APA Guidance on AI for Psychologists: What It Actually Says

Yes, psychologists can use AI in practice, and the American Psychological Association has said how. Its June 2025 ethical guidance for health service psychologists asks you to be open with clients, check tools for bias, protect client data, verify what the tool produces, keep your own judgment in charge, and think about liability.¹ The guidance is not enforceable on its own, but the Ethics Code standards underneath it are.² Here is what the documents say, how they map to the Code, and what that means for a solo or small-group practice.

What the APA Has Published, and How Much Weight It Carries

The main document is Ethical Guidance for AI in the Professional Practice of Health Service Psychology. APA's Mental Health Technology Advisory Committee drafted it after a January 2025 meeting, and the APA Ethics Committee adopted it.¹ It says plainly that it is not official APA policy, does not set mandatory standards, and has no enforcement mechanism. It is an educational document built on the Ethics Code's general principles.

Three other APA resources are worth knowing:

• An Ethics Committee FAQ on AI and social media (November 2023), which works through dilemmas such as an AI note-taking bot joining a clinical consultation group.³
• An AI tool guide for practitioners from APA Services (October 2024): a step-by-step review of a vendor's HIPAA posture, security, privacy policy and terms of service.⁴
• A two-page companion checklist from APA's Office of Health Care Innovation for recording that review.⁵

The Ethics Code itself, last amended effective January 1, 2017, is still the enforceable document.² The 2023 FAQ noted that APA is working on a revised Code that will include guidance on technology.³

Use is rising quickly. Among psychologists who had used AI in the past year, writing assistance was the top task (52%), according to APA's 2025 Practitioner Pulse Survey of 1,742 licensed psychologists:⁶

The Six Themes in the Guidance

The guidance has six sections. It cites the Code's Ethical Principles rather than numbered standards, so the standards listed under each theme are our mapping, checked against the Code's text.²

1. Transparency and Informed Consent

Psychologists have an ethical obligation to get informed consent by explaining the purpose, application, benefits and risks of the AI tools they use.¹ The guidance scales disclosure to the use. Its example of a subtle use is predictive text in provider notes; a system that picks a treatment approach calls for real discussion. It suggests your written consent say when, how and what type of AI tools you use; that clients hear they can opt out of certain AI-driven interventions and what the alternatives are; and that they know whom to contact to withdraw consent. It also extends disclosure to third parties who may be considered a client, such as a court.

Code standards: 3.10 Informed Consent; 10.01 Informed Consent to Therapy, which includes telling clients about the involvement of third parties and the limits of confidentiality; and 4.02 Discussing the Limits of Confidentiality, whose part (c) covers privacy risks when services are offered electronically.²

2. Mitigating Bias and Promoting Equity

Evaluate tools for biases that could worsen disparities, including how a tool was normed and what data it was trained on.¹ Code: Principle E, Respect for People's Rights and Dignity, which the guidance cites, and 2.04 Bases for Scientific and Professional Judgments.²

3. Data Privacy and Security

Make sure any tool can be used in compliance with HIPAA and other privacy rules. Know how client data are used, stored or shared, including aggregated or de-identified data, and tell clients. Stop using a tool when security concerns arise.¹ The Ethics Committee FAQ is blunter:

Code: 4.01 Maintaining Confidentiality and 6.02 Maintenance, Dissemination, and Disposal of Confidential Records.² The FAQ points out that 6.02 reaches information on local devices as well as cloud services and external platforms.³

4. Accuracy and Misinformation Risks

Evaluate AI-generated content critically, both when you start using a tool and as you keep using it. Prefer tools whose developers publish validation and testing data, and drop a tool promptly if misinformation concerns arise.¹ Code: 2.04, and 6.01 Documentation of Professional and Scientific Work and Maintenance of Records.² On records, the FAQ says anything a bot produces for a client's record must be reviewed and summarized accurately.³

5. Human Oversight and Professional Judgment

This section opens with one line: “AI should augment, not replace, human decision-making.”¹ You remain responsible for final decisions, should be competent with the tools you use, and should build in clear points where a person reviews the output. Code: 2.01 Boundaries of Competence, 2.03 Maintaining Competence, and 9.09(c), which keeps psychologists responsible for interpreting assessment instruments even when they use automated services.²

6. Liability and Ethical Responsibility

The guidance says the legal picture is still emerging, that negligent reliance on AI without proper validation or oversight could create liability, and that continuing education on mental health AI is best practice.¹ No single standard covers this. Your malpractice carrier is the right call.

AI Scribes vs. Tools That Work on Documents You Already Have

Most of the practical questions come down to one fact: where the client information goes.

AI scribes

A scribe records or transcribes the session and processes it on the vendor's servers to draft a note. Under HIPAA, a company that creates, receives, maintains or transmits protected health information on your behalf is a business associate,⁷ so you need a business associate agreement (BAA) before the first session. APA's tool guide adds questions: does the vendor offer a BAA, how does it encrypt data, and does it use your data to train its model?⁴ The checklist also asks how long data are kept and where they are stored.⁵

The consent questions are bigger, because the client is being recorded:

• Does the client understand that audio or a transcript exists, who holds it, and for how long?
• Can they say no and get the same care? The guidance says clients should hear the alternatives.¹
• Do they know whom to contact to withdraw consent later?
• Does your state require more? In Illinois, before a licensed professional uses AI for supplementary support on a recorded or transcribed session, the client must be told in writing that AI will be used and for what specific purpose, and must consent. Accepting general terms of use does not count as consent under that law.⁸

Tools that work on documents you already have

The other category never hears the session. You highlight or open something already in front of you (a payer letter, a records request, prior records) and ask for a summary or explanation. If the tool sends that text to a cloud service, the business associate analysis matches a scribe's. If the model runs on your computer, no vendor receives the information; device encryption, access controls and anything the tool saves locally are still yours.

