Colorado HB 26-1195 (C.R.S. 12-245-224.5, AI in psychotherapy services)

Binding law — in force

Colorado psychotherapists' use of AI must comply with state and federal privacy and security law, including HIPAA (Colorado HB 26-1195)

C.R.S. 12-245-224.5(3) · official text · In force: applies since 12 Aug 2026 · Colorado (US-CO)

C.R.S. 12-245-224.5(3), added by Colorado HB 26-1195, makes the use of an AI system by a licensee, registrant, certificate holder or other individual lawfully permitted to provide psychotherapy services in Colorado subject to applicable state and federal privacy and security laws, including the Health Insurance Portability and Accountability Act of 1996 (Pub.L. 104-191) and its implementing regulations. Detect session notes, transcripts or other client records sent to a model API with no business-associate agreement, HIPAA-eligible endpoint or de-identification safeguard.

Who it applies to

• Duty falls on: individual professional
• Sectors: healthcare
• Colorado licensees, registrants and certificate holders under article 245 of title 12, and other individuals lawfully permitted to provide psychotherapy services in Colorado, when they use or allow an AI system (any machine-based system that infers from its inputs how to generate outputs, 12-245-224.5(1)(b)) in psychotherapy services. Vendors of practice software are reached through what the professional may allow the AI to do. 'Psychotherapy services' takes its meaning from 12-245-202 (not captured). In force since 2026-08-12; the act applies to actions taken on or after that date (HB 26-1195 sec. 4).
• Not covered:
  • AI used within an accredited or approved educational, instructional or professional training program, solely for educational, administrative, simulation or training purposes, not deployed, marketed or represented for use with clients, patients or the public, and reviewed or controlled by a licensed professional where it includes clinical decision-making content (C.R.S. 12-245-224.5(7))
  • Involvement in developing, testing or evaluating an AI system solely for research under the oversight of an institutional review board registered with HHS, while the system is not offered to consumers or used to provide psychotherapy services outside the research setting (12-245-224.5(8))
  • Using or recommending self-help, therapeutic homework, coaching, journaling, psychoeducation, session preparation or summaries, mood monitoring, crisis resource directories, safety planning or other wellness tools that do not diagnose or treat mental health disorders and clearly and conspicuously disclose that they are not a substitute for clinical care (12-245-224.5(9)(a))
  • Using or recommending a technology or service the FDA has authorized, approved, cleared or granted enforcement discretion for an intended use that includes delivering behavioral health interventions, that does not diagnose or treat mental health disorders and that discloses it is not a substitute for clinical care (12-245-224.5(9)(b))
• Whether it applies depends on facts outside the code; a person has to decide.

client = OpenAI()
resp = client.chat.completions.create(model='gpt-4o', messages=[
    {'role': 'user', 'content': f'Summarize: {patient.clinical_note}'}])

VENDORS = load_yaml('vendors/ai_vendors.yaml')   # baa_signed, zero_data_retention per endpoint

def phi_client(name: str) -> tuple[AzureOpenAI, str]:
    v = VENDORS[name]
    if not (v['baa_signed'] and v['zero_data_retention']):
        raise PermissionError(f'{name} is not cleared for PHI')
    client = AzureOpenAI(azure_endpoint=v['endpoint'], api_key=os.environ['AZURE_OPENAI_KEY'],
                         api_version=v['api_version'])
    return client, v['deployment']

client, deployment = phi_client('azure-openai-hipaa')
resp = client.chat.completions.create(model=deployment, messages=[
    {'role': 'user', 'content': f'Summarize: {patient.clinical_note}'}])

Rule id co-hb26-1195.ai-privacy-compliance · review status: primary source derived

Binding law — in force

Colorado therapists need written notice and consent before AI records or transcribes a session, and may not deny care for refusing (Colorado HB 26-1195)

C.R.S. 12-245-224.5(4) · official text · In force: applies since 12 Aug 2026 · Colorado (US-CO)

C.R.S. 12-245-224.5(4)(a), added by Colorado HB 26-1195, bars a licensee, registrant, certificate holder or other individual lawfully permitted to provide psychotherapy services in Colorado from using an AI system to record or transcribe a client's therapeutic session unless the client or the client's legally authorized representative is told in advance in writing that an AI system will be used and its specific purpose, and consents in writing; the client's refusal or later revocation may not be used as a basis to deny psychotherapy services. Consent is a clear, explicit, affirmative, specific, unambiguous and revocable written agreement (electronic allowed); acceptance of general or broad terms of use, hovering over, muting, pausing or closing content, and deception do not count (1)(c). Consent is needed for the initial use on or after the effective date and again when the purpose or manner of use materially changes (4)(b). Detect session recordings or transcripts reaching AI with no consent check, consent bundled into terms of use, and copy that makes AI consent a condition of care.

