Every quarter, a new category of behavioral health AI lands in your inbox: ambient session capture, predictive risk stratification, automated measurement-based care, group therapy tooling, clinician-burnout early-warning dashboards, payer-side clinical AI, remote therapeutic monitoring billed under CPT 98975, 98980, and 98981. Some will be standard infrastructure by 2028. Some will end careers. The expensive problem is that the vendor decks for both look identical, and the operator who cannot tell the difference either misses the retention tool that would have kept three clinicians from quitting, or pilots the risk-prediction tool that puts an algorithmic suicide score into a chart no clinician reviewed. By the end of this lesson you will run a disciplined frontier scan of the 2026 to 2028 landscape, sort every emerging application into clinically defensible, conditionally defensible, or not defensible, and produce a one-page Frontier Scan Decision Sheet your leadership can vote on.

The Harbor Master, Not the Treasure Hunter

Hold one analogy through this lesson: the operator scanning the AI frontier is a harbor master, not a treasure hunter. The treasure hunter sails toward every rumor of gold; the behavioral health version is the clinical director who signs a pilot agreement at a conference booth because the demo was impressive. The harbor master does something different. Ships arrive constantly: some carry cargo the port needs, some carry contraband, some carry disease. The job is not to be excited about ships. It is to inspect every vessel against a fixed protocol before anything comes ashore: what is the cargo, who certified it, what happens to the port if the manifest is wrong. The harbor master who waves a ship through because the captain gave a good speech loses the harbor.

The fixed protocol matters because the volume is about to overwhelm informal judgment. In earlier levels you learned to evaluate the tools that already exist: ambient scribes (Mentalyc, Eleos Health, Upheal, Twofold, Heidi), measurement-based care platforms (Blueprint Health, Greenspace, Owl), EHR-native assistants (SimplePractice with Sidekick, TherapyNotes AI). What arrives between 2026 and 2028 is a second wave that does not fit the scribe-shaped evaluation, because it touches clinical judgment itself: tools that claim to predict who will deteriorate, to monitor alliance inside a group, to tell a payer which clients no longer need care. The harbor master needs a protocol that works on cargo nobody has seen.

Picture the meeting where this becomes real. Jordan, who runs a 25-clinician group practice in Sacramento with a working AI governance committee, gets three vendor approaches in one month: an RTM platform promising new revenue under CPT 98980, a "burnout early-warning" dashboard that analyzes clinician documentation patterns, and a payer-affiliated analytics company offering to "align utilization review with outcomes data." All three decks cite peer-reviewed-sounding evidence. All three offer pilots. Without a frontier scan protocol, the loudest vendor wins. With one, Jordan's committee sorts all three in an hour and documents why.

The 2026-2028 Frontier: Seven Categories Worth Scanning

A useful scan starts with a complete map. Seven categories define the 2026-2028 frontier.

One: ambient session capture. The most mature category. Audio is captured with consent, transcribed, and drafted into a progress note the clinician reviews and signs. The clinical decision remains entirely human; the evaluation playbook from earlier levels applies directly: BAA, consent addendum, retention policy, pre-signature review.

Two: predictive risk stratification. Models that ingest documentation, assessment scores, attendance patterns, and sometimes language features to flag clients at elevated risk of suicide, dropout, or deterioration. This category sits closest to the line that must never be crossed: AI never scores the CSSRS, never assigns a risk level, never substitutes for the clinician's risk determination. A defensible deployment surfaces a prompt ("this client's PHQ-9 item 9 has been nonzero for three administrations; review at next session") for a clinician to evaluate. A non-defensible one generates a risk score that drives action without clinician review.

Three: automated measurement-based care. Automated administration and arithmetic scoring of client-completed instruments like the PHQ-9 and GAD-7, trend dashboards, and alerts when trajectories stall, billed in part under CPT 96127 where covered. Largely defensible because the scoring is arithmetic, not inference, provided the clinician interprets the trend and acts on it.

Four: AI-supported group therapy tooling. Tools that summarize group sessions, track member participation, or flag dynamics for the facilitator. High consent complexity: every group member must consent to capture, one refusal changes the architecture for the room, and group notes that identify other members create disclosure problems. Conditionally defensible at best, and only with a consent design built for groups.

