A licensed therapist in Chicago starts using an AI scribe in March. She picked a vendor with a BAA, she reads every draft before signing, she even mentions the tool verbally to most clients. In September, a former client files a board complaint that does not mention AI at all; it alleges a billing dispute. But the investigator requests the full record, sees notes referencing "transcription service," finds no written consent line covering it, and the inquiry widens. The billing issue dies quickly. The consent issue does not. Before any federal rule reaches you, two closer authorities already govern your AI use: your state licensing board and your professional ethics code. By the end of this lesson you will be able to cross-walk five state boards (CA BBS, NY OPP, TX BHEC, FL DOH Chapter 491, IL IDFPR) and four ethics codes (APA, NASW, AAMFT, ACA) on AI, recording, and informed consent, and you will build the one-page crosswalk sheet that shows exactly which sections apply to you.

Two Courts, One Consent Line

Hold one controlling analogy for the whole lesson: when something goes wrong with AI in your practice, your conduct gets tried in two courts, and both courts read the same consent line. The first court is your state licensing board, a government agency with statutory power to investigate, discipline, suspend, and revoke your legal permission to practice. The second court is your professional ethics code: APA for psychologists, NASW for social workers, AAMFT for marriage and family therapists, ACA for counselors. The association behind the code can expel you, and that sounds softer until you learn that many state boards incorporate the relevant ethics code into their regulations, so an ethics violation becomes a license violation by reference. The two courts have different procedures, timelines, and remedies, but in an AI complaint they will both open the same exhibit: your informed consent paperwork.

This is why the Chicago story turns the way it does. The investigator was not hunting for AI. Investigators read records, and modern records leave fingerprints: a vendor name in a note footer, a "draft generated" timestamp, an audit log entry, an invoice in discovery. Once the AI use is visible, the investigator asks the only question that matters at this stage: did the client know, and where is that knowledge documented? A verbal mention "to most clients" is, for board purposes, close to nothing. The consent line, one or two sentences in a signed document describing what the tool does with session content, is the difference between "clinician adopted a documentation tool with appropriate disclosure" and "clinician routed confidential session content to a third party without client knowledge." Same tool, same vendor, same notes. The paperwork decides which sentence the investigator writes.

Beginners often assume there is an "AI rule" somewhere to look up. In most states, in 2026, there is not a single tidy rule but a lattice: confidentiality regulations, recording statutes, informed consent requirements, telehealth rules, and supervision regulations, each written before AI scribes existed and each fully capable of reaching them. Your job is not to memorize fifty states. It is to learn how to read your own state and your own code, using five boards and four codes as the worked examples.

The Five Boards: Same Job, Different Buildings

Start with the government court. Licensing is state law, which means the agency that holds your license depends entirely on where you practice, and the agencies are organized differently enough that clinicians moving states routinely look in the wrong building. In California, master's-level clinicians (LMFTs, LCSWs, LPCCs, and their pre-licensed associates) answer to the Board of Behavioral Sciences, the BBS, while psychologists answer to a separate Board of Psychology. The BBS is the board in Maria's life in Oakland and Carmen's life in Fresno: it registers associates, approves supervisors, audits supervised hours, and disciplines licensees. When Carmen's supervisor said "we need to talk about that" after learning Carmen pays for her own AI scribe, the unspoken sentence was: the BBS holds my supervisor approval, your hours, and both our futures, and our supervision agreement says nothing about this tool.

In New York, the structure surprises almost everyone: licensed professions, including psychology, social work, and mental health counseling, are regulated by the State Education Department through its Office of the Professions, the OPP. Misconduct complaints run through that office, not a health department, and New York's unprofessional-conduct definitions, including confidentiality and record-keeping provisions, apply to session content regardless of what technology touched it. In Texas, the Behavioral Health Executive Council, BHEC, houses the member boards for psychologists, social workers, professional counselors, and MFTs: one agency, one complaint portal, four professions. In Florida, clinical social workers, MFTs, and mental health counselors are licensed under Chapter 491 of the Florida Statutes within the Department of Health, commonly shorthanded as the "491 Board." In Illinois, the Department of Financial and Professional Regulation, IDFPR, licenses clinical professions, and Illinois carries a layer no other state on this list has: the 2025 Wellness and Oversight for Psychological Resources Act, the WOPR Act, which drew a statutory line around AI in therapy itself, making the documentation-versus-treatment distinction a legal one, not just an ethical one, for every Illinois clinician.

