AI Therapy Laws: Illinois vs Nevada vs Utah

No, not as a class. Illinois is the sharpest test because it has the broadest prohibition, and Section 35 of the Wellness and Oversight for Psychological Resources Act expressly excludes three categories that do not purport to offer therapy or psychotherapy: religious counseling by faith leaders, peer support grounded in lived experience rather than clinical training, and publicly available self-help and educational materials. An app that offers generalised content such as guided meditations, breathing exercises or mood tracking, and that does not simulate a therapeutic relationship, is not what the Act reaches. Nevada works the same way from the other direction: its prohibition attaches to systems programmed to provide services constituting the practice of professional mental or behavioral health care, and to representations that a system can provide such care. Utah is narrowest of all, because the obligations only attach once a product meets the definition of a mental health chatbot, meaning it holds interactive conversations similar to the confidential communications a person would have with a licensed therapist. The risk for a wellness product is therefore not the category label it gives itself but the behaviour of the model in a hard conversation. A meditation app whose chatbot starts responding to a disclosure of suicidal ideation with something that looks like clinical assessment has moved across the line in Illinois and Nevada regardless of what the app store listing says.

No, and all three states preserve this use, but Illinois and Nevada each attach a condition worth building around. Illinois permits administrative support such as scheduling, billing and insurance processing, and supplementary support such as maintaining records and analysing anonymised data, provided the licensed professional retains clinical responsibility and the AI is not the source of a treatment recommendation or plan that goes unreviewed. Illinois also requires written informed consent before an AI tool is used on a recorded or transcribed session, and that consent must describe the specific tool and its purpose, which is a documentation requirement most ambient scribe deployments do not satisfy by default. Nevada permits administrative support tasks including scheduling, records, operational analysis and managing notes, but where AI manages billing or notes from patient sessions the provider must independently review the output for accuracy, which makes a sign-off step a legal requirement rather than a quality preference. Utah does not regulate this at all, because a documentation tool is not holding a therapeutic conversation with a user and so is not a mental health chatbot. The Illinois emotion-detection prohibition is the one to watch: a scribe that also scores affect, flags sentiment or generates a risk rating from a session recording is doing something Illinois has separately prohibited, even though the transcription itself is permitted.

In practice, all of the ones whose residents can reach the product, which is why this group of statutes is harder to comply with than any one of them suggests. Utah applies to Utah users, Nevada frames its prohibition around offering such a system in Nevada, and Illinois bars providing, advertising or otherwise offering therapy or psychotherapy services to the public without a licensed professional conducting them, with advertising specifically named. A national operator that reads only the Utah statute and ships a disclosure banner has not addressed the Illinois or Nevada exposure, because those states are not asking whether the user was misled. They are asking whether the system is doing work reserved to a licensed professional, and an accurate disclosure is not a defence to that. The workable options are geographic segmentation of features, a design that keeps the model demonstrably outside therapeutic communication everywhere, or a licensed-professional-in-the-loop architecture. Each is a real product decision with real cost, and choosing between them is the actual compliance question rather than the drafting of a consent screen. This is also the point at which the group of statutes stops being a legal review item and becomes an architecture item, because two of the three cannot be satisfied by anything that happens in the user interface.

Because the two models make incompatible demands on the same product, and the penalty ceilings are the least significant difference between them. Utah at 2,500 dollars per violation, Illinois at 10,000 and Nevada at 15,000 all describe per-violation exposure that scales with user count rather than a fixed cap, so none of the three is cheap at volume. The structural difference is what compliance consists of. Under the disclosure model, compliance is a feature: the chatbot says what it is, the data does not get sold, the advertising is labelled, and Utah even offers an affirmative defense to a supplier that files a written policy with the Division of Consumer Protection and follows it. Under the prohibition model, compliance is a limit on capability: the system is either permitted to do the work or it is not, no amount of transparency changes the answer, and neither Illinois nor Nevada offers a safe harbour to document your way into. A team that treats these three statutes as three intensities of the same rule will build for the most expensive one and still be unlawful in the other two.

Through scope, not through mental health. NIKOLAI is CASRAI's own independent frontier-AI-safety dictionary, and the element that applies here is Deployment Surface on the N1 track, Actors, models and scope, which is defined as the product, API or channel through which a model becomes accessible, held deliberately separate from deployment type. These three statutes are a clean illustration of why that separation earns its keep. The same underlying model is lawful behind a licensed clinician in Illinois, lawful as a disclosed consumer chatbot in Utah, and unlawful as a direct-to-user therapy product in Nevada. The legal answer tracks the surface, not the weights. A safety framework that records only that a model is deployed externally cannot express that distinction, and a compliance team reading such a framework cannot tell which of these three obligations it has triggered. Deployment Surface carries the status Proposed in NIKOLAI, and the crosswalk rows on it are shadow mappings, meaning CASRAI's own reading of published material. No lab, evaluator or regulator named in a crosswalk row has endorsed, reviewed or been consulted on it. An organisation changes that only by filing a Mapping Declaration.

It puts a state-law question upstream of the human-subjects analysis, and that ordering is the part institutions get wrong. An IRB reviewing a digital mental-health intervention study, or a university counselling centre piloting a triage chatbot, is used to asking whether risks are minimised, whether consent is adequate and whether the study design is sound. None of those questions reaches the issue these statutes raise, which is whether the intervention may lawfully be delivered at all in the state where the participants are. A protocol that is approvable in Utah, where a disclosed mental health chatbot is lawful subject to data and advertising limits, may be unlawful to run in Illinois or Nevada, where the same chatbot is offering services reserved to a licensed professional. IRB approval does not cure that, and a convened board has no authority to authorise conduct a state has prohibited. The practical implications are concrete. Multi-site studies need a site-by-site legal screen before the science is reviewed, not after. Recruitment that crosses state lines can pull a lawful protocol into a prohibiting jurisdiction without anyone amending the study. Illinois requires written informed consent describing the specific AI tool and its purpose before AI handles a recorded or transcribed session, which is a consent-document requirement, not a discretionary one. And a campus counselling service piloting a triage bot is squarely in scope in both prohibition states, including the Nevada provision on school counselors, psychologists and social workers where the institution operates a school setting. Research security and sponsored programs offices should also note that a subaward moving a digital mental-health study to a partner institution moves it into that partner's state law.