Illinois HB 1806 AI Therapy Law: Checklist for Small Teams

Source: Illinois General Assembly, Public Act 104-0054 (enrolled HB 1806), page 6, cropped by us on November 10, 2026.

Picture two small teams on the same Monday. One is a five-person startup whose "AI mood coach" app has a few hundred users in Illinois. The other is a two-clinician counseling practice that turned on an AI notes feature that records sessions. That is our illustration, not a case. The startup has to ask whether it is offering therapy. The practice has to ask whether its clients were told in writing and said yes. Illinois law answers both questions, in different sections.

The law is HB 1806, the Wellness and Oversight for Psychological Resources Act, Public Act 104-0054. The bill status page lists "Governor Approved" on 8/01/2025 and "Effective Date August 1, 2025." I read the 8-page enrolled text and each compiled section. It is short: nine sections, and two of them (15 and 20) do the work.

What the dates tell you

Section 99 reads: "This Act takes effect upon becoming law." I did not have to derive the effective date, because the bill status page and the compiled statute both give it as August 1, 2025. Two things are my derivation, and I mark them:

• My derivation: by the day this post goes up, the Act has been in force for about 15 months.
• My derivation: the compiled text of every section I read (5, 10, 15, 20, 25, 30, 35 and 99) carries only the source line "P.A. 104-54, eff. 8-1-25.", so I found no later amendment as of November 10, 2026.

The vote was not close. The House passed it 105-0-0 and the Senate 56-0-0, according to the bill status page. The IDFPR press release of August 4, 2025 says it "was unanimously passed in each chamber of the Illinois General Assembly."

Section 20: the ban does not need AI

The ban in Section 20(a) is one sentence: "An individual, corporation, or entity may not provide, advertise, or otherwise offer therapy or psychotherapy services, including through the use of Internet-based artificial intelligence, to the public in this State unless the therapy or psychotherapy services are conducted by an individual who is a licensed professional."

Read it as a rule about offering therapy. AI is named as one way of offering it. An unlicensed human who advertises therapy is inside the same sentence. The IDFPR release summarizes the Act as one that "prohibits anyone from using AI to provide mental health and therapeutic decision-making, while allowing the use of AI for administrative and supplementary support services for licensed behavioral health professionals." That is a paraphrase, and for a product team the difference matters: the question is not whether you use a model, it is whether you "offer therapy or psychotherapy services."

Section 10 defines those services as "services provided to diagnose, treat, or improve an individual's mental health or behavioral health," and says they do not include "religious counseling or peer support." Two details in that definition are worth checking against your marketing copy. The verb is "improve", not "address." And the definition has no "through therapeutic communication" limiter. Maine's final law has both, and I come back to that below.

The Act does not define "artificial intelligence" itself. Section 10 says it "has the meaning given to that term in Section 2-101 of the Illinois Human Rights Act." That section reads: "'Artificial intelligence' means a machine-based system that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments." The next sentence adds that it "includes generative artificial intelligence." Section 20(a) does not depend on that definition, since it bans offering therapy by anyone who is not a licensed professional.

Where does your product sit?

Table is ours. The third column quotes or paraphrases the Act; the fourth is the desk's reading and not an IDFPR position.

The exception sentence in full is Section 35(3): "self-help materials and educational resources that are available to the public and do not purport to offer therapy or psychotherapy services." Sections 35(1) and (2) cover religious counseling and peer support.

Three voices describe the middle row differently from one another:

• Rep. Bob Morgan, the House sponsor, said in the August 4, 2025 IDFPR release: "Illinoisans will still have access to many helpful, therapeutic relaxation and calming apps, but we are going to put a stop to those trying to prey on our most vulnerable in need of true mental health services." That is a statement about intent. It is not in the Act.
• NASW-IL's release, dated 8/1/2025, says "wellness apps that only provide generalized content (e.g., meditations, mood trackers) and do not simulate a therapeutic relationship are exempt from regulation." The phrase "simulate a therapeutic relationship" does not appear in the Act. It is the chapter's gloss on Section 35(3).
• IDFPR Secretary Mario Treto Jr. said in the same release: "The people of Illinois deserve quality healthcare from real, qualified professionals and not computer programs that pull information from all corners of the internet to generate responses that harm patients." That is the Department's framing of why the Act exists, and it is not a test for any product.

None of the three is the test. The test is the words "purport to offer therapy," and your product page is the evidence.