Who it applies to

• Duty falls on: individual professional
• Sectors: healthcare
• Colorado licensees, registrants and certificate holders under article 245 of title 12, and other individuals lawfully permitted to provide psychotherapy services in Colorado, when they use or allow an AI system (any machine-based system that infers from its inputs how to generate outputs, 12-245-224.5(1)(b)) in psychotherapy services. Vendors of practice software are reached through what the professional may allow the AI to do. 'Psychotherapy services' takes its meaning from 12-245-202 (not captured). In force since 2026-08-12; the act applies to actions taken on or after that date (HB 26-1195 sec. 4).
• Not covered:
  • AI used within an accredited or approved educational, instructional or professional training program, solely for educational, administrative, simulation or training purposes, not deployed, marketed or represented for use with clients, patients or the public, and reviewed or controlled by a licensed professional where it includes clinical decision-making content (C.R.S. 12-245-224.5(7))
  • Involvement in developing, testing or evaluating an AI system solely for research under the oversight of an institutional review board registered with HHS, while the system is not offered to consumers or used to provide psychotherapy services outside the research setting (12-245-224.5(8))
  • Using or recommending self-help, therapeutic homework, coaching, journaling, psychoeducation, session preparation or summaries, mood monitoring, crisis resource directories, safety planning or other wellness tools that do not diagnose or treat mental health disorders and clearly and conspicuously disclose that they are not a substitute for clinical care (12-245-224.5(9)(a))
  • Using or recommending a technology or service the FDA has authorized, approved, cleared or granted enforcement discretion for an intended use that includes delivering behavioral health interventions, that does not diagnose or treat mental health disorders and that discloses it is not a substitute for clinical care (12-245-224.5(9)(b))
• Whether it applies depends on facts outside the code; a person has to decide.

def draft_note(session):
    with open(session.audio_path, 'rb') as f:
        transcript = client.audio.transcriptions.create(model='whisper-1', file=f).text
    resp = client.chat.completions.create(model=MODEL, messages=[
        {'role': 'system', 'content': NOTE_PROMPT}, {'role': 'user', 'content': transcript}])
    return resp.choices[0].message.content

def draft_note(session):
    consent = db.consents.get(client_id=session.client_id, purpose='ai_scribe')
    if consent is None or consent.signed_at is None or consent.revoked_at:
        raise ConsentRequired('written AI-use consent for note drafting is missing or revoked')
    with open(session.audio_path, 'rb') as f:
        transcript = client.audio.transcriptions.create(model='whisper-1', file=f).text
    resp = client.chat.completions.create(model=MODEL, messages=[
        {'role': 'system', 'content': NOTE_PROMPT}, {'role': 'user', 'content': transcript}])
    return resp.choices[0].message.content

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Tell people when they are interacting with AI — everywhere, not only where required

Rule id co-hb26-1195.ai-session-recording-notice-consent · review status: primary source derived

Binding law — in force

Colorado psychotherapists must not let AI do therapy or talk therapeutically with clients unless they take part in real time (Colorado HB 26-1195)

C.R.S. 12-245-224.5(6)(a) · official text · In force: applies since 12 Aug 2026 · Colorado (US-CO)

