Colorado, Nevada, Illinois and Utah put four different AI duty sets on the same PSYPACT session. One compliance policy covering all four is the myth, not the inconsistency itself.

"Our AI note-taking and consent policy already works in Colorado. Once it's written down, it covers us everywhere we're licensed to practice." That's the assumption a multi-state psychology group reaches for the moment a clinician asks to add a second, third or fourth PSYPACT state to the telehealth roster. It sounds reasonable. PSYPACT's entire point is that one authorization, the E.Passport and APIT combination issued through the Association of State and Provincial Psychology Boards, lets a licensed psychologist see clients across 43 participating jurisdictions without a separate license in each one (PSYPACT Commission, psypact.gov, checked September 2026). Licensure travels. The AI rules governing the session do not, and that gap is exactly where a single group-wide policy quietly stops covering you.

Licensure travels under PSYPACT. The AI rules attached to the session don't.

PSYPACT's compact rules only override state law on the interjurisdictional practice of telepsychology itself, the license question. For everything else, informed consent, scope of practice, mandated reporting and AI-specific restrictions, the psychologist follows the law of the "receiving state," where the client is physically located during the session, not where the practice is headquartered or the clinician holds a home license (analysis corroborated across PSYPACT-focused legal guidance, checked September 2026). A group PSYPACT-authorized across Colorado, Nevada, Illinois and Utah isn't running one compliance environment. It's running four, decided session by session by where the client is sitting.

So what this means for you: a policy that satisfies your home state doesn't travel with the license. It has to be checked against wherever the client is, every time.

Four different regulatory models, not just four different fines

The gap isn't only in penalty size. Each state has built a genuinely different kind of rule around AI and therapy.

Colorado's HB 26-1195, in force since 12:01am on 12 August 2026, is a supervised-permission model. It doesn't ban AI from therapeutic communication outright; it bars that communication only when there's no synchronous, real-time interaction between clinician, AI system and client, and requires clinician review and approval of any AI-generated treatment plan. Administrative and supplementary support, including AI-assisted documentation and progress tracking, is explicitly permitted (Colorado General Assembly, enrolled bill text HB 26-1195, sections 12-245-224.5(1) and (5)). The statute also carries a sleeper provision unrelated to whether a practice uses AI at all: every client must receive written notice of the AI restrictions at their first contact with the practice, regardless of whether AI is used in their care (HB 26-1195, section 12-245-224.5(6)(b)).

Nevada's AB 406, in effect since 1 July 2025, takes a flatter approach. It prohibits mental and behavioral healthcare providers from using AI systems in connection with providing care directly to a patient, and separately bars anyone from representing that an AI system can provide that care. General-purpose chatbots and wellness apps not operated by a licensed provider stay outside the law's reach (Wilson Sonsini, client alert, 2025).

Illinois's Wellness and Oversight for Psychological Resources Act, signed by Governor Pritzker on 4 August 2025, is built the same way as Nevada's, a prohibition rather than a permission structure. It bars AI from providing mental health therapy or making clinical decisions, while still allowing AI for administrative and supplementary tasks under a licensed professional's supervision (Illinois Department of Financial and Professional Regulation, news release, 2025).

Utah's HB 452, in effect since 7 May 2025, isn't a scope-of-practice law at all. It regulates "mental health chatbot" suppliers directly: clear AI disclosure before first use, after seven days without access, and whenever asked, plus restrictions on selling or sharing a user's identifiable health information and on undisclosed paid product placement inside a chatbot conversation (Wilson Sonsini and Sheppard Mullin, client alerts, 2025).

So what this means for you: a policy written to satisfy Colorado's real-time-supervision test doesn't automatically satisfy Nevada or Illinois's outright bar on the same AI feature, and none of those three clinician-facing rules will trip Utah's chatbot-disclosure duty, which sits in a completely different part of that state's statute book.

What the myth gets right

Concede the real part of it. All four states permit administrative and supplementary AI use: scheduling, billing, non-therapeutic communications, and AI-assisted documentation with clinician review. None bans an AI scribe that drafts a note for a clinician to read, edit and sign off. Assuming AI is heavily regulated in psychotherapy everywhere you operate is correct. The mistake is assuming heavy regulation means the same regulation.

So what this means for you: the compliance floor is higher, and more consistent, than the confusing detail at the top suggests. Most of what a group already does with AI (scheduling, billing, reviewed documentation) is likely fine in all four states. The risk concentrates in the narrower set of features that touch direct client-AI interaction or public-facing chatbot tools.

Build to the strictest line each duty sets, not four separate policies

A multi-state PSYPACT group doesn't need four compliance documents. It needs one policy built to whichever state sets the highest bar on each individual duty, plus a way of knowing which state a given session falls under.

Give every client, in every state, written notice at intake describing what your AI tools do and don't do. Colorado is currently the only state that requires this regardless of AI use, but applying it group-wide costs nothing extra and closes the one duty most likely to be missed by a group assuming "no AI, no obligation."

Require human review and sign-off on every AI output that touches clinical judgment or documentation, in every state, not just Colorado. That single practice satisfies Colorado's review requirement, keeps you clear of Nevada and Illinois's bans on AI delivering care directly, and isn't restricted by Utah's law at all.

Never let a client communicate with an AI system unsupervised. That single rule satisfies Nevada and Illinois's prohibitions outright and means Colorado's synchronous-interaction test never gets tested in the first place.

Tag every session by the state the client is physically in at the time of the appointment, the PSYPACT receiving-state test, not by the clinician's home license. That's the only reliable way to know which of the four rule sets applies to a given hour on the calendar, and it's the detail most likely to get lost as a group adds a fifth or sixth state.

If a tool markets itself as a consumer-facing chatbot rather than a clinician-facing documentation aid, check it against Utah's disclosure and data-sharing rules specifically, the one duty set the other three states don't impose, and easy to miss since it doesn't read like a "therapy AI" law on the vendor's marketing page.

So what this means for you: this turns four separate compliance projects into one written policy and one intake-time state tag, the kind of standardization a small group can build in an afternoon and a larger one can audit in an afternoon too.

Where enforcement actually stands, five weeks in

Colorado's law has now been in force for more than five weeks. A direct check this week found no publicly reported enforcement action, complaint, or DORA interpretive guidance or model notice form since the 12 August effective date. That silence says nothing about the notice-at-initial-contact duty, which applies from day one whether or not a complaint has ever been filed.

So what this means for you: quiet enforcement in the first five weeks is not the same as low risk. Build to the duty as written, not to whatever the first headline case eventually turns out to be.

The call

Don't write a Colorado policy and assume it travels with the PSYPACT license, and don't build four separate state playbooks either. The evidence points toward one written policy set to the strictest version of each duty (universal intake notice, mandatory human review, no unsupervised client-AI contact, session-level state tagging), plus a separate check against Utah's chatbot rules for any consumer-facing tool. That combination covers a group operating across all four states, and most of what the next state to legislate is likely to add.

For a scored, independent read on where your group's AI policy actually stands against each state you practice in, the AI Opportunity and Growth Assessment covers exactly that gap analysis. Start with a free 20-minute discovery call.

See also: what Colorado's law actually restricts, provision by provision, why "our locations are too different" doesn't hold up for psychology groups either, and how record-retention rules follow a similar state-by-state pattern.

Related: Colorado's AI therapy law, provision by provision · The multisite consistency myth in psychology · HIPAA's 6 years isn't your state's clock