Notice what is constant and what varies. The job is constant: every board exists to protect the public, not the clinician, and every board disciplines through the same machinery of complaint, investigation, and adjudication. The buildings vary: BBS, OPP, BHEC, the 491 professions, IDFPR. The practical consequence is worth saying plainly: you cannot answer "is my AI use compliant" until you can name your board, find its regulations on confidentiality, recording, and informed consent, and read them as if they were written about your scribe, because the investigator will.

The Four Codes: The Sections That Reach Your Scribe

Now the second court. Each major ethics code has specific numbered sections that an AI scribe walks straight into, and a careful clinician should be able to cite them the way she cites a diagnosis. For psychologists, it is APA Standard 4, Privacy and Confidentiality: take reasonable precautions to protect confidential information, discuss the limits of confidentiality, and limit intrusions on privacy. An AI scribe is, in Standard 4 terms, a planned intrusion you have invited into the room, which makes the "reasonable precautions" and "discuss the limits" language operative before the first session is ever transcribed. For social workers, two NASW standards work as a pair. Standard 1.07, Privacy and Confidentiality, is the long backbone of the code: it governs when you may disclose confidential information, requires informed consent before recording or permitting third-party observation, and obligates you to protect confidentiality in electronic transmission and storage. Standard 1.04, Competence, supplies the half most clinicians forget: you may only practice within your competence, and using a technology you cannot explain to a client well enough to describe its data handling is a competence problem before it is ever a privacy problem.

For marriage and family therapists, AAMFT Standard 1.6 addresses confidentiality, and an MFT has a complication the other professions feel less acutely: the client is often a system, a couple or a family, so an AI scribe in a couples session is processing the confidences of multiple people whose interests may already be adverse, in a custody dispute, a separation, an abuse dynamic. Consent for recording or AI processing in family work is not one signature; it is everyone's signature, and "the husband agreed" does not cover the wife. For counselors, ACA Section H governs distance counseling, technology, and social media, and H.2 specifically addresses informed consent in that context: clients must understand the technology being used, its limitations, and the security of transmitted information. H.2 reads almost as if it anticipated the AI scribe conversation: the counselor's duty is not to avoid technology but to ensure the client's consent to it is informed, which requires the counselor to understand it first.

Read the four together and a pattern emerges that is more useful than any single citation: every code converges on three obligations. Protect the confidentiality of session content wherever it travels. Be competent in any tool you put between yourself and the record. Obtain informed, documented consent before any third party, human or machine, receives session content. The codes differ in numbering and emphasis, not direction, which is good news for the crosswalk you are about to build: you are not reconciling contradictions; you are mapping one set of duties onto four citation systems and five enforcement agencies.

The board can take your license and the code can take your name, but in an AI complaint both courts open the same exhibit first: the consent line. Write it before you need it.

Recording Is the Hinge: Where AI Scribes Actually Enter the Rules

Here is the doctrinal move that makes old rules reach new tools, and it is worth slowing down for. Most AI scribes work from audio: they listen, transcribe, and draft the note. Legally and ethically, the scribe question is therefore first a recording question, and boards and codes have regulated recording for decades, since clinicians began taping sessions for training and supervision in the reel-to-reel era. NASW 1.07 says it directly: informed consent before recording or permitting third-party observation. APA Standard 4's framework on intrusions and limits of confidentiality covers it. ACA's technology provisions cover it. State regulations on confidentiality and client records cover it. None of these texts needed the word "artificial intelligence" to apply, any more than a speed limit needed to mention your car's model year.

This reframing dissolves the most common rationalization in group practice break rooms: "there's no rule about AI yet." There is no rule with AI in the title, perhaps. There are decades-old rules about recording sessions, disclosing third-party access to session content, and obtaining informed consent for both, and an AI scribe triggers all three the moment it starts listening. When Jordan's compliance officer in Sacramento asks whether the twelve clinicians already using a free scribe are exposed, the answer does not wait for an AI statute: undisclosed audio capture and third-party processing of session content is the exposure, today, in every state on our list.

Two refinements complete the picture. First, even text-only AI use, where a clinician types shorthand into a tool that drafts the note without any audio, still routes confidential session content to a third party, so the confidentiality and consent provisions apply even where the recording provisions do not. Second, the consent must be informed, not merely written: a buried clause on page nine of an intake packet satisfies the letter of "written" while failing the spirit of "informed," and ethics committees, unlike some courts, are explicitly in the spirit business.