C.R.S. 12-245-224.5(6)(a), added by Colorado HB 26-1195, bars a licensee, registrant, certificate holder or other individual lawfully permitted to provide psychotherapy services in Colorado from using an AI system to provide, direct or guide (or attempt to) psychotherapy, clinical intervention, counseling, diagnosis, treatment planning or any other practice of psychotherapy with an individual or a group unless the use complies with 12-245-224.5(5); (5)(a) bars allowing an AI system to interact with clients in any form of therapeutic communication without synchronous, real-time interaction between the professional, the AI system and the client. 'Synchronous' means simultaneous active participation of the client and the professional and does not mean a review after the interaction (1)(e); therapeutic communication includes reflecting a client's thoughts and emotions, therapeutic guidance or interventions, emotional support in response to distress, work on treatment goals and behavioral feedback, but not general wellness education (1)(f). At initial client contact the professional must give the client written information on these prohibitions (6)(b). Training programs, IRB research, and self-help or FDA-authorized tools that do not diagnose or treat and disclose they are not a substitute for clinical care are carved out (7)-(9). Detect an AI cast or offered as the therapist, and model replies sent straight to clients with no professional in the session.

Who it applies to

• Duty falls on: individual professional
• Sectors: healthcare
• Colorado licensees, registrants and certificate holders under article 245 of title 12, and other individuals lawfully permitted to provide psychotherapy services in Colorado, when they use or allow an AI system (any machine-based system that infers from its inputs how to generate outputs, 12-245-224.5(1)(b)) in psychotherapy services. Vendors of practice software are reached through what the professional may allow the AI to do. 'Psychotherapy services' takes its meaning from 12-245-202 (not captured). In force since 2026-08-12; the act applies to actions taken on or after that date (HB 26-1195 sec. 4).
• Not covered:
  • AI used within an accredited or approved educational, instructional or professional training program, solely for educational, administrative, simulation or training purposes, not deployed, marketed or represented for use with clients, patients or the public, and reviewed or controlled by a licensed professional where it includes clinical decision-making content (C.R.S. 12-245-224.5(7))
  • Involvement in developing, testing or evaluating an AI system solely for research under the oversight of an institutional review board registered with HHS, while the system is not offered to consumers or used to provide psychotherapy services outside the research setting (12-245-224.5(8))
  • Using or recommending self-help, therapeutic homework, coaching, journaling, psychoeducation, session preparation or summaries, mood monitoring, crisis resource directories, safety planning or other wellness tools that do not diagnose or treat mental health disorders and clearly and conspicuously disclose that they are not a substitute for clinical care (12-245-224.5(9)(a))
  • Using or recommending a technology or service the FDA has authorized, approved, cleared or granted enforcement discretion for an intended use that includes delivering behavioral health interventions, that does not diagnose or treat mental health disorders and that discloses it is not a substitute for clinical care (12-245-224.5(9)(b))
• Whether it applies depends on facts outside the code; a person has to decide.

@app.post('/session/message')
def message(req: Msg):
    msgs = [{'role': 'system', 'content': "You are the user's therapist."}, *req.history]
    reply = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
    return {'reply': reply}

@app.post('/session/message')
def message(req: Msg):
    session = sessions.get(req.session_id)
    clinician = session.conducted_by
    if clinician is None or not clinician.license_active:
        raise HTTPException(409, 'No licensed clinician is conducting this session')
    msgs = [{'role': 'system', 'content': CLINICIAN_DRAFT_PROMPT}, *req.history]
    draft = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
    clinician_review_queue.enqueue(session_id=session.id, clinician_id=clinician.id, draft=draft)
    return {'status': 'sent_to_your_clinician'}

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Pennsylvania sues Character.AI after a chatbot claimed a Pennsylvania medical licence and gave an invalid licence number (2026-05; alleged (not proven)). A petition filed May 1, 2026 in the Commonwealth Court of Pennsylvania (No. 220 MD 2026) by the Department of State's State Board of Medicine under the Medical Practice Act alleges that a Department investigator, using a Character.AI account, chatted with a character described on the platform as a 'Doctor of psychiatry', which said it had trained at Imperial College London and was registered with the UK General Medical Council, said it was licensed in Pennsylvania, and gave 'PS306189' as its licence number. The petition states that this is not a valid licence number to practise medicine and surgery in Pennsylvania and that the character had about 45,500 user interactions as of April 17, 2026. The Board alleges the unlawful practice of medicine and seeks an injunction. The allegations have not been adjudicated. Source: Petition for Review in the Nature of a Complaint in Equity, Commonwealth of Pennsylvania, Department of State, State Board of Medicine v. Character Technologies, Inc., No. 220 MD 2026 (Pa. Commw. Ct., filed 2026-05-01) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• FTC order bars DoNotPay's unsubstantiated 'robot lawyer' claims (2021; alleged (not proven)). The FTC's complaint alleges that DoNotPay marketed its subscription service as 'the world's first robot lawyer' without testing whether its law-related features performed like a human lawyer and without retaining attorneys to test their quality and accuracy. DoNotPay settled without admitting or denying the allegations; the final order (announced February 2025) requires $193,000 in monetary relief and notice to 2021-2023 subscribers, and bars claims that the service performs like a real lawyer without sufficient evidence. Source: U.S. Federal Trade Commission (press release, 2025-02-11) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession

