Governing AI scribes in behavioral health: a working framework for 2026

For two years, many behavioral health agencies assumed AI governance would be handed to them. Federal certification rules would make vendors disclose how their models work, and accreditors would set the standard. As of October 2026 that is not happening. The federal floor is getting lower, the state rules are getting stricter, and the agency that deploys an AI scribe is answerable for how it is used.

What changed at the federal level#

HTI-1 created transparency duties, and HTI-5 removes most of them. ONC's HTI-1 final rule (published January 2024) replaced the old clinical decision support certification criterion with a "decision support interventions" (DSI) criterion. Certified health IT that supported predictive DSIs had to expose 31 source attributes, covering intended use, training data, external validation and performance measures. In practice, this was a mandatory model card.

ONC proposed HTI-5 in December 2025 as a deregulatory rule, and the comment period closed on February 27, 2026. According to Holland & Knight's October 28, 2026 summary, ONC published the HTI-5 final rule on October 26, 2026. It narrows the DSI criterion to fully remove the model card requirements for source attributes, along with the related transparency, documentation and annual review duties from HTI-1. ONC's stated reason was that it had found "no publicly available evidence" that the transparency requirements had improved patient care. Different provisions take effect on different dates, and we have not confirmed which date applies to the DSI changes.

The practical effect is simple. If you want a vendor's model card, you now have to ask for it in the contract. Certification will no longer require one.

Section 1557 still applies to decision support tools. HHS's 2024 Section 1557 rule added 45 CFR §92.210. It prohibits discrimination through "patient care decision support tools", a category broad enough to include anything from a flowchart to a machine-learning model. Covered entities must make reasonable efforts to identify tools that use race, color, national origin, sex, age or disability as inputs, and to reduce the risk of discrimination from each one. The identification and mitigation duties took effect May 1, 2025. The section remains in the CFR, but federal enforcement priorities have shifted since then, so ask counsel how much weight to give it.

A scribe that only transcribes and drafts is arguably not a decision support tool. Many products now do more than that: they suggest diagnoses, flag risk, propose CPT codes or recommend a level of care. Each of those features influences a clinical decision, and we recommend governing them as if §92.210 applies.

What states have added#

State law is where the specific obligations for behavioral health are. The laws we track most closely (our consent guide covers recording consent in more depth):

There is also a federal complication. A December 11, 2025 executive order directed the Attorney General to set up an AI Litigation Task Force to challenge state AI laws. We have not found a court decision that strikes down any of the laws above. Until one exists, assume they apply.

The accreditor view#

On September 17, 2025, The Joint Commission and the Coalition for Health AI released voluntary guidance on the responsible use of AI in health care. It is organized around seven elements: governance structures, privacy and transparency, data security, ongoing quality monitoring, voluntary reporting of AI safety events, risk and bias assessment, and education. The guidance is not an accreditation standard yet. The Joint Commission has said it plans a voluntary AI certification, so the seven elements are a reasonable preview of what surveyors will ask about.

An eight-part governance program#

Below is the program we would run at a multi-program agency. Most of it can be assigned to people who already exist: the compliance officer, the medical director, the privacy officer and an IT lead.

1. Inventory

List every AI feature in use: scribe drafting, code suggestion, risk flags, client messaging and intake triage. For each one, record what it influences and which law or policy applies. Something not on the list cannot be governed.

2. Consent

Capture consent before recording, per client and per setting, in the language the state requires. Store it as structured data with a date and version, not as a scanned PDF.

3. Human review

The clinician reads and signs every note. Do not allow bulk-signing of AI drafts. Supervisors co-sign for pre-licensed staff, as they would without AI.

4. Audit trail

For each signed note, keep the draft the model produced, the clinician's edits, the model and version, the consent record and who signed. When an auditor or licensing board asks what the AI wrote and what the clinician wrote, you need an exact answer.

5. Quality and bias monitoring

Sample notes every month. Track omissions, statements the transcript does not support, and edit rates. Break the results down by session language, client age group and program. A model that does worse with accented speech or with children shows up here first.

6. Incident reporting

Treat AI errors that reach a signed note like other safety events: report them, review them and record what changed.

7. Vendor terms

Since HTI-5 removes the certification requirement, put transparency in the contract: model documentation, validation data for behavioral health, data retention, no training on your PHI, and notice before material model changes.

8. Training

Clinicians should be able to say what the tool does, what it gets wrong, and how to explain it to a client who asks.

Where agencies get stuck#

• Consent captured once at intake and never refreshed when the setting changes, for example from individual to family sessions.
• No record of what the AI drafted versus what the clinician changed, so an omission can't be traced.
• Code suggestions and risk flags governed like the transcription feature, even though they influence decisions.
• Bias reviews done once at procurement and never repeated after the vendor updates the model.
• Client-facing chat or text features launched under the documentation policy, which doesn't cover them.

How Margent is built for this#

Margent keeps the governance record as part of normal use. Margent links every sentence in a draft to the moment in the session it came from, and consent is captured per program and per client before recording starts. The draft, the clinician's edits and the signature are stored together. Nothing is submitted without a clinician's signature. Note checks test consent and co-signature rules before signing. Our security page lists data handling, retention and the model-training commitment so you can put them in a contract.