An ambient AI scribe does something the law has strong opinions about: it records a private conversation between a clinician and a patient, then uses generative AI to turn that recording into text. Two different bodies of state law reach that act, and they are easy to conflate. The first is old — wiretapping and eavesdropping statutes that decide whether you may record at all. The second is new — generative-AI disclosure and governance laws written in the last two years. This page tracks both, as dated status tables tied to each state's own statute text. It is general information for orientation, not legal advice. As of July 2026. For what these tools are and how they perform, see the glossary entry on the ambient AI scribe and our AI scribe head-to-head comparison.
What are the two layers of law an AI scribe touches?
Keep the two layers separate, because they answer different questions:
- May you record the encounter? This is governed by each state's recording-consent regime — a rule that predates AI entirely and turns on whether the state requires the consent of one party or all parties.
- Must you disclose the AI, or govern it as high-risk? This is the newer layer: statutes that require telling patients when AI generates a communication or is used in their care, and broader AI-governance duties for higher-risk systems.
A scribe can clear the first layer and still trip the second, or the reverse. Both have to be worked through for any given deployment.
Layer 1 — how does recording consent vary by state?
Whether a scribe may capture the visit begins with a distinction every US privacy lawyer knows: one-party versus all-party consent. In a one-party state, one participant's consent to record a conversation is enough — and a clinician who runs the scribe is a participant. In an all-party state, every party to a confidential communication must consent before it is recorded. Most states follow the one-party rule; roughly a dozen are all-party jurisdictions, and those are the ones where an undisclosed scribe creates real exposure.
| State | Recording-consent regime | Governing statute | Status (as of Jul 2026) |
|---|---|---|---|
| California | All-party consent | Cal. Penal Code 632 1 | In force |
| Florida | All-party consent | Fla. Stat. 934.03 3 | In force |
| Washington | All-party consent | RCW 9.73.030 2 | In force |
| Other all-party states | All-party consent | Enumerations commonly include Connecticut, Delaware, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania | Verify each state's statute |
| Majority of states | One-party consent | State wiretap statute | In force |
California's statute is representative of the all-party rule: it penalizes a person who, intentionally and without the consent of all parties to a confidential communication, records that communication, with a fine of up to $2,500 per violation 1. Washington similarly bars recording a private conversation without first obtaining the consent of all the persons engaged in it 2, and Florida makes it unlawful to intercept an oral communication carried with a reasonable expectation of privacy without all-party consent 3.
Three practical points follow. First, the all-party list is enumerated slightly differently across sources, and some states apply the all-party rule only to in-person conversations or only to phone calls — so the specific statute, rather than a map, is what governs. Second, telehealth crosses state lines, which can put a single encounter under two states' rules at once. Third, because consent is both a legal requirement in some states and an ethical expectation everywhere, most health systems obtain patient consent to the scribe regardless of the local regime; the recording-consent map tells you where it is mandatory, not where it is wise.
The telehealth wrinkle deserves its own line. When a clinician in one state records a patient located in another, either state's law may apply, and the safe assumption is that the stricter regime governs. That is why a growing number of health systems standardize on all-party-style consent everywhere: a single consent workflow that satisfies the most demanding state is simpler to operate — and to defend — than a patchwork keyed to the patient's location at each visit. The consent itself is usually brief: a spoken or written notice that an AI tool will help document the visit, an opportunity to decline, and a line in the record confirming consent was obtained.
Layer 2 — generative-AI disclosure and governance laws
The second layer is newer and moving quickly. Three state laws are the ones to track for clinical AI as of July 2026.
| Law | What it requires | Effective | Source |
|---|---|---|---|
| California AB 3030 | Disclaimer + human-contact instructions when generative AI produces a patient communication about clinical information; exempt if a licensed provider reviews it | 1 Jan 2025 | 4 |
| Texas TRAIGA (HB 149) | Health care providers must disclose to patients when AI is used in relation to a health care service or treatment, by the date service is first provided | 1 Jan 2026 | 5 |
| Colorado AI Act (SB 24-205) | Duties on developers and deployers of high-risk AI making consequential decisions, including in health care | Delayed to 30 Jun 2026; framework revised for 1 Jan 2027 | 6 |
California AB 3030 attaches to patient-facing communications. When a health facility, clinic, or physician's office uses generative AI to produce a written or verbal communication that pertains to a patient's clinical information, that communication must carry a disclaimer that it was generated by AI and give clear instructions on how to reach a human provider 4. The exemption is the part that matters most for scribes: the requirement does not apply where the communication is read and reviewed by a licensed or certified provider. A scribe that drafts a note the clinician reviews and signs before anything reaches the patient generally lands inside that exemption — which is one more reason the human-in-the-loop review step is doing legal work as well as clinical work.