Section 15: the clause a clinic operates

Source: Illinois General Assembly, Public Act 104-0054, page 5, with the last word from the top of page 6, cropped by us on November 10, 2026.

Section 15(a) lets a licensed professional use AI tools "to assist in providing administrative support or supplementary support in therapy or psychotherapy services" as long as the professional "maintains full responsibility for all interactions, outputs, and data use associated with the system." Section 10 defines supplementary support to include "preparing and maintaining client records, including therapy notes" as its first listed example. A notes tool is that.

Section 15(b) then sets the condition: no licensed professional may use AI for supplementary support "where the client's therapeutic session is recorded or transcribed unless" two things are true. The patient or the patient's legally authorized representative "is informed in writing" of (A) "that artificial intelligence will be used" and (B) "the specific purpose of the artificial intelligence tool or system that will be used." And that person "provides consent to the use of artificial intelligence."

The bill history shows how narrow this ended up. House Amendment 2 changed the trigger from "administrative or supplementary support" to "supplementary support" only. So the written notice is for recorded or transcribed sessions that feed supplementary tasks, and scheduling or billing AI does not need it.

Source: Illinois General Assembly, Public Act 104-0054, page 2, cropped by us on November 10, 2026.

What counts as consent

The Act defines "consent" as "a clear, explicit affirmative act by an individual" that communicates the individual's "express, freely given, informed, voluntary, specific, and unambiguous written agreement, including a written agreement provided by electronic means," and is "revocable by the individual." Three things are excluded by name. Consent "does not include an agreement that is obtained by the following:"

1. "the acceptance of a general or broad terms of use agreement or a similar document that contains descriptions of artificial intelligence along with other unrelated information;"
2. "an individual hovering over, muting, pausing, or closing a given piece of digital content; or"
3. "an agreement obtained through the use of deceptive actions."

Our reading: a clause inside an intake packet's general terms does not do the job, because the definition excludes general terms of use that describe artificial intelligence alongside other unrelated information. A separate written form that names the AI use is the safer shape, but the Act does not prescribe a form. Electronic delivery is allowed by the definition.

SimplePractice's guide of August 22, 2025 includes a sample form for its own notes feature, and is a useful model of how a vendor reads the law. Two points differ from the text. The guide says clinicians "must first obtain explicit signed consent from the client", and the Act asks for a written agreement that may be electronic, with no signature requirement in the sentences I read. And the sample lists purposes the practice "may use AI now and in the future", where Section 15(b)(1)(B) asks for "the specific purpose of the artificial intelligence tool or system that will be used." A list of six purposes is wider than one tool's purpose. That is my reading, and no board has addressed it. Treat the vendor's form as a starting point to edit.

Section 20(b): four things AI may not do

Source: Illinois General Assembly, Public Act 104-0054, page 7, cropped by us on November 10, 2026.

Section 20(b) says: "A licensed professional may use artificial intelligence only to the extent the use meets the requirements of Section 15. A licensed professional may not allow artificial intelligence to do any of the following:"

Table is ours; the middle column is quoted from Section 20(b).

Item (4) is the one to read twice. House Amendment 1 added it, and Maine's list of prohibitions has no equivalent: I read Maine's subsection 4 on the Revisor's page and it stops at three. Our reading: a notes product with a "client sentiment" panel may be a clinical-use problem under item (4) even if the notice and consent are perfect. I found no IDFPR guidance on that.

Who enforces, and what it costs

Section 30(a) says anyone "found in violation of this Act shall pay a civil penalty to the Department in an amount not to exceed $10,000 per violation, as determined by the Department, with penalties assessed based on the degree of harm and the circumstances of the violation." The penalty is assessed "after a hearing is held in accordance with Section 2105-100 of the Department of Professional Regulation Law of the Civil Administrative Code of Illinois." The violator "shall pay the civil penalty within 60 days after the date of an order by the Department imposing the civil penalty." The order "shall constitute a judgment and may be filed and executed in the same manner as any judgment from a court of record." Section 30(b) gives the Department "authority to investigate any actual, alleged, or suspected violation of this Act." "The Department" is the Department of Financial and Professional Regulation, as Section 10 defines it.

The press release puts it as "All confirmed violations will result in a fine of up to $10,000 to IDFPR." The Act adds that the amount is set by degree of harm and circumstances. I found no sentence in the nine sections that creates a private claim. That is a statement about this Act only, not about other Illinois consumer law.