How a Board Complaint Actually Moves

Demystify the process, because fear of the unknown drives clinicians toward both paralysis and denial. A board complaint begins with a filing: a client, a family member, a colleague, an insurer, sometimes the board itself. The board screens for jurisdiction, and if the filing states a potential violation, an investigator is assigned. The investigator gathers records, and this is the step that decides AI cases: your clinical record, consent documents, policies, and correspondence are requested, and you are typically asked for a written response. The matter then closes, resolves through a consent agreement or citation, or proceeds toward formal discipline, which can mean probation, suspension, or revocation. Discipline is public. It follows you into every credentialing application, every insurance panel, every state you ever apply to practice in, because boards report to national databanks and ask each other.

Now run the AI scribe through that machinery and notice where the risk concentrates: not at the hearing, where few cases arrive, but at the records-gathering step, where the investigator compares what your record shows the technology did with what your consent documents show the client knew. Three documents do almost all the defensive work. The consent line: a clear, signed disclosure of AI-assisted documentation. The BAA or vendor agreement: proof the third party was contractually bound to protect the information. And evidence of clinician review: the cardinal rule of this program is that the clinician signs the note, and the signature is a legal attestation that the contents are accurate, not a formatting step. A clinician who can produce those three things converts an AI question into a non-event. A clinician who cannot has converted a billing dispute into a confidentiality investigation, which is exactly the Chicago story this lesson opened with.

One more structural point for supervisors and associates. In every state on our list, supervision is itself regulated: the BBS approves supervisors and audits hours in California, BHEC's member boards set supervision rules in Texas, and so on. A supervisee's undisclosed AI use is therefore a two-license problem, because the supervisor attests to the quality of the supervisee's documentation. Carmen's $59-per-month scribe, purchased personally and unmentioned in the supervision agreement, is precisely the fact pattern a board audit is built to find. The fix is not secrecy; it is a supervision agreement that names the tool, the consent process, and the review requirement, signed by both parties before the next quarterly form.

Reading Your Own State: A Repeatable Four-Question Method

You will practice in one or two states, not five, so the durable skill is a method you can run on any board's materials in an afternoon. Question one: who is my board, exactly? Name the agency that holds your specific license, not your building-mate's: a California psychologist and a California LCSW have different boards; a New York LMHC files under OPP; a Texas LPC lives under BHEC; a Florida LMFT is a 491 profession; an Illinois LCPC answers to IDFPR. Write the agency name, its complaint process, and the citation for its core confidentiality and record-keeping regulations on your crosswalk sheet. Question two: what do my state's rules say about recording and third-party access to session content? Look for consent requirements, confidentiality provisions, and telehealth or technology regulations, the provisions an AI scribe activates. Question three: does my state have AI-specific law? For Illinois, yes, the WOPR Act, which polices the line between AI as a clinician-controlled administrative tool and AI in the therapy itself; for the other four states, the general rules carry the load, and the absence of an AI-titled statute is not an absence of regulation.

Question four, the one that fuses the two courts: does my board incorporate my ethics code? Many boards adopt the profession's code into their regulations or define unprofessional conduct by reference to it, which means APA Standard 4, NASW 1.07 and 1.04, AAMFT 1.6, or ACA H.2 stops being aspirational guidance and becomes enforceable law for your license. This is the mechanism that makes the "two courts" analogy more than a metaphor: the second court's rulebook is frequently adopted outright by the first. When you answer question four for your own state, you will know whether an ethics-code citation in your consent paperwork is good practice or a regulatory requirement, and either way you will write the consent line the same careful way.

Run this method once, in writing, and date it. Then rerun it annually, because this layer of law is moving: Illinois passed the WOPR Act in 2025, Nevada moved with AB 406, New York enacted an AI companion law, and Colorado built a dual-track framework through SB 24-205 and SB 26-189. None of those changes the method; all of them change the answers, which is why the crosswalk sheet carries a "last verified" date.

What the Codes Demand of the Consent Line Itself

Since both courts read the consent line first, learn what a defensible one contains, element by element. From APA Standard 4 comes the limits-of-confidentiality duty: the line names the category of tool ("an AI-assisted documentation service") and what it receives ("audio and transcript of our sessions" or "my written session summaries," whichever is true). From NASW 1.07 comes the recording-consent duty: if audio is captured, the line says "recorded," not a euphemism. From NASW 1.04 comes the competence duty, shaping the line indirectly: you must understand the tool well enough that every sentence in the disclosure is true, including what happens to audio after the note is signed and whether session content trains the vendor's models. From AAMFT 1.6 comes the multi-client rule: in couples and family work, every adult participant consents, and any participant may decline. From ACA H.2 comes the technology-explanation duty: the tool's limitations and security are described, not just its existence, and the right to decline without penalty is stated.

