Guardrails for AI in the Therapy Room (09/23/2026)

California is about to draw a hard line around what AI may do in mental health care, and the line is drawn in the right place for a business reason as much as a clinical one. SB 903 lets AI help with the administrative load and keeps every therapeutic judgment with a licensed professional who has to review and approve it. Alongside that, boards are telling management they are not getting enough on AI, which usually precedes a new reporting obligation landing on somebody’s desk.

Top 5 Critical Compliance Alerts

1. California’s SB 903 Keeps AI Out of the Therapist’s Chair

SB 903 passed the Assembly 71-4 after clearing the Senate and now awaits Governor Newsom’s signature, per the HIPAA Journal. It would limit AI to administrative and supplementary support, prohibit AI from conducting therapy, require a licensed professional to review and approve AI output involving diagnosis, treatment plans, emotional state detection, triage, or patient interaction, bar advertising a chatbot as a therapist, and require patient consent before sessions are recorded or transcribed. It applies to any individual, corporation, or entity that provides psychotherapy services in California, and to those that help provide them.

Operator Note: The reach beyond clinics is the part to notice, because the bill covers organizations that help deliver therapy as well as those that deliver it. If your platform routes patients to therapists or transcribes sessions, map every AI touchpoint against the review requirement now, while the bill is still waiting on a signature.

2. Boards Say They Need More From Management on AI

A PwC survey finds directors want more from management on AI and remain hesitant to use it in their own oversight work, per Corporate Compliance Insights. When a board says it needs more, the practical translation is a standing agenda item and an owner expected to report against it.

3. Dompe Pays $32 Million After Voluntary Self-Disclosure

Dompe’s $32 million settlement with the Department of Justice over manufacturer donations to patient assistance programs followed a voluntary self-disclosure, per JD Supra. The settlement shows DOJ’s continued attention to how manufacturers fund patient assistance, and it shows what the credit for coming forward looks like in practice.

Operator Note: Self-disclosure is a decision best made with a plan already written, because the window where it earns credit closes once the government finds the problem first.

4. EU Auditors Say Information-Sharing Gaps Slow Incident Response

The European Court of Auditors has criticized shortcomings in how the EU responds to major cyber incidents, pointing to gaps in information sharing, per Infosecurity Magazine. The same gap shows up inside companies, where the team that sees an incident first is rarely the team that has to report it.

5. SEC Charges an Investment Scheme Aimed at Law Enforcement Officers

The SEC charged CMI Capital LLC and its founder and manager Michael D. Williams over an alleged fraudulent investment scheme that raised about $860,000 from law enforcement officers, per the SEC. Affinity fraud works because trust inside a professional community substitutes for diligence.

Additional Compliance Alerts

Regulatory Fines & Enforcement Actions

• Vasindas’ Around the Clock Care settles breach litigation: The California home care provider has settled class action litigation over its data breach. HIPAA Journal

Policy & Governance Updates

• Prompt injection is now a legal review risk: Recent court decisions show the exposure for firms using AI to review filings, discovery, contracts, and diligence materials that may carry hidden instructions. JD Supra
• Business ethics as a practiced discipline: An argument that board directors need an understanding of their role in society beyond good character. Corporate Compliance Insights

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.