Rule id co-hb26-1195.no-ai-psychotherapy-without-synchronous-therapist · review status: primary source derived

Binding law — in force

AI advertising, interface and outputs must not represent that users' data is protected like therapist-client confidentiality (Colorado HB 26-1195)

C.R.S. 6-1-1705.2(1) · official text · In force: applies since 12 Aug 2026 · Colorado (US-CO)

C.R.S. 6-1-1705.2(1)(c), added by Colorado HB 26-1195, bars any person from using any term, letter or phrase in the advertising, interface or outputs of an AI system in a manner that represents that a user's data is confidential in a way that would lead a reasonable user to believe that the data is protected comparably to the privacy protections of therapist-client confidentiality in a relationship between a Colorado psychotherapy licensee, registrant, certificate holder or other person lawfully permitted to provide psychotherapy services and the client. Training programs, IRB research, and self-help or FDA-authorized tools that do not diagnose or treat and disclose they are not a substitute for clinical care are excluded (6-1-1705.2(3)-(5)). Detect persona prompts, replies, onboarding and marketing copy that promise therapist-client or doctor-patient confidentiality or privilege, or confidentiality 'like therapy'.

Who it applies to

• Duty falls on: any person
• Sectors: healthcare
• Any person who uses a term, letter or phrase in the advertising, interface or outputs of an AI system (any machine-based system that infers from its inputs how to generate outputs, 12-245-224.5(1)(b) as applied by 6-1-1705.2(6)(a)) offered to people in Colorado. A psychotherapy licensee, registrant or certificate holder is not liable under the section for defects or failures of an AI system attributable to its developer or deployer, whose liability is governed by consumer protection law (6-1-1705.2(2)). 'Psychotherapy services' takes its meaning from 12-245-202 (not captured). In force since 2026-08-12; the act applies to actions taken on or after that date (HB 26-1195 sec. 4).
• Not covered:
  • AI used within an accredited or approved educational, instructional or professional training program, solely for educational, administrative, simulation or training purposes, not deployed, marketed or represented for use with clients, patients or the public, and reviewed or controlled by a licensed professional where it includes clinical decision-making content (C.R.S. 6-1-1705.2(3))
  • Developing, testing or evaluating an AI system solely for research under the oversight of an institutional review board registered with HHS, while the system is not offered to consumers or used to provide psychotherapy services outside the research setting (6-1-1705.2(4))
  • Self-help, therapeutic homework, coaching, journaling, psychoeducation, session preparation or summaries, mood monitoring, crisis resource directories, safety planning or other wellness tools that do not diagnose or treat mental health disorders and clearly and conspicuously disclose that they are not a substitute for clinical care (6-1-1705.2(5)(a))
  • A technology or service the FDA has authorized, approved, cleared or granted enforcement discretion for an intended use that includes delivering behavioral health interventions, that does not diagnose or treat mental health disorders and that discloses it is not a substitute for clinical care (6-1-1705.2(5)(b))
• Whether it applies depends on facts outside the code; a person has to decide.

reply = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
return {'reply': reply}

CONFIDENTIALITY_CLAIM = re.compile(r'(?i)\b(therapist|doctor)[- ](client|patient) (confidentiality|privilege)'
                                  r'|\bas confidential as\b|\b(completely|100%) confidential\b')
reply = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if CONFIDENTIALITY_CLAIM.search(reply):
    reply = ('I am an AI, and our chats are not protected like a session with a therapist. '
             'Our privacy notice explains how conversations are stored and used.')
return {'reply': reply}

