Law / United States / 
Colorado
HB 26-1195 (2026), Psychotherapy Artificial Intelligence Restrictions
Also known as Psychotherapy Artificial Intelligence Restrictions.
Colo. HB 26-1195, 2026 Colo. Sess. Laws ch. 358
In force since .
An AI sector rules rule binding private bodies.
- Obligation class
- Prohibition, Disclosure, Consent
As of .
What it requires
- Do not allow an AI system to interact with a client in any form of therapeutic communication unless the regulated professional, the AI system and the client interact synchronously in real time, and do not let it generate therapeutic recommendations or treatment plans without the professional's review and approvalNIST AI RMFMAP 3.5
- Do not use an AI system to provide, direct or guide psychotherapy, clinical intervention, counseling, diagnosis or treatment planning except for educational, administrative, simulation, training or research purposes or as the act allowsNIST AI RMFMAP 3.3
- At initial client contact, inform clients of the prohibitions on the use of AI systems in the practice of psychotherapyNIST AI RMFMEASURE 2.8
- If a client's therapeutic session will be recorded or transcribed through an AI system, disclose the use and its purposes in advance and obtain the client's written, informed consentNIST AI RMFMAP 1.6
- Do not use a term, letter or phrase in your AI system that implies its outputs are provided by, endorsed by or equivalent to services of a regulated professional, that represents that the system provides psychotherapy services, or that represents that user data is confidential in a way that suggests therapist-client confidentialityNIST AI RMFMAP 3.3
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
- NIST AI 600-1
- GAI-RISK-04Data Privacy
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- MIT mitigations Draft
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
- 5.1.3-2Threats developers cannot resolve are passed to operators and on to end-users.
- 5.1.4-5End-users told which uses of the system are prohibited.
- 5.3.1-1Users told where and how their data is used, accessed and stored, with developers informing operators.
- 5.3.1-2.1That guidance covers proper use, limits and likely failure modes.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
Who enforces it
Enforcement body
The appropriate licensing board in the Department of Regulatory Agencies may discipline a regulated professional who violates the act.
What this law does
HB 26-1195 took effect on as Chapter 358 of the 2026 Colorado session laws. The Governor signed it on .
It prohibits a regulated psychotherapy professional from allowing an AI system to interact with clients in any form of therapeutic communication without synchronous, real-time interaction between the professional, the AI system, and the client, or from letting the system generate therapeutic recommendations or treatment plans without the professional's review and approval. A professional must inform clients of these prohibitions at initial client contact.
If a session will be recorded or transcribed through an AI system, the professional must disclose that use in advance and obtain written, informed consent.
The act also makes it an unfair or deceptive trade practice under the Colorado Consumer Protection Act for any person to use a term in the use of an AI system that implies its outputs are provided or endorsed by a regulated professional, that represents that the system provides psychotherapy services, or that suggests therapist-client confidentiality. A regulated professional who violates the act may be disciplined by the appropriate licensing board.
When LexLint raises it
When your app profile says your app deploys a chatbot or makes health care decisions.