Five: clinician-burnout early-warning. Dashboards that analyze documentation timeliness, after-hours EHR activity, and caseload composition to flag clinicians at risk of burnout or departure. The subject is your workforce, not your clients, which changes the ethics: this is employee monitoring, requiring the same transparency you would demand for clients, plus a written commitment that the data drives support, never discipline.

Six: payer-side clinical AI. Utilization-review algorithms, concurrent-review automation, and outcomes-based authorization models deployed by the payer, not by you. You rarely choose these tools, but you must scan them because they shape your documentation requirements and denial patterns, and a payer algorithm denying care based on predicted recovery is a parity fight you need to see coming.

Seven: remote therapeutic monitoring (RTM). The category with an actual reimbursement pathway. CPT 98975 covers initial setup and patient education for an RTM device or software; CPT 98980 and 98981 cover monthly treatment management: 98980 for the first 20 minutes of clinician time reviewing RTM data and interacting with the client in a calendar month, 98981 for each additional 20 minutes. The adjacent remote physiologic monitoring family (99454 for device supply and transmission, 99457 and 99458 for management time) follows the same logic on the physiologic side. RTM matters because it is the rare category where an emerging AI-adjacent workflow arrives with billing codes attached, which means vendors will push it hard, and the operator must verify the time, the data review, and the clinician interaction actually occurred as billed. A 98980 claim without 20 documented minutes of review is a recoupment letter waiting to be printed.

The Defensibility Screen: Three Questions Before Any Pilot Conversation

The inspection protocol reduces to three questions, asked in order.

Question one: where does the tool sit relative to the clinical decision? Draw a line from "purely administrative" to "makes or shapes a clinical determination." Transcription sits at the administrative end. A note draft sits one step in, still defensible because the clinician reads and signs. A deterioration-risk score sits at the far end. The rule you have carried since Level 1 holds at the frontier without exception: AI never scores the CSSRS, never assigns a risk level, never makes the Tarasoff or duty-to-protect determination (in California, duty to protect under Civ Code §43.92), never makes the mandated-report call. Any frontier tool whose value proposition requires crossing that line is not defensible, no matter how good the validation study looks. Many "predictive" products are only commercially interesting because they promise to replace clinician attention in risk assessment, which is exactly what your license, your ethics code, and your malpractice carrier prohibit.

Question two: what is the evidence, and was it generated on a population like yours? The frontier is full of validation studies run on insured, English-speaking, mild-to-moderate outpatient populations, then sold to CCBHCs serving clients with serious mental illness, housing instability, and 42 CFR Part 2 protected SUD records. Ask for the validation population, the false-positive and false-negative rates in deployment (not the lab), and whether any deployment survived a payer audit or board complaint. A vendor who cannot answer has a demo, not evidence; the next lesson is devoted to why that distinction decides everything.

Question three: what breaks if the tool is wrong? For a scribe, a wrong output is a bad draft a clinician catches before signing. For a burnout dashboard, a misallocated check-in conversation. For a risk-stratification model, either a missed deterioration (a client harmed and a chart showing your organization had a tool that was supposed to catch it) or a false-alarm cascade that trains clinicians to ignore alerts. This question is where most frontier tools fail, because the vendor has priced the upside and left you holding the downside.

On the AI frontier, the question is never "what can this tool do?" It is "what happens to a specific client, and to a specific license, on the day this tool is wrong?"

Sorting the Seven Categories Through the Screen

Run the seven categories through the three questions and a map emerges you can defend anywhere.

Clinically defensible now, with the standard controls: ambient session capture with consent, BAA, and pre-signature review; automated MBC administration and arithmetic scoring with clinician interpretation; RTM under 98975/98980/98981 where the data is client-generated, the clinician personally performs and documents the management time, and the billing matches the minutes. These tools sit on the administrative side of the clinical decision and their failure modes are catchable by an attentive clinician.

Conditionally defensible, pilot only with extraordinary controls: predictive risk stratification deployed strictly as a clinician-attention prompt, never as a score in the chart, never as an automated action trigger, with a written protocol that every flag is reviewed by a licensed clinician who makes and documents their own determination; group therapy tooling, only after a group-specific consent architecture is built; burnout early-warning, only with full workforce transparency and a written support-not-discipline commitment. The default vendor configuration is usually not the defensible configuration, and that gap is where pilots earn their keep.