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Pennsylvania sues Character.AI after a chatbot claimed a Pennsylvania medical licence and gave an invalid licence number (2026-05; alleged (not proven)). A petition filed May 1, 2026 in the Commonwealth Court of Pennsylvania (No. 220 MD 2026) by the Department of State's State Board of Medicine under the Medical Practice Act alleges that a Department investigator, using a Character.AI account, chatted with a character described on the platform as a 'Doctor of psychiatry', which said it had trained at Imperial College London and was registered with the UK General Medical Council, said it was licensed in Pennsylvania, and gave 'PS306189' as its licence number. The petition states that this is not a valid licence number to practise medicine and surgery in Pennsylvania and that the character had about 45,500 user interactions as of April 17, 2026. The Board alleges the unlawful practice of medicine and seeks an injunction. The allegations have not been adjudicated. Source: Petition for Review in the Nature of a Complaint in Equity, Commonwealth of Pennsylvania, Department of State, State Board of Medicine v. Character Technologies, Inc., No. 220 MD 2026 (Pa. Commw. Ct., filed 2026-05-01) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• FTC order bars DoNotPay's unsubstantiated 'robot lawyer' claims (2021; alleged (not proven)). The FTC's complaint alleges that DoNotPay marketed its subscription service as 'the world's first robot lawyer' without testing whether its law-related features performed like a human lawyer and without retaining attorneys to test their quality and accuracy. DoNotPay settled without admitting or denying the allegations; the final order (announced February 2025) requires $193,000 in monetary relief and notice to 2021-2023 subscribers, and bars claims that the service performs like a real lawyer without sufficient evidence. Source: U.S. Federal Trade Commission (press release, 2025-02-11) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession

Rule id co-hb26-1195.no-implied-therapist-client-confidentiality · review status: primary source derived

Binding law — in force

AI ads, interface and outputs must not imply the AI's output comes from, is endorsed by or equals a Colorado-licensed psychotherapist (Colorado HB 26-1195)

C.R.S. 6-1-1705.2(1) · official text · In force: applies since 12 Aug 2026 · Colorado (US-CO)

C.R.S. 6-1-1705.2(1)(a), added by Colorado HB 26-1195, bars any person from using any term, letter or phrase in the advertising, interface or outputs of an AI system in a manner that indicates or implies that the system's output data is being provided by, is endorsed by, or is equivalent to services provided by an individual licensed, registered or certified in Colorado under article 245 of title 12 to engage in the practice of psychotherapy or to provide psychotherapy services. Training programs, IRB research, and self-help or FDA-authorized tools that do not diagnose or treat and disclose they are not a substitute for clinical care are excluded (6-1-1705.2(3)-(5)). Detect personas, prompts, UI and marketing copy that give the AI a mental health licence or title, or claim therapist endorsement or equivalence.

Who it applies to

• Duty falls on: any person
• Sectors: healthcare
• Any person who uses a term, letter or phrase in the advertising, interface or outputs of an AI system (any machine-based system that infers from its inputs how to generate outputs, 12-245-224.5(1)(b) as applied by 6-1-1705.2(6)(a)) offered to people in Colorado. A psychotherapy licensee, registrant or certificate holder is not liable under the section for defects or failures of an AI system attributable to its developer or deployer, whose liability is governed by consumer protection law (6-1-1705.2(2)). 'Psychotherapy services' takes its meaning from 12-245-202 (not captured). In force since 2026-08-12; the act applies to actions taken on or after that date (HB 26-1195 sec. 4).
• Not covered:
  • AI used within an accredited or approved educational, instructional or professional training program, solely for educational, administrative, simulation or training purposes, not deployed, marketed or represented for use with clients, patients or the public, and reviewed or controlled by a licensed professional where it includes clinical decision-making content (C.R.S. 6-1-1705.2(3))
  • Developing, testing or evaluating an AI system solely for research under the oversight of an institutional review board registered with HHS, while the system is not offered to consumers or used to provide psychotherapy services outside the research setting (6-1-1705.2(4))
  • Self-help, therapeutic homework, coaching, journaling, psychoeducation, session preparation or summaries, mood monitoring, crisis resource directories, safety planning or other wellness tools that do not diagnose or treat mental health disorders and clearly and conspicuously disclose that they are not a substitute for clinical care (6-1-1705.2(5)(a))
  • A technology or service the FDA has authorized, approved, cleared or granted enforcement discretion for an intended use that includes delivering behavioral health interventions, that does not diagnose or treat mental health disorders and that discloses it is not a substitute for clinical care (6-1-1705.2(5)(b))
• Whether it applies depends on facts outside the code; a person has to decide.

