Descriptions. Ensure no companion chatbot is advertised as providing psychotherapy.
• Update Governance Policies. Review data sharing, storage, and model-deployment processes and practices for compliance with CMIA, HIPAA, and state-specific sensitive health information laws.

SB 903 is a clear signal: California is not waiting for a general AI framework before regulating specific clinical disciplines. Organizations that build compliant consent and oversight workflows now will be better positioned as similar requirements spread to other states and specialties. Part Five of this series takes up AB 1609, which moves beyond the clinical encounter altogether and regulates AI in the consumer-facing customer service channels where patients and members increasingly interact with health care organizations.

For any questions on development or deployment of AI in the health care setting contact your Quarles attorney or:

• Meghan O’Connor: (414) 277-5423 / meghan.oconnor@quarles.com
• Candice Andalia: (202) 780-2627 / candice.andalia@quarles.com