Assembled, the consent line is three to five sentences, in plain language, in a document the client actually signs, with the decline option visible. The skeleton, subject to your attorney's review: the practice uses an AI-assisted documentation tool; here is what it receives; the clinician reviews and personally signs every note; here is what happens to recordings and transcripts; you may decline and your care will not change. Every clause maps to a code section, which is the whole point of the crosswalk: when the investigator, the ethics committee, or the malpractice carrier's renewal questionnaire asks why your consent says what it says, you answer with citations, not vibes.

The Applied Problem: Build Your Board-and-Code Crosswalk Sheet

Your artifact is the Board-and-Code Crosswalk Sheet: one page that puts the five boards and four codes in front of you, with your own row highlighted. Build a table with five rows for the boards: CA BBS (master's-level clinicians; psychologists under the separate Board of Psychology), NY OPP (Office of the Professions, State Education Department), TX BHEC (the consolidated council over the psychology, social work, counseling, and MFT member boards), FL DOH Chapter 491, IL IDFPR (plus the WOPR Act overlay). Give the table four columns: agency and what it regulates; where its confidentiality, recording, and consent rules live; any AI-specific law; complaint process in one line. Below the table, add four rows for the codes: APA Standard 4 (privacy, confidentiality, limits, intrusions), NASW 1.07 and 1.04 (confidentiality and recording consent; competence with the tools you use), AAMFT 1.6 (confidentiality, with the all-participants rule for couples and family work), ACA H.2 (informed consent for technology, including limitations and security). Final block: your own profile, three lines, naming your board, your code sections, and whether your board incorporates your code.

You may draft the sheet's structure with AI assistance; this is a safe use because no client information is involved. A working prompt: "Create a one-page crosswalk table for a licensed mental health clinician comparing five state regulators (California BBS, New York OPP, Texas BHEC, Florida DOH Chapter 491, Illinois IDFPR) and four ethics code provisions (APA Standard 4, NASW 1.07 and 1.04, AAMFT 1.6, ACA H.2) on three issues: confidentiality of session content, consent for recording, and informed consent for AI-assisted documentation. Leave citation cells blank for me to verify and fill from primary sources." That last sentence is the verification pass built into the prompt: the AI supplies structure, you supply every citation by checking the board's own website and your code's own text, because a crosswalk with an invented citation is worse than no crosswalk; it is documented overconfidence.

"Done" looks like this: one page, every cell filled from a primary source you actually opened, your own row highlighted, a "last verified" date in the corner, and one sentence at the bottom stating which code section and which board regulation your AI consent line answers to. Staple it inside your policy binder, next to the consent addendum you will draft later in this program. When the malpractice renewal questionnaire asks about AI, when a new supervisee asks what the rules are, or when an investigator asks why your paperwork says what it says, this is the page you open first.

Key Takeaways

• Two courts govern your AI use before any federal rule does: your state licensing board, which holds your legal permission to practice, and your professional ethics code, whose violations many boards enforce by incorporation. In an AI complaint, both open the same exhibit: your informed consent paperwork.
• Know your building. California master's-level clinicians answer to the BBS, New York clinicians to the Office of the Professions inside the State Education Department, Texas clinicians to the consolidated BHEC, Florida's 491 professions to the Department of Health, and Illinois clinicians to IDFPR, with the 2025 WOPR Act adding an AI-specific layer in Illinois.
• Four code sections reach the AI scribe directly: APA Standard 4 on privacy, confidentiality, and intrusions; NASW 1.07 on confidentiality and consent before recording, paired with NASW 1.04 on competence; AAMFT 1.6 on confidentiality, with every participant consenting in family work; and ACA H.2 on informed consent for technology.
• The scribe question is first a recording question. Rules written decades before AI, on recording, third-party access, and informed consent, apply the moment a tool starts listening, which is why "there's no AI rule yet" is a rationalization, not an analysis.
• Board complaints are won or lost at the records-gathering step. Three documents do the defensive work: the signed consent line, the vendor agreement or BAA, and evidence of clinician review. The cardinal rule stands: the clinician signs the note, and the signature is a legal attestation, not a formatting step.
• Supervision doubles the exposure. An associate's undisclosed AI use implicates the supervisor's approval and attestations, so the supervision agreement should name the tool, the consent process, and the review requirement before the next quarterly form is signed.
• Your artifact is the Board-and-Code Crosswalk Sheet: five boards, four codes, three issues, every citation verified against a primary source, your own row highlighted, and a "last verified" date, because Illinois, Nevada, New York, and Colorado have already shown this layer of law is moving.