Not defensible, decline regardless of evidence: any tool that scores or assigns suicide risk autonomously; any tool that makes duty-to-protect, mandated-reporting, or IPV-risk determinations; any tool that writes unreviewed clinical conclusions into a chart; any payer-side arrangement that feeds your clinical data into an algorithm used to deny your own clients' care without a contestable medical-necessity process. The screen does not bend for accuracy claims, because the question-three failure modes here are unsurvivable: the chart entry is the exhibit, and the clinician who delegated the determination has no defense any ethics code recognizes.

Notice what this does for Jordan's triage. The RTM vendor goes to "defensible, verify the billing integrity" and earns a pilot conversation. The burnout dashboard goes to "conditional" with a workforce-transparency requirement before anyone sees a demo. The payer analytics offer goes to "not defensible as proposed" with a written rationale. Three decisions, all defensible in writing.

Reading the Regulatory Weather

The harbor master also reads the weather, and the regulatory weather for 2026 to 2028 is not neutral. The Illinois WOPR Act and Nevada AB 406 drew a statutory line: AI does not provide therapy, does not make therapeutic decisions, and the licensed human remains the clinical actor. New York's AI companion law put disclosure and crisis-referral duties on conversational AI. Colorado's SB 24-205, on the SB 26-189 dual track, treats high-risk AI systems touching health decisions as a regulated category with developer and deployer duties. All of it tells you which way the wind blows: toward regulating exactly the categories this lesson marks conditional or non-defensible.

That reading changes the scan practically: a tool that is conditionally defensible today may become a compliance liability mid-contract when a state adopts the next WOPR-style statute. The Decision Sheet should record not just today's verdict but the regulatory exposure: which statute family touches this category, and what contract language lets you exit if the law moves. A three-year agreement for a risk-stratification tool, signed in a state with an active AI-in-healthcare bill, without a regulatory-change termination clause, is a treasure hunter's contract.

The same reading applies to reimbursement. RTM codes exist, but payer adoption of 98980/98981 for behavioral use cases varies by payer and by state Medicaid program, and a scan that assumes universal reimbursement is a revenue projection built on fog. Verify coverage with your top three payers before any RTM pilot is scoped, and treat vendor reimbursement claims as marketing until your billing manager confirms them against the actual provider manuals.

Who Runs the Scan, and How Often

A frontier scan is a standing function, not an annual offsite. The structure that works is small and boring on purpose: a three-person scan group (a clinical leader who carries the ethics codes, a compliance lead who carries the contracts and BAAs, and a working clinician who carries the caseload reality), meeting monthly for one hour, with a standing intake form any clinician or vendor approach feeds into. The output is one Decision Sheet per evaluated application, filed where the governance committee and the malpractice-renewal questionnaire can both find it.

The working clinician seat is not decorative. The most reliable early signal that a frontier category is real is that your own clinicians start using something without asking, the way associates adopted free-tier scribes years before policies existed. The scan group's quarterly question to the workforce is simple: "What tools have you tried, heard about, or been pitched in the last ninety days?" The answers route the scan toward what is actually arriving at the harbor.

Cadence discipline matters more than brilliance. A monthly scan that sorts two applications per session covers a frontier this size, and it produces a paper trail: when the carrier questionnaire asks how AI tools are evaluated, the answer is a dated stack of Decision Sheets, not a shrug. The scan is itself a defensibility artifact.

The Vendor Meeting: What the Harbor Master Actually Asks

Frontier vendors are skilled at controlling the meeting, so the scan group walks in with its own script. Six questions sort most vendors in thirty minutes.

First: "Show me where, in your product, a clinical determination is made, and show me the human who makes it." Watch for the answer that gestures at "human in the loop" without showing the loop. Second: "Describe your validation population: payer mix, acuity, diagnoses, languages. How does it compare to a caseload with SMI, SUD records under 42 CFR Part 2, and Medicaid managed care?" Third: "What are your false-positive and false-negative rates in live deployment, and what did your customers do about them?" Fourth: "Will you sign a BAA at the tier we are buying, and who is on your subprocessor list?" The subprocessor list is where BAAs quietly die; on the frontier it is also where training-data rights hide. Fifth: "Has any deployment of this product been examined in a payer audit, a board complaint, or litigation, and what happened?" Sixth: "What does your contract say about our exit: data return, model-output deletion, and termination if the regulatory environment changes?"

