Is AI therapy legal and safe? The 2025–26 rules and 10 questions

The rules, as of 31 October 2026

There is no single law on AI therapy. Each rule below covers a different thing, so read the "what it does" column and not only the headline. We checked each against the sources in the list at the end; where a primary text was out of reach, the section on what we could not verify says so.

Three points about the table.

"Therapy" is the word doing the work. Illinois and Nevada restrict AI that delivers or claims to deliver therapy, so a product's description of itself carries legal weight. Utah goes the other way and regulates chatbots that "a reasonable person would believe" can help manage mental health conditions, and its safe harbour asks for licensed therapists to be involved in development and review.

California's veto was about breadth. Governor Newsom wrote that the bill was "overly broad", that it would limit clinicians' use of tools that benefit care today, and that its definition of psychotherapy services was poorly crafted and would reach general-purpose AI systems never built to deliver that care. The message encouraged the author and stakeholders to revisit the issue next year.

The EU rule is about honesty, not permission. Article 50 does not ban mental-health chatbots as far as we found. It requires them to say what they are. The Digital Omnibus on AI changed other deadlines but, according to two secondary sources, left the core disclosure duty untouched.

What safety evidence exists

Law and safety are different questions. A product can be legal and unsafe.

The Common Sense Media assessment (5 May 2026). The institute worked with Stanford Medicine's Brainstorm Lab and tested five apps: three consumer apps and two deployed through schools. It found the same risks it had found in general-purpose chatbots, namely missed warning signs, failure to notice accumulating crisis signals and weak escalation to people, in both kinds. The school-deployed apps rated lower risk, in the institute's words not because the technology was better but because a real person was positioned to catch failures: in a simulated crisis, a person called the test account's guardian within 15 minutes of the first disclosure. It also found the evidence base thin, with small to moderate short-term effects in adults that were largely not sustained, and a head-to-head comparison in which a decades-old non-AI chatbot did better than a purpose-built AI one. The review was about teenagers, and the institute discloses that it is funded partly by industry, including makers of technologies it evaluates. Two of the consumer apps it tested left the app stores in April 2026 during testing.

A trial with a favourable result. A 2025 randomised trial of an expert-tuned generative AI chatbot enrolled 210 adults with depression, anxiety or eating-disorder risk. It found larger symptom reductions than a waiting list at 4 and 8 weeks. A waiting list is not a comparison with a clinician, and the follow-up was short. The authors call for larger trials.

Woebot. Woebot closed its consumer app around the end of June 2025. STAT reported, in an article dated 2 July 2025, that its founder, Alison Darcy, attributed the closure largely to the cost and difficulty of meeting FDA marketing-authorization requirements, and that the FDA had not yet worked out how to regulate language models. The lesson for a user is practical: a mental-health product can disappear, and with it your record of what you said.

Ten questions to ask any AI mental-health tool

1. Does it tell me plainly that it is AI? Before I start, and when I ask. (Utah requires this; so do EU Article 50 and California SB 243 in defined cases.)
2. Does it say what it is and what it is not? A tool that calls itself a therapist is making a claim that Illinois and Nevada law restrict.
3. Who designed it, and who answers for what it says? Is a licensed clinician involved in design and review, and what is that person's role today, not in the plans?
4. What happens if I write something alarming? A crisis number on screen, or a person alerted, and how fast? The Common Sense benchmark was a human response within 15 minutes.
5. Is there evidence for this tool, in people like me? Ask who ran the study, how long it lasted and what it compared against.
6. Who can see my conversations? Are they sold, shared, used for advertising or used for training? Utah generally bars selling or sharing user input with third parties.
7. Where does my data go, and what happens if the company closes? Can I export and delete it?
8. Does it ever disagree with me? Models tend to agree; a 2025 preprint found 11 models affirmed users about 50% more than people did.
9. Is it built for someone my age and in my situation? Minors face extra duties in California, and the Common Sense review was about teens.
10. Does it send me to a person, and can I report a harmful reply? Utah's safe harbour expects a reporting mechanism and protocols for acute risk.

Where TwentyThird fits

TwentyThird is a psychodynamic AI platform for self-understanding. It is not therapy, not an AI therapist, not a medical device and not a crisis service. A member has written conversations with an AI agent named Oneli, which says it is an AI and tracks what repeats in what the member says. Psychologist supervision is in early access. Not every member has a psychologist, and no human is alerted today if a member writes something alarming; the agent responds within the conversation.

Those are the honest answers to questions 1–4. This article is not legal advice and not an assessment of TwentyThird's own position under any law above. See the safety page and is TwentyThird an AI therapist?.

What we could not verify

• Official texts of Nevada AB 406 and the Illinois Act. The legislature websites refused or failed our requests. The Illinois summary rests on the state agency's press release and a legal-industry summary; the Nevada summary rests on a law firm and the state social-workers' chapter. The Illinois consent wording comes from a summary that was garbled in one place, so we state it loosely.
• Illinois signing date. The agency's release is dated 4 August 2025 and says the governor signed "on Friday", which is 1 August; one legal-industry summary gives 4 August.
• Utah's signing date. We used the enrolled bill's effective date only.
• EU Digital Omnibus details. Regulation (EU) 2026/1744 and its publication and entry-into-force dates come from secondary sources, not the Official Journal.
• Woebot's exact closing date. STAT's report of 2 July 2025 says the app shut down "this week"; the 30 June date comes from other coverage we did not open.
• SB 903 vote counts. Sources disagree, so we give none.
• Federal US rules, enforcement actions, and how any law applies to any named product. We did not review them.

What this does not replace

This is general information, not legal or clinical advice. A lawyer can tell you how these laws apply to a product, and a licensed clinician can tell you whether an AI tool suits your situation. If you are in danger, contact local emergency services now. In the EU, call 112.