Law / United States / 
Nevada
AB 406 (2025), licensed provider restriction on direct clinical use of AI
In force since .
An AI sector rules rule binding public and private bodies.
- Criminal exposure
- No
- Enforcement body
- the board, agency or other entity in Nevada by which the provider is licensed or certified
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Prohibition, Governance
- Audit expectation
- continuous
- Who audits it
- Self
What it requires
- If you are a Nevada-licensed provider of mental and behavioral health care, do not use an artificial intelligence system in connection with providing professional mental and behavioral health care directly to a patient.NIST AI RMFMAP 3.3
- You may use an artificial intelligence system only for administrative support tasks such as scheduling, records management, billing, operational data analysis, and organizing session notes.
- Where you use AI for administrative support, ensure the use complies with Health Insurance Portability and Accountability Act (HIPAA), HITECH, and Nevada's own health-information privacy statutes (NRS 439.581 to 439.597).NIST AI RMFMEASURE 2.10
- Independently review the accuracy of any report, data or other information an AI system compiles, summarizes, analyzes or generates for those administrative purposes.NIST AI RMFMAP 3.5
- A violation is treated as unprofessional conduct, subject to disciplinary action by your licensing board rather than a civil fine.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 3.3Targeted application scope is specified and documented based on the system’s capability, established context, and AI system categorization.
- MAP 3.5Processes for human oversight are defined, assessed, and documented in accordance with organizational policies from the GOVERN function.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
- NIST AI 600-1
- GAI-RISK-07Human-AI Configuration
- GAI-RISK-08Information Integrity
- GAI-RISK-11Obscene, Degrading, and/or Abusive Content
- NIST AI 200-2 Draft
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI09Human-Agent Trust Exploitation
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.1.2-1Business need and security risks written down and assessed before deciding to build an AI system.
- 5.1.4-1Capability for human oversight designed in and maintained.
- 5.1.4-5End-users told which uses of the system are prohibited.
- 5.2.1-1Full inventory of assets, including their dependencies and connections.
- 5.2.4-1Developers keep an audit trail of system design and post-deployment maintenance plans and offer it downstream.
- 5.4.2-1Operators log system and user actions.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
What it makes you log
What the log must hold
Output reference, Human involvement
Logging duty
Subsection 4 requires the provider to independently review the accuracy of any report, data, or other information an artificial intelligence system compiles, summarizes, analyzes, or generates for billing or for organizing session notes. The clause never uses the words logs, records, event recording, or audit trail, but a licensing board enforcing subsection 5's disciplinary consequence for a violation of this section could not tell whether the review happened without something documenting it.
- Kind
- Implicit
- As of
- Provision
- Nev. Rev. Stat. 629.610(4)
- Trigger
- personal_data_processing
What this law does
A Nevada-licensed provider of mental and behavioral health care (psychiatrists, psychologists, licensed social workers, psychiatric nurses, marriage and family therapists, and certain counselors) may not use an artificial intelligence system in connection with providing professional mental and behavioral health care directly to a patient, except that the provider may use AI for administrative support such as scheduling, records management, billing, operational data analysis, and organizing session notes, subject to compliance with federal and Nevada health-privacy law and to the provider's own independent review of any AI-generated report or data.
A provider who violates this section is guilty of unprofessional conduct and subject to disciplinary action by the licensing board, agency or other entity that licenses or certifies the provider.
When LexLint raises it
When your app profile says your app deploys a chatbot or makes health care decisions.
Back to the example · Lint your app
Page updated .