Illinois against Maine

Maine's LD 2082 covers the same ground. The final Maine law, which I cover in the Maine post, differs from Illinois in these ways:

Table is ours, built from the two statutes. Maine's no-denial and storage items are in 32 MRSA 2113 on the Maine Revisor's page.

The practical reading: a Maine-style three-item notice contains both Illinois items. The reverse is not true.

What I would do this month

1. List every tool that records, transcribes or analyzes a session, and every client-facing chat or app, including features switched on by a vendor update.
2. For each client-facing product, write down whether any page, ad or onboarding screen says it treats, helps heal or improves mental health. Rewrite claims you cannot stand behind, or accept that you are offering therapy.
3. For each notes tool, decide the Section 15(b) trigger: does it record or transcribe the session? If yes, put a dedicated written notice and consent in place before the next session.
4. Remove the consent from general terms of use. Make it a separate form, easy to withdraw.
5. Turn off sentiment, mood or risk scoring in clinical sessions, or document that no AI is detecting emotions or mental states.
6. Add a logged clinician approval step for any AI-drafted plan or recommendation.
7. Ask the vendor three questions and keep the answers: where session data is stored, whether it trains a model, and when it is deleted. Illinois does not require you to put these in the notice. I would, because consent has to be "informed," and one notice is cheaper than two versions if you also treat clients in Maine.
8. Check your own state's licensing board before copying any of this. Section 20(a) applies to services offered "to the public in this State."

A notice you can adapt

This is our own draft, not statutory text, not reviewed by a lawyer, and not approved by IDFPR. It tracks the two items in Section 15(b)(1) and adds the revocation and storage lines I would include.

AI use in your sessions

1. AI will be used. [Practice name] uses an artificial intelligence
   tool to [record / transcribe] your therapy sessions.
2. Specific purpose. The tool is [tool name]. It is used only to
   [produce a draft progress note for your therapist to review].
   It does not give you advice and does not make treatment decisions.
3. Your data. Recordings and transcripts are stored at [where],
   kept for [period], never used to train a model [or: used as
   follows], and deleted [when].
4. Your choice. Saying yes is optional. You can withdraw at any
   time by telling [contact]. If you withdraw, we will stop using
   the tool for your sessions.

[ ] I agree to the use of AI described above.
Name / date (electronic submission is allowed by the Act's
definition of consent)

My take

The headline says Illinois banned AI therapy. The text says something wider for sellers and narrower for clinics. Section 20(a) is a rule about what you offer and advertise, so the control that matters for a small product team is not a model setting but the copy on your landing page. For a clinic, Section 15(b) is a notice and a consent tied to one event, a recorded or transcribed session. A team that treats the first as a legal-review task and the second as an intake form will have the work in the right places.

What I could not confirm

• Whether IDFPR has adopted rules, issued guidance or brought any case under the Act. I read the news release page and the statute; I did not search enforcement records.
• How "per violation" is counted: per user, per session or per day. The text does not say.
• Whether a physician who provides therapy is inside Section 20(a). Section 10 excludes "a physician" from "licensed professional," and the bill history says House Amendment 2 removed licensed physicians from that definition. My reading of the two together is that a physician is outside the Section 15 consent duty. I could not find an IDFPR reading of what that means for Section 20(a).
• Whether Section 20(a) reaches an out-of-state vendor with Illinois users. The text says "to the public in this State" and nothing more.
• Whether a mood tracker or wellness app falls inside Section 35(3). The result depends on how IDFPR reads "purport to offer," and I found no guidance.
• Whether a scripted chatbot that infers nothing from its input counts as "artificial intelligence" under the Human Rights Act definition. I did not test it, and Section 20(a) would not turn on the answer.
• How the Section 2105-100 hearing works for an entity that holds no license. I read the cross-reference, not a case.
• Court decisions. I did not look for any.
• Law-firm commentary. I did not read any, so I cannot say how counsel advise on the open points above.
• The data-handling statements in vendor forms, including SimplePractice's. I read them and did not test them.

Related Reading

• Maine LD 2082: AI Therapy Ban and AI Notes Consent Rules
• Utah Mental Health Chatbot Law (HB 452): Checklist
• Rhode Island AI Therapy Chatbot Laws: What Applies to You
• California AB 1979: Health Chatbots and the CMIA
• State Chatbot Disclosure Laws for SaaS Teams (2026)
• HIPAA AI Vendor BAA Requirements (2026)