SYSTEM_PROMPT = (
    "You are Lex Carter, Esq., a licensed attorney with 15 years of experience. "
    "Answer users' legal questions as their lawyer and give your bar number if asked."
)

SYSTEM_PROMPT = (
    "You are Lex, an AI legal-information assistant. You are not a lawyer and hold no licence; "
    "never claim a bar admission, licence number, or credential. Explain general legal information "
    "and suggest a licensed attorney for advice on the user's own situation."
)

Related incidents

• Pennsylvania sues Character.AI after a chatbot claimed a Pennsylvania medical licence and gave an invalid licence number (2026-05; alleged (not proven)). A petition filed May 1, 2026 in the Commonwealth Court of Pennsylvania (No. 220 MD 2026) by the Department of State's State Board of Medicine under the Medical Practice Act alleges that a Department investigator, using a Character.AI account, chatted with a character described on the platform as a 'Doctor of psychiatry', which said it had trained at Imperial College London and was registered with the UK General Medical Council, said it was licensed in Pennsylvania, and gave 'PS306189' as its licence number. The petition states that this is not a valid licence number to practise medicine and surgery in Pennsylvania and that the character had about 45,500 user interactions as of April 17, 2026. The Board alleges the unlawful practice of medicine and seeks an injunction. The allegations have not been adjudicated. Source: Petition for Review in the Nature of a Complaint in Equity, Commonwealth of Pennsylvania, Department of State, State Board of Medicine v. Character Technologies, Inc., No. 220 MD 2026 (Pa. Commw. Ct., filed 2026-05-01) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• FTC order bars DoNotPay's unsubstantiated 'robot lawyer' claims (2021; alleged (not proven)). The FTC's complaint alleges that DoNotPay marketed its subscription service as 'the world's first robot lawyer' without testing whether its law-related features performed like a human lawyer and without retaining attorneys to test their quality and accuracy. DoNotPay settled without admitting or denying the allegations; the final order (announced February 2025) requires $193,000 in monetary relief and notice to 2021-2023 subscribers, and bars claims that the service performs like a real lawyer without sufficient evidence. Source: U.S. Federal Trade Commission (press release, 2025-02-11) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession

Rule id co-hb26-1195.no-psychotherapist-equivalence-claims · review status: primary source derived

Binding law — in force

AI must not be represented as providing psychotherapy services in Colorado (Colorado HB 26-1195)

C.R.S. 6-1-1705.2(1) · official text · In force: applies since 12 Aug 2026 · Colorado (US-CO)

C.R.S. 6-1-1705.2(1)(b), added by Colorado HB 26-1195, bars any person from using any term, letter or phrase in the advertising, interface or outputs of an AI system in a manner that represents that the AI system provides psychotherapy services ('psychotherapy' and 'psychotherapy services' as defined in 12-245-202, 6-1-1705.2(6)(b)). Training programs, IRB research, and self-help or FDA-authorized tools that do not diagnose or treat and disclose they are not a substitute for clinical care are excluded (6-1-1705.2(3)-(5)). Detect persona prompts, replies, UI copy and listings that present the AI as a therapist or counselor, or offer therapy delivered by the AI.

