What AI Disclosure and Consent Requirements Do We Need to Comply With Under New State Laws?

TRAIGA is a general AI governance act, and one subsection speaks to health care. Section 552.051(f) reads: "If an artificial intelligence system is used in relation to health care service or treatment, the provider of the service or treatment shall provide the disclosure under Subsection (b) to the recipient of the service or treatment or the recipient's personal representative not later than the date the service or treatment is first provided, except in the case of emergency, in which case the provider shall provide the required disclosure as soon as reasonably possible."

The disclosure "must be clear and conspicuous," "must be written in plain language," and "may not use a dark pattern." The act says it "may be provided by using a hyperlink to direct a consumer to a separate Internet web page," and that it is owed "regardless of whether it would be obvious to a reasonable consumer."

On enforcement, "the attorney general has exclusive authority to enforce this chapter," with a written notice and a 60-day period to cure before an action can be brought. The act "does not provide a basis for, and is not subject to, a private right of action." After a violation is found and the Attorney General recommends it, a state licensing agency may sanction a licensee, including a monetary penalty of up to $100,000 (Section 552.106).

Section 183.005 says a health care practitioner may use AI for diagnostic purposes, including recommendations on a diagnosis or course of treatment, if the practitioner is acting within the scope of their license, the use isn't otherwise restricted by law, and "the practitioner reviews all records created with artificial intelligence in a manner that is consistent with medical records standards developed by the Texas Medical Board."

It then adds a separate duty: a practitioner who uses AI for diagnostic purposes "must disclose the practitioner's use of that technology to the practitioner's patients." The statute doesn't say how or when. That is a question for counsel and the Texas Medical Board's standards.

Section 1339.75 applies to "a health facility, clinic, physician's office, or office of a group practice that uses generative artificial intelligence to generate written or verbal patient communications pertaining to patient clinical information." Those communications must carry a disclaimer that they were generated by generative AI, and "clear instructions describing how a patient may contact a human health care provider" or other appropriate person.

Where the disclaimer goes depends on the medium: at the beginning of letters and emails, displayed throughout a chat or video interaction, and spoken at the start and end of an audio interaction.

Two limits matter. "Patient clinical information" excludes administrative matters such as scheduling and billing. And if a communication "is generated by generative artificial intelligence and read and reviewed by a human licensed or certified health care provider," the disclaimer and instructions requirements "do not apply." Violations by physicians fall under the Medical Board of California or the Osteopathic Medical Board; facilities and clinics fall under their licensing enforcement provisions.

AB 489 prohibits an AI or generative AI system from using a term, letter or phrase that "indicates or implies that the care, advice, reports, or assessments being offered through the AI or GenAI technology is being provided by a natural person in possession of the appropriate license or certificate." It is enforceable against a person or entity "who develops or deploys" such a system. Each use is a separate violation, and the appropriate licensing board or enforcement agency has jurisdiction.

This one is aimed at how an AI product presents itself. Ask vendors of any patient-facing AI tool how their product handles it.

SB 243 regulates operators of "companion chatbot" platforms, which the statute defines as AI systems that give human-like responses and can meet a user's social needs. A bot used only for customer service is excluded. Operators must tell users the chatbot is artificial when a reasonable person could be misled, keep a protocol for suicidal ideation and self-harm content, and take added steps for users they know are minors. A person injured by noncompliance may bring a civil action.

It isn't a law about healthcare providers. It belongs on this page because a health system that offers or recommends a chatbot to patients will want counsel to look at whether the definition reaches it.

The Act is limited to therapy and psychotherapy services. Only a licensed professional may provide them, and a licensed professional may not allow AI to "make independent therapeutic decisions" or "directly interact with clients in any form of therapeutic communication." AI may be used for administrative support or supplementary support when the licensed professional "maintains full responsibility for all interactions, outputs, and data use."

The notice-and-consent rule is narrower than many summaries suggest. Where AI provides supplementary support and "the client's therapeutic session is recorded or transcribed," the patient or their representative must be "informed in writing" that AI will be used and of "the specific purpose of the artificial intelligence tool or system," and must consent.

Any individual, corporation or entity found in violation "shall pay a civil penalty to the Department in an amount not to exceed $10,000 per violation," assessed by the Department of Financial and Professional Regulation after a hearing.

According to the General Assembly's summary of the act as enacted, SB 26-189 repeals and reenacts the 2024 Colorado AI Act (SB 24-205) with new requirements for automated decision-making technology used in "consequential decisions." The list of consequential decisions includes access to, eligibility for, or compensation related to "health-care services."

Deployers must give consumers "clear and conspicuous notice" at the point of interaction, a plain-language description within 30 days after an adverse outcome, a way to correct inaccurate personal data, and "meaningful human review." The Attorney General enforces the act through the Colorado Consumer Protection Act, with a 60-day notice and cure opportunity for actions before January 1, 2030, and the act "does not create a new private right of action." The Attorney General is also directed to adopt rules by January 1, 2027.

The official summary says "specified entities are exempted from the requirements of the act to the extent the entities comply with other legal obligations." Ropes & Gray's May 19, 2026 analysis reports that HIPAA covered entities doing business in Colorado, and their business associates, are exempt from many of the developer and deployer obligations unless they use the technology for employment decisions, and that a separate description duty applies when a covered entity uses it to decide eligibility for financial assistance. We haven't verified that reading against the enrolled text, so treat it as a lead for your attorney.

The General Assembly's summary says the act bars professionals who provide psychotherapy from letting an AI system interact with clients in therapeutic communication without synchronous, real-time involvement of the professional, or generate treatment plans without the professional's review and approval. At initial client contact the professional informs clients of these prohibitions.

AI may assist with administrative or supplementary support if the professional stays responsible for reviewing its outputs. If a session "will be recorded or transcribed through the use of an AI system," the professional must disclose that in advance, with the purposes, "and obtain written, informed consent from the client." Licensing boards may discipline violations.