The consent question is smaller but not gone. The guidance treats subtle uses more lightly than substantial ones, and it still suggests your written consent say when, how and what type of AI tools you use.¹

What States and Boards Are Adding

California's Board of Psychology issued an advisory on AB 489, operative January 1, 2026. It says licensees must disclose AI use, clearly identify AI-generated content (including reports and treatment summaries), and review and verify anything AI produces. Failing to check AI output may expose a licensee to negligence allegations.⁹

Illinois's Wellness and Oversight for Psychological Resources Act allows AI for administrative and supplementary support, including preparing therapy notes. It bars AI from making independent therapeutic decisions, communicating therapeutically with clients, or detecting emotions or mental states. Each violation can bring a civil penalty of up to $10,000.⁸

APA Services reported in March 2026 that California, Illinois, Nevada, New York and Utah had passed key AI legislation, and that many bills allow AI for administrative work such as note generation.¹⁰ We did not find formal AI practice standards from ASPPB; a May 2026 article on its site recaps a keynote urging boards to clarify documentation expectations and accountability.¹¹ Check your own board's site rather than reading silence as permission.

Assessment: Where Extra Caution Belongs

• Keep test materials out. Standard 9.11 requires reasonable efforts to keep test materials secure, consistent with law and contractual obligations.² Publisher terms are those contractual obligations. Pearson's appropriate-use page, for example, prohibits scanning or digitizing stimulus book images and uploading stimulus materials to a shared drive or website.¹² That page does not mention AI, but pasting items, stimuli or manual content into a third-party AI service is hard to square with it. Check each publisher's terms.
• Test data are doubly sensitive. The Code defines test data to include client responses to test items and your notes and recordings of statements and behavior during an examination.² Recording a testing session with a scribe puts test data on a vendor's servers.
• Interpretation stays with you. Under 9.09(c), you remain responsible for interpretation whether you score tests yourself or use automated services.²
• Say when AI helped write a report. Answering a question about trainees, the FAQ says to cite ChatGPT if it is used in any aspect of testing or report writing.³ California's board says AI-generated content in reports must be identified.⁹ In forensic work, remember that the guidance extends disclosure to third parties such as a court.¹

Before You Use an AI Tool: A Checklist for a Solo Practice

1. Name the task and the data. Drafting a letter template involves no client data. Summarizing a records request does. Test items are a category of their own.
2. Find out where processing happens. On your computer, or on a vendor's servers? If a vendor receives client information, get a signed BAA first.
3. Read the privacy policy and terms. Look for training on your data, retention, storage location and deletion. APA's checklist works as the form.⁵
4. Keep test materials out unless the publisher has authorized the platform.
5. Update your written informed consent to say when, how and what type of AI you use, that clients can opt out, and whom to contact. Add anything your state requires.
6. Review every output before it enters the record. Once you sign it, it is your work.
7. Secure the device. Turn on full-disk encryption (FileVault on a Mac) and turn off or clear any history the tool keeps.
8. Document your review and revisit it when the vendor's policies change, as APA's tool guide recommends.⁴

Where On-Device AI Fits

On-device AI settles checklist item two in the simplest way. The model runs on your computer, so no vendor receives client information and there is no BAA to negotiate. It does not settle the rest: consent, review, test security and device security are still yours.

Hey Eduardo is a Mac menu-bar app built that way. Highlight text anywhere and press a shortcut: ⌥⇧S to summarize, ⌥⇧A to ask a question. “Ask About a Document…” opens a PDF or text file and goes straight to a question; on the local model it reads a window of a few thousand words and tells you when a document is longer than it can take in. Scanned PDFs have no text layer, so ⌥⇧C reads a box you drag on screen with Apple's on-device text recognition. Local mode is the default, and nothing captured is sent to Hey Eduardo or any AI company.

Know what it is not. It is not an AI scribe and never records sessions. It does not integrate with EHRs, does not score or interpret tests, and is not a clinical decision-making tool. Cloud mode is opt-in, uses your own Anthropic, OpenAI or OpenRouter API key, and sends captured text to that provider, so keep it for research with no client data. A Local/Cloud badge is always visible.

Recent history is on by default: the last 25 results, with up to 4,000 characters of source text, stored only on the Mac. For clinical work, turn it off in Settings → Reading → Recent, clear it, and use FileVault. And the assessment rule still applies: don't capture test content, locally or otherwise. It runs on Apple Silicon Macs (M1–M5) with macOS 15 or later; more on the psychologists page.

Related: Hey Eduardo for psychologists, Hey Eduardo for therapists, AI workflows for therapists in 2026, and Can therapists use ChatGPT under HIPAA?