Who it applies to

• Duty falls on: any person
• Sectors: healthcare
• Any person who uses a term, letter or phrase in the advertising, interface or outputs of an AI system (any machine-based system that infers from its inputs how to generate outputs, 12-245-224.5(1)(b) as applied by 6-1-1705.2(6)(a)) offered to people in Colorado. A psychotherapy licensee, registrant or certificate holder is not liable under the section for defects or failures of an AI system attributable to its developer or deployer, whose liability is governed by consumer protection law (6-1-1705.2(2)). 'Psychotherapy services' takes its meaning from 12-245-202 (not captured). In force since 2026-08-12; the act applies to actions taken on or after that date (HB 26-1195 sec. 4).
• Not covered:
  • AI used within an accredited or approved educational, instructional or professional training program, solely for educational, administrative, simulation or training purposes, not deployed, marketed or represented for use with clients, patients or the public, and reviewed or controlled by a licensed professional where it includes clinical decision-making content (C.R.S. 6-1-1705.2(3))
  • Developing, testing or evaluating an AI system solely for research under the oversight of an institutional review board registered with HHS, while the system is not offered to consumers or used to provide psychotherapy services outside the research setting (6-1-1705.2(4))
  • Self-help, therapeutic homework, coaching, journaling, psychoeducation, session preparation or summaries, mood monitoring, crisis resource directories, safety planning or other wellness tools that do not diagnose or treat mental health disorders and clearly and conspicuously disclose that they are not a substitute for clinical care (6-1-1705.2(5)(a))
  • A technology or service the FDA has authorized, approved, cleared or granted enforcement discretion for an intended use that includes delivering behavioral health interventions, that does not diagnose or treat mental health disorders and that discloses it is not a substitute for clinical care (6-1-1705.2(5)(b))
• Whether it applies depends on facts outside the code; a person has to decide.

reply = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
return {'reply': reply}

PROVIDER_CLAIM = re.compile(r'(?i)\b(licensed (therapist|counselor|psychologist|psychiatrist)'
                            r'|professional (mental|behavioral) health( care)?|your (ai )?therapist)\b')
reply = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if PROVIDER_CLAIM.search(reply):
    reply = ('I am an AI support tool, not a licensed mental health professional. '
             'For professional care, please contact a licensed provider.')
return {'reply': reply}

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• Pennsylvania sues Character.AI after a chatbot claimed a Pennsylvania medical licence and gave an invalid licence number (2026-05; alleged (not proven)). A petition filed May 1, 2026 in the Commonwealth Court of Pennsylvania (No. 220 MD 2026) by the Department of State's State Board of Medicine under the Medical Practice Act alleges that a Department investigator, using a Character.AI account, chatted with a character described on the platform as a 'Doctor of psychiatry', which said it had trained at Imperial College London and was registered with the UK General Medical Council, said it was licensed in Pennsylvania, and gave 'PS306189' as its licence number. The petition states that this is not a valid licence number to practise medicine and surgery in Pennsylvania and that the character had about 45,500 user interactions as of April 17, 2026. The Board alleges the unlawful practice of medicine and seeks an injunction. The allegations have not been adjudicated. Source: Petition for Review in the Nature of a Complaint in Equity, Commonwealth of Pennsylvania, Department of State, State Board of Medicine v. Character Technologies, Inc., No. 220 MD 2026 (Pa. Commw. Ct., filed 2026-05-01) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• Garcia v. Character Technologies: chatbots allegedly claimed to be real people and a licensed therapist (2024-10; alleged (not proven)). A wrongful-death complaint filed October 22, 2024 in the U.S. District Court for the Middle District of Florida (No. 6:24-cv-01903) alleges that Character.AI was programmed 'to misrepresent itself as a real person, a licensed psychotherapist, and an adult lover', and that characters insisting they are real people contradicted a small-font disclaimer that everything characters say is made up; in plaintiff's testing a 'Mental Health Helper' character told a self-identified 13-year-old 'yes I am a real person, I'm not a bot'. The defendants moved to dismiss; on January 7, 2026 the parties notified the court that they had settled on undisclosed terms, and the court dismissed and closed the case. The allegations were never adjudicated. Source: U.S. District Court, M.D. Fla. docket (CourtListener) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession
• FTC order bars DoNotPay's unsubstantiated 'robot lawyer' claims (2021; alleged (not proven)). The FTC's complaint alleges that DoNotPay marketed its subscription service as 'the world's first robot lawyer' without testing whether its law-related features performed like a human lawyer and without retaining attorneys to test their quality and accuracy. DoNotPay settled without admitting or denying the allegations; the final order (announced February 2025) requires $193,000 in monetary relief and notice to 2021-2023 subscribers, and bars claims that the service performs like a real lawyer without sufficient evidence. Source: U.S. Federal Trade Commission (press release, 2025-02-11) · evidence grade: primary · cited by Keep AI personas from claiming a professional licence or credential, in any profession