A strong vendor answers all six without flinching and earns a place on the pilot pipeline you will build in the next lesson. A weak vendor answers question one with accuracy statistics and question five with "nothing like that has ever happened," which usually means nothing like a real caseload has ever happened either. Either way, the answers go on the Decision Sheet verbatim.

The Applied Problem: Build the Frontier Scan Decision Sheet

Your artifact is the Frontier Scan Decision Sheet: a one-page template your scan group completes for every emerging application, producing a dated, signed, filed verdict. Build it now, then complete it once.

Step one: the header fields. Application name and vendor; frontier category (one of the seven); date of scan; the three scan-group members present. Step two: the defensibility screen, as three labeled blocks. Block A, position relative to the clinical decision: one sentence stating which decisions the tool touches and which human makes each one, plus a checkbox row for the hard exclusions (scores CSSRS or assigns risk level; makes duty-to-protect or mandated-report determinations; writes unreviewed clinical conclusions into the chart; any "yes" ends the evaluation at Not Defensible). Block B, evidence: validation population, deployment-grade error rates, audit or complaint history, each marked obtained/refused. Block C, failure mode: one paragraph answering "what happens to a specific client and a specific license on the day this tool is wrong," written by the working clinician, not the vendor.

Step three: the verdict and conditions. Three checkboxes: Clinically Defensible (proceed to pilot scoping), Conditionally Defensible (list the named controls required first, such as "deployed as clinician-attention prompt only, no score written to chart"), Not Defensible (one-sentence rationale citing the failed screen question). Below the verdict: regulatory weather notes (which statute family touches this category, whether the contract needs an exit clause) and reimbursement verification for any billing claim (for RTM: payer-by-payer confirmation of 98975/98980/98981 coverage, marked verified or unverified).

Step four: the verification pass. Complete the sheet against the RTM vendor from Jordan's triage. Done looks like this: every field has an entry, the hard-exclusion row shows three "no" answers, the evidence block records what the vendor actually produced rather than what the deck claimed, the failure-mode paragraph names a concrete scenario (an RTM alert missed for three weeks; a 98980 claim with 12 documented minutes), and all three scan-group members have signed and dated it. File it in the governance binder. The day a carrier, an auditor, or a board asks how your organization decides what AI comes ashore, this sheet is the answer.

Key Takeaways

• The 2026-2028 frontier has seven scannable categories: ambient session capture, predictive risk stratification, automated MBC, group therapy support, clinician-burnout early-warning, payer-side clinical AI, and RTM under CPT 98975/98980/98981 (with 99454/99457/99458 on the physiologic side). Distance from the clinical decision is the master variable.
• Be the harbor master, not the treasure hunter: every emerging application passes a fixed three-question screen. Where does it sit relative to the clinical decision, what is the evidence and on whose population, and what breaks when the tool is wrong.
• The hard exclusions hold at the frontier without exception: AI never scores the CSSRS, never assigns a risk level, never makes the duty-to-protect determination (in California, duty to protect under Civ Code §43.92), never makes the mandated-report call. Any tool whose value depends on crossing that line is not defensible regardless of accuracy claims.
• RTM is the rare frontier category with real billing codes: 98975 for setup and education, 98980 for the first 20 minutes of monthly clinician management time, 98981 for each additional 20. Attractive and audit-exposed at once: the minutes must exist as billed, and payer coverage must be verified before any pilot is scoped.
• Read the regulatory weather: IL WOPR, NV AB 406, the NY AI companion law, and Colorado's SB 24-205/SB 26-189 dual track all point toward tighter regulation of the categories marked conditional or non-defensible. Record regulatory exposure on every Decision Sheet and demand a regulatory-change termination clause.
• The scan is a standing monthly function run by a three-person group (clinical leader, compliance lead, working clinician), fed by a quarterly workforce question, producing one signed Decision Sheet per evaluated application.
• The Decision Sheet, not the demo, is the artifact your organization will be judged on. A dated stack of completed sheets answers the carrier's questionnaire, the auditor's inquiry, and the board's question about why a tool was adopted or declined.