California SB 903 and Mental Health AI: Why Your Practice Needs a Real Compliance Review Now
California Senate Bill 903, the Wellness and Oversight for Psychological Resources Act, has passed both houses of the Legislature and is currently listed as enrolled. If it becomes law, it will create specific guardrails for the use of AI in psychotherapy services. The bill is a clear signal of where behavioral health regulation is headed: meaningful human oversight, clear patient consent, and real accountability for how AI is deployed. If you do not understand this bill fully then you need someone to help you and our consultants are here.
10/5/20265 min read
California SB 903 and Mental Health AI: Why Your Practice Needs a Real Compliance Review Now
Artificial intelligence is moving into behavioral health quickly. It can make documentation faster. It can reduce repetitive administrative work. It can help organizations scale responsibly.
But in California, the question is no longer simply, “Can this AI tool do it?” The question is, “Can we use it this way without placing patients, clinicians, or the organization at risk?”
California Senate Bill 903, the Wellness and Oversight for Psychological Resources Act, has passed both houses of the Legislature and is currently listed as enrolled. If it becomes law, it will create specific guardrails for the use of AI in psychotherapy services. The bill is a clear signal of where behavioral health regulation is headed: meaningful human oversight, clear patient consent, and real accountability for how AI is deployed.
This is not a reason to panic or abandon useful technology. It is a reason to stop treating AI implementation like a software purchase.
What SB 903 means in plain English
SB 903 draws a bright line between AI that supports clinical work and AI that starts acting like the clinician.
The bill allows AI to support administrative and supplementary functions. That can include scheduling, reminders, billing support, workflow support, documentation assistance, organizing referrals, and tracking trends. The licensed professional must still remain responsible for clinical decisions and communications.
The bill also makes clear that a practice cannot casually turn on an AI feature and assume it is compliant. In particular, the proposed requirements address AI used to record or transcribe psychotherapy sessions, screen or triage people for psychotherapy services, communicate therapeutically with clients, generate clinical recommendations, create diagnoses or treatment plans, or detect emotions and mental states.
The rule is simple: the closer the tool gets to clinical judgment or the therapy relationship, the more careful the organization must be.
Consent cannot be buried in the fine print
Under SB 903, if AI is used to record or transcribe psychotherapeutic communications or sessions, or to conduct triage or screening, the patient or authorized representative must be told that AI will be used and the specific purpose for its use. They must then provide consent.
The bill defines consent as clear, explicit, informed, voluntary, and documented. It must also be revocable. A broad terms-of-use agreement is not enough.
That creates immediate operational questions for California practices:
Which workflows use AI?
Is the patient told exactly what the tool does?
Is consent separate from general intake paperwork?
Is the consent documented in the record?
What happens if the patient declines or later revokes consent?
Can the practice still provide care without penalizing the patient?
Those answers cannot live only in someone’s memory. They need to appear in the organization’s workflows, forms, training, configuration decisions, and documentation standards.
AI cannot replace licensed clinical judgment
The bill would prohibit organizations from allowing AI to perform key functions without review and approval by a licensed professional. These include making therapeutic decisions, generating therapeutic recommendations, assessment results, diagnoses, or treatment plans, detecting emotions or mental states, and conducting triage or screening.
It also restricts AI from directly engaging in psychotherapeutic communication with patients unless the system is FDA approved or cleared for that purpose and HIPAA compliant.
This matters because many AI products sound harmless during a sales demonstration. A feature may be called a “care navigator,” “wellness assistant,” “engagement tool,” or “clinical insights engine.” The name does not control the risk. The actual function does.
If the tool is interpreting a patient’s symptoms, directing next steps, identifying urgency, suggesting a clinical intervention, or responding as though it is providing therapy, the organization needs a careful review before putting that tool in front of patients or clinicians.
Your vendor’s assurances are not your compliance program
A vendor may say its product is secure. It may offer a business associate agreement. It may say that clinicians remain in control. Those details matter, but they do not answer every compliance question.
An organization still has to understand how the tool is configured in its own environment. It must know what data the tool receives, what outputs it produces, who reviews those outputs, what happens when the tool is wrong, and whether the workflow matches California requirements.
SB 903 also speaks directly to psychotherapy data. It requires AI use in patient or client records to comply with California confidentiality requirements and prohibits a company or entity from sharing, selling, storing, or training models on psychotherapy data in a manner inconsistent with applicable law.
In other words, “We have AI” is not a policy. “Our vendor says it is HIPAA compliant” is not a full risk assessment. And a generic AI policy copied from the internet is not an implementation plan.
Why an outside AI compliance consultant matters now
Everybody says they understand AI. Very few people understand AI where it becomes operational: inside a behavioral health workflow, inside the patient record, inside a consent process, and inside a clinician’s daily decision-making.
That is where an outside consultant adds value.
A qualified consultant can examine how AI is actually being used across your California practice or organization. The work is not limited to reviewing a policy. It includes looking at your tools, workflows, vendor representations, patient-facing communications, consent process, documentation practices, staff roles, and oversight structure.
The goal is practical: identify where AI is helping, identify where it is creating preventable exposure, and build a clear plan to use it responsibly.
What an AI compliance review can cover
An independent California AI readiness review can help your organization:
Inventory every AI-enabled tool, including features that were switched on by default.
Classify each use case as administrative, supplementary, clinical, patient-facing, or high risk.
Review ambient listening, transcription, screening, triage, chatbots, note support, and clinical recommendation features.
Evaluate consent language and the workflow for obtaining, documenting, and honoring consent.
Review who has clinical oversight and where review and approval must occur.
Assess data handling, vendor contracts, retention practices, and model-training disclosures.
Create staff guidance that tells people what they may do, what they may not do, and when to escalate a question.
Strengthen policies, documentation standards, and implementation guardrails before a complaint, audit, or board inquiry forces the issue.
This kind of review should not be designed to stop innovation. It should give your team a safer path to use the technology you already have and make better decisions about the technology you are considering.
The right question is not “Do we use AI?”
Most behavioral health organizations will use AI in some form. The real question is whether they can explain their use of AI with confidence.
Can you show what the tool does? Can you show who reviews its output? Can you show what patients were told? Can you show how consent is handled? Can you show that a licensed professional remains responsible for clinical judgment?
If the answer is uncertain, now is the time to review it.
Get California AI readiness support
California organizations using AI in behavioral health need more than a template policy and a vendor promise. They need a thoughtful compliance structure that reflects clinical reality.
Our consulting services help behavioral health practices, group practices, digital health companies, and healthcare organizations assess their AI use from the ground up. We can review your workflows, identify areas of risk, strengthen your consent and oversight processes, and help build a practical implementation plan that supports both innovation and patient protection.
Do not wait until a new AI feature creates a clinical, privacy, or licensing problem. Schedule an AI compliance consultation to make sure your organization is using these tools responsibly, clearly, and with the right safeguards in place.
This article is for educational purposes and does not constitute legal advice. SB 903’s final status, effective date, and any implementing guidance should be confirmed before relying on it for legal or compliance decisions.