56% of psychologists use AI. Write the one-page policy

If your psychology group has eight clinicians, the American Psychological Association's latest Practitioner Pulse Survey implies four or five of them used an AI tool for work in the past year, and about two are using it for note-taking, whether or not you have approved anything. That is arithmetic on a national average (APA, 2025 Practitioner Pulse Survey, released December 2025), not a headcount of your own team. But it points at the decision you are probably already living with: AI is in your practice, and the only open question is whether it arrived with a policy or without one.

What the numbers say about your clinicians

The APA surveyed 1,742 psychologists, with responses closing in September 2025. Of those, 56% had used AI tools for work in the past 12 months, up from 29% in 2024, and 29% used them at least monthly, up from 11% (APA Practitioner Pulse Survey, December 2025, via the APA's release on EurekAlert). Nearly all of the use is administrative: 52% for writing emails and materials, 32% for summarizing notes or articles, and 22% for note-taking. Only 8% used AI to assist with diagnosis and 5% for chatbot-style patient support (same survey).

Psychologists are not relaxed about it. In the same survey, 67% worried about data breaches (up from 59% in 2024) and 60% worried about inaccurate outputs, or hallucinations (up from 44%) (APA, December 2025). A caveat on the data: the survey's completion rate was 6.6%, so respondents skew toward people with a view on the topic. Treat the figures as direction, not census.

So what this means for you: your clinicians are almost certainly ahead of your paperwork. The fear is data leaving the building, and a written policy is the cheapest way to answer it before a client asks.

What the Division 29 report gives you, and what it leaves out

In September 2026 the Society for the Advancement of Psychotherapy (APA Division 29) published a report from its AI and Psychotherapy Work Group, chaired by Stewart Cooper, PhD, covering practice, supervision, training and research. It sets out six principles: AI augments rather than replaces humans, accountability stays human, output needs critical evaluation, implementation must be ethical and safe, human relationships stay central, and governance is continuous. It then boils down to four practices for individual psychologists: reason independently before consulting a model, verify what it produces, protect confidentiality in data handling, and review AI-assisted documentation before it enters a record (Society for the Advancement of Psychotherapy, September 2026).

Two details matter for a practice director. The report states that any tool touching protected health information carries HIPAA and HITECH obligations, including a signed business associate agreement, and that clients are entitled to meaningful disclosure and a genuine opportunity to decline. It also warns supervisors that AI notes can over-emphasize symptoms while under-documenting interventions. Those are usable rules.

What the report does not do is tell you what to write. By its own statement it is neither APA policy nor a practice guideline (Society for the Advancement of Psychotherapy, September 2026). It offers no consent wording, no approved-tool checklist and nothing on state law. The APA's June 2025 ethical guidance for AI in health service psychology sits alongside it as a further reference. Principles do not survive a busy Tuesday afternoon; a one-page policy does.

So what this means for you: treat the report as the reasoning and your own policy as the artifact. If a licensing board or an insurer ever asks what you told your clinicians, "we read the Division 29 report" is not an answer, and a dated policy is.

The law sits underneath the principles

Two facts explain why the consent line in your policy matters more than it looks. First, a business associate agreement satisfies HIPAA but does not settle state recording law. In Washington et al. v. Sutter Health (N.D. Cal., filed April 8, 2026), patients allege an ambient scribe recorded clinical conversations without informed consent, under the California Invasion of Privacy Act and the federal Wiretap Act. The complaint does not allege a HIPAA violation, and the vendor held a BAA with its health-system clients (court filing, via Northeastern University School of Law and HIPAA Journal summaries; these are allegations, not findings). California's all-party consent rule carries statutory damages of $5,000 per violation without proof of harm (California Penal Code sections 632 and 637.2). Our wiretap-risk explainer walks through the mechanics.

Second, states are starting to write psychotherapy-specific AI rules. Colorado's HB 26-1195, effective August 12, 2026, requires a regulated professional to give clients written information about its AI restrictions at initial contact, whether or not the practice uses AI. It defines valid consent as clear, explicit, written and revocable, and it expressly rules out a general terms-of-use document with an AI paragraph tucked inside (Colorado General Assembly, enrolled bill text, read directly). It also bars AI-generated treatment plans without clinician review. We break the statute down in our Colorado explainer. If you telehealth into more than one state, the strictest rule you touch is the one that matters. None of this is legal advice; have counsel or your state board confirm what applies to you.

So what this means for you: a consent clause buried in your intake packet is the single most likely thing to fail, in Colorado on its face and anywhere else on a bad day. Pull it out into its own form.

The one-page policy

Six short paragraphs cover it. Each maps to a Division 29 practice or a legal point above, and none needs a lawyer to draft a first version, though a lawyer should read the finished page.

1. Approved tools. A named list: each tool, what it is approved for, whether a BAA is on file, and where the data lives. Anything not on the list gets no client information, ever. That includes free accounts on general chatbots.

2. BAA first. No tool touches a client record until the agreement is signed. Ask each vendor whether recordings or transcripts are stored, for how long, and whether your data trains their models. Get the answers in writing.

3. Separate consent. A standalone, revocable, written consent for any AI tool that hears or reads session content, kept apart from intake terms. Declining must not change how the client is treated. Where you record audio, confirm the all-party consent rules for the state the client sits in.

4. Review before filing. The clinician who saw the client reads and edits every AI-assisted note before it enters the record. Check specifically that interventions are documented, not only symptoms.

5. Judgment stays human. No AI-generated diagnosis, risk assessment or treatment plan goes into a record without the clinician's own reasoning first. Only 8% of psychologists were using AI for diagnosis support in the APA survey; your policy can keep it that way.

6. Owner and review date. One named person owns the policy, reviews it every quarter, and keeps a short incident log of hallucinated content, misfiled data or client objections. The quarterly cadence is our recommendation, not a regulatory requirement.

So what this means for you: the page is short on purpose. A policy clinicians can recall from memory gets followed. The Division 29 practices give it the ethical spine; the six paragraphs make it enforceable. For the treatment-plan piece specifically, see our look at AI treatment planning in psychology practices.

The call

The evidence points toward writing the policy before you buy or approve another AI tool, not after. With 56% adoption among surveyed psychologists, and most of that use being email and summaries, the risk sits in the gap between what clinicians do and what you have written down. Frankly, if you are a director with a group of any size and no written AI policy, the sensible first move is a one-hour meeting with your clinicians to find out what they already use, then a draft policy the following week. Ask vendors for their BAA and data-retention terms before any demo.

If you would rather have an independent read on which tools fit your practice and which carry more risk than reward, the AI Opportunity and Growth Assessment scores exactly that, and you can start with a free 20-minute discovery call.

Related: Colorado's AI psychotherapy law, explained · Why one AI compliance policy fails across states · Medicare's LCD wants 6 things in your plan