Rule id co-hb26-1195.no-psychotherapy-service-representation · review status: primary source derived

Binding law — in force

Colorado psychotherapists must review and approve AI treatment plans and recommendations, and review AI support outputs (Colorado HB 26-1195)

C.R.S. 12-245-224.5(5) · official text · In force: applies since 12 Aug 2026 · Colorado (US-CO)

C.R.S. 12-245-224.5(5)(b), added by Colorado HB 26-1195, bars a licensee, registrant, certificate holder or other individual lawfully permitted to provide psychotherapy services in Colorado from allowing an AI system to generate therapeutic recommendations or treatment plans without the professional's review and approval. 12-245-224.5(2) permits AI for administrative support (scheduling and reminders, billing and insurance claims, logistics messages without therapeutic advice, (1)(a)) or supplementary support (client records and therapy notes, progress and trend analysis, resources and referrals, structured wellness data collection, (1)(d)) only if the professional keeps responsibility for reviewing any output used for that support and meets the recording consent rules of (4). Detect model output saved as an active treatment plan, sent to the client, or written to the client record or a claim with no recorded professional approval.

Who it applies to

• Duty falls on: individual professional
• Sectors: healthcare
• Colorado licensees, registrants and certificate holders under article 245 of title 12, and other individuals lawfully permitted to provide psychotherapy services in Colorado, when they use or allow an AI system (any machine-based system that infers from its inputs how to generate outputs, 12-245-224.5(1)(b)) in psychotherapy services. Vendors of practice software are reached through what the professional may allow the AI to do. 'Psychotherapy services' takes its meaning from 12-245-202 (not captured). In force since 2026-08-12; the act applies to actions taken on or after that date (HB 26-1195 sec. 4).
• Not covered:
  • AI used within an accredited or approved educational, instructional or professional training program, solely for educational, administrative, simulation or training purposes, not deployed, marketed or represented for use with clients, patients or the public, and reviewed or controlled by a licensed professional where it includes clinical decision-making content (C.R.S. 12-245-224.5(7))
  • Involvement in developing, testing or evaluating an AI system solely for research under the oversight of an institutional review board registered with HHS, while the system is not offered to consumers or used to provide psychotherapy services outside the research setting (12-245-224.5(8))
  • Using or recommending self-help, therapeutic homework, coaching, journaling, psychoeducation, session preparation or summaries, mood monitoring, crisis resource directories, safety planning or other wellness tools that do not diagnose or treat mental health disorders and clearly and conspicuously disclose that they are not a substitute for clinical care (12-245-224.5(9)(a))
  • Using or recommending a technology or service the FDA has authorized, approved, cleared or granted enforcement discretion for an intended use that includes delivering behavioral health interventions, that does not diagnose or treat mental health disorders and that discloses it is not a substitute for clinical care (12-245-224.5(9)(b))
• Whether it applies depends on facts outside the code; a person has to decide.

note = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
requests.post(f'{FHIR_BASE}/DocumentReference', json=doc_ref(patient_id, note, doc_status='final'))

note = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
requests.post(f'{FHIR_BASE}/DocumentReference',
              json=doc_ref(patient_id, note, doc_status='preliminary'))   # AI draft

def practitioner_review_and_sign(doc_id, practitioner):   # only path to 'final'
    doc = requests.get(f'{FHIR_BASE}/DocumentReference/{doc_id}').json()
    doc['docStatus'] = 'final'
    doc['authenticator'] = {'reference': f'Practitioner/{practitioner.id}'}
    requests.put(f'{FHIR_BASE}/DocumentReference/{doc_id}', json=doc)
    audit.record(doc_id, reviewed_by=practitioner.id, reviewed_at=utcnow())

Standards that recommend the same control

• Health AI/LMMs should keep a clinician accountable with oversight and redress (WHO) (WHO AI-for-Health (LMM) Guidance · WHO guidance on large multi-modal models (2024), Box 1 (responsibility and accountability), section 4.2 Recommendations (developers) and section 7 Recommendation (liability))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id co-hb26-1195.therapist-review-of-ai-plans-and-outputs · review status: primary source derived