Texas TRAIGA takes a different route. Signed on 22 June 2025 and effective 1 January 2026, it requires a health care provider that uses an AI system in relation to a health care service or treatment to disclose that use to the patient, clearly and in plain language, no later than the date the service or treatment is first provided 5. Because a scribe is AI used in the course of a visit, that disclosure obligation can attach even where the note never becomes a patient communication — a broader trigger than California's. Enforcement rests with the Texas Attorney General, and the Act also amends the state's biometric-identifier law, which can bear on capturing a patient's voice.
Colorado's AI Act (SB 24-205) is the broadest and the most in flux. It imposes risk-management, impact-assessment, and notice duties on developers and deployers of high-risk AI systems that make or influence consequential decisions, and health care is named among the covered domains 6. Its effective date has already moved — pushed to 30 June 2026 — and the framework was subsequently revised by 2026 legislation set to take effect 1 January 2027. A documentation scribe with human review is a weaker fit for the high-risk "consequential decision" trigger than, say, a diagnostic model; but the boundary is exactly the kind of thing that shifts as the statute is rewritten, which is why this row carries a live date.
Read across the three, a pattern emerges. California regulates the output — a patient communication; Texas regulates the use — AI in the course of care; and Colorado regulates the risk — consequential decisions. A single scribe deployment in a multi-state system can touch all three triggers at once, which is why compliance teams increasingly map each AI tool against all three axes rather than against a single statute. None of the three turns on the vendor's brand or the model's sophistication; each turns on what the tool does and to whom. The corollary for procurement is concrete: ask a prospective vendor which of these triggers its tool activates in each state you operate in, and treat a vague answer as a diligence gap.
Beyond the table — the watch list
Two more items belong on any tracker even though they are not scribe-specific and their status should be confirmed against the current statute text with counsel. Utah's Artificial Intelligence Policy Act requires disclosure of generative-AI use in interactions tied to state-licensed occupations, which reaches clinicians. Illinois's Biometric Information Privacy Act can treat a captured voiceprint as a biometric identifier, adding a consent-and-notice layer on top of the state's all-party recording rule. Both are active areas; neither is settled as applied to ambient scribes. Several other states introduced or enacted generative-AI transparency measures across 2025 and 2026, and the direction of travel is toward more disclosure rather than less — so a tool that sits comfortably within the rules today can acquire a fresh obligation in the next legislative session.
How to read this tracker
Four cautions travel with every row.
First, status is perishable. The Colorado dates have already changed once, and new state bills appear each session — treat the effective dates here as of July 2026 and confirm before relying on them.
Second, the two layers interact. Clearing recording consent does not satisfy an AI-disclosure statute, and disclosing AI use does not cure a missing recording consent. Work through both.
Third, the review exemption is doing heavy lifting. California's carve-out for provider-reviewed communications, and the general design in which a clinician signs every note, are what keep many scribe workflows on the lighter side of these laws — so a change to that workflow can change the legal analysis.
Fourth, this is general information, not legal advice, and it is only the state layer. Federal privacy law runs underneath all of this; see HIPAA and LLMs: what is permitted, the global AI in health regulation tracker, and the deployment figures in the AI scribe adoption statistics. Confirm any deployment with privacy counsel and your compliance office before you rely on it.
Sources and method
Every row is drawn from the primary statute or bill text: California's all-party consent rule at Penal Code 632 1, Washington's at RCW 9.73.030 2, and Florida's at Statutes 934.03 3 for the recording-consent layer; California AB 3030 4, Texas HB 149 (TRAIGA) 5, and Colorado SB 24-205 6 for the generative-AI layer — each read from the enacting legislature's own site. Where an effective date reflects a statute that has been delayed or revised, the row says so. The enumerated all-party states beyond the three cited should each be checked against their own statute, as regimes and scope vary. We revisit this page every 90 days and whenever a state enacts, delays, or revises a law that reaches clinical AI. Statuses and dates are current as of July 2026.