EveryAILaw.com

The duty falls on private-sector actors, not only on licensees: § 40.1-5.5-3(b) reaches any "individual, corporation, or entity" that offers therapy to the Rhode Island public "including through the use of internet-based artificial intelligence", so an out-of-state AI therapy product marketed into Rhode Island is directly in scope, and the vendors selling clinical-adjacent AI into private practices are constrained by what their customers may lawfully deploy. That is what makes this an AI-deployment rule rather than a professional-licensing rule. The liability allocation is the sharpest edge: the provider retains clinical judgement and therapeutic oversight "but not for vendor-controlled system design, algorithms, or outputs" (§§ 40.1-5.5-2(6), 40.1-5.5-3(c)(2)) — the statute carves the provider's responsibility around the vendor's black box without saying who carries the residue.

The consent definition does the work. § 40.1-5.5-2(3) rules out the three cheapest consent mechanics in software: acceptance of broad terms of use that bury the AI description among unrelated material, dark-pattern interactions (hovering, muting, pausing, closing content), and deceptive actions. Consent must be affirmative, written or electronic, purpose-specific, and revocable — which means the product needs a per-purpose consent record and a revocation path, not a checkbox. § 40.1-5.5-3(c) then makes consent a condition precedent: AI use is permitted "only to the extent that such use meets the requirements of subsection (a)".

This is the only duty in the chapter with an attached penalty schedule, so it is the likeliest enforcement route. Because § 40.1-5.5-2(8)(i) puts preparation and maintenance of therapy notes inside "supplementary support", any AI scribe or note-taking vendor sits inside the confidentiality perimeter — the practice's vendor contracts, retention, and training-data terms are what this section reaches in practice.