What AI Disclosure and Consent Requirements Do We Need to Comply With Under New State Laws?

TRAIGA applies to healthcare providers broadly. The law uses the term to capture the range of licensed and certified healthcare practitioners and entities operating in Texas. This means hospital systems, physician practices, behavioral health providers, and other healthcare organizations operating in Texas are subject to the disclosure requirements. The specific trigger is AI use in patient care interactions. If your organization uses AI in a context that interacts with or affects the care of Texas patients, the disclosure requirements apply. The emergency exception is the primary carve-out: disclosure requirements are suspended in emergency situations where obtaining disclosure before care would delay necessary treatment. Routine clinical encounters, patient communications, and AI-assisted workflows don't qualify for the emergency exception.

TRAIGA requires disclosure that is clear and conspicuous, meaning it must be presented in a way that a reasonable patient would notice and understand. Disclosure buried in a general consent form that patients sign on admission alongside dozens of other provisions is unlikely to meet this standard. The disclosure needs to be specific to AI use and presented in a context where the patient can understand it before or at the time of the AI interaction. For patient-facing AI tools, this may mean an explicit disclosure screen or statement when the patient first interacts with the AI system. For AI tools that affect care but aren't directly patient-facing, the disclosure approach may differ, but the standard of clarity and conspicuousness still applies.

Yes, if your organization uses the EHR's generative AI features for clinical communications and those communications reach patients. AB 3030's obligations run to the healthcare provider (your organization), not just to the AI vendor or tool developer. If your organization sends patients AI-generated after-visit summaries, AI-generated care instructions, or AI-generated responses to patient portal messages, those communications need to include the AB 3030 disclaimer regardless of whether the AI is a third-party tool, an EHR-native feature, or something your organization built internally. Work with your EHR vendor to understand which features qualify as generative AI under AB 3030's definition and whether the vendor's default outputs include the required disclaimers.

The approach CHIME recommends, and which the evidence supports, is to build your compliance program around the most stringent applicable requirements rather than managing separate standards per state. Identify which states you operate in, identify the disclosure requirements in each, and build your policies and patient-facing forms to satisfy the strictest applicable standard. A unified intake notification explaining AI use in clinical settings, written in plain language and reviewed by a patient or their representative, addresses the core disclosure requirements in Texas, California, and Illinois, and positions your organization for Colorado's requirements taking effect January 1, 2027. Point-of-interaction disclosures need to be built into specific AI workflows. The advantage of the unified approach is that it scales as more states enact requirements and it produces consistency in the patient experience across your system.

Partially, but the compliance obligation is yours. Vendors can build disclosure language into their patient-facing products, and many are doing so in response to state law requirements. But your organization's obligation to ensure disclosure happens doesn't transfer to the vendor through a contract provision. You need to verify that the vendor's disclosure mechanisms actually satisfy the requirements of each state you operate in, that the disclosures are being delivered as required, and that you have documentation of the disclosure practices. Relying entirely on vendor implementations without verifying them creates compliance risk. Build your own disclosure verification into your AI governance and vendor management processes.

The penalty structures vary by state and by law. Texas TRAIGA's non-compliance creates exposure to state licensing action (which for a healthcare organization means potential license consequences affecting the ability to operate) and to legal action under Texas consumer protection statutes. California's laws are enforced through state professional licensing boards for the professional credentials provisions, and through the Attorney General and local prosecutors for some consumer protection provisions. Illinois HB 1806 has enforcement mechanisms tied to professional licensing for the practitioners involved. The enforcement architecture suggests that the primary risk for organizations is regulatory action affecting operations and licenses, in addition to civil liability exposure in individual patient claims that allege violation of the disclosure requirements contributed to harm. The Texas AG's demonstrated willingness to pursue AI-related enforcement action against vendors is a data point that suggests enforcement appetite at the state level is real.