The rules haven't caught up. Build as if they had.

Our response to Second Opinion's reporting on AI therapy. State bans regulate a word, wellness exemptions regulate a marketing claim, and neither regulates what happens in the conversation.

On October 22, 2026, Alexa Mikhail and Christina Farr published "People Are Already Using AI for Therapy. The Rules Haven't Caught Up" in Second Opinion. Their framing is that the question is no longer whether people will use AI for mental health support but what role purpose-built chatbots will play, and who decides their use cases. We agree with most of it. This is our commentary, written as a company building an AI companion for people with chronic pain, which makes us an interested party too. The patient-facing version is AI therapy laws: what the rules cover.

What the piece gets right

The risk is a mismatch, not a technology. The authors' sources locate the greatest danger in the gap between what people believe a tool can safely do and what it was designed to do. Headspace's Jenna Glover names the cause: "the omnibot," the single assistant people use for flight bookings and for their most vulnerable conversations. That is the right diagnosis. Almost every documented harm we know of comes from a general tool used for a job nobody designed or tested it for.

Wellness tools still need an exit. The piece accepts that resilience-focused chatbots that listen and help people cope with daily stress are probably low risk, and that some users may find that is all they need. It then makes the point that matters most: if someone shows signs of suicidal thinking or a more serious episode, even a wellness chatbot needs a way to refer them to care. A wellness label does not remove the obligation; it only removes the regulator who would check it.

Sycophancy is a design flaw, not a quirk. The authors note that earlier models are known to affirm what people want to hear. In mental health that is not a style problem. It reinforces exactly the beliefs therapy works to loosen, which is why we treat it as the core risk in AI companions.

Humans in the loop are a real model. Talkspace's Tee, as described in the piece and in the company's June 2026 announcement, is monitored by licensed therapists who can step in, and is trained to flag suicidal ideation, homicide risk, eating disorders, and substance use. Whatever one thinks of any single product, supervised AI is a credible answer to the question of what happens when a conversation turns clinical.

Where we would push further

Most of the scale is in the omnibots, not the purpose-built tools. Tee's roughly 30,000 early users are meaningful. OpenAI's own estimate, cited in the piece, is that about 0.15 percent of ChatGPT's weekly users show explicit signs of suicidal planning or intent, about 1.2 million people a week at the time. Rules written for products that call themselves mental health tools will miss most of the people who need protecting.

The voices are vendors, ours included. The piece is sponsored by Pelago, and its expert voices come largely from companies building these products: Pelago, Talkspace, Headspace. That is normal for an industry newsletter and the piece is open about it, but it means the field is largely describing its own safeguards. Claims about supervision, flagging, and escalation should come with published, independently checkable evaluations, and that applies to us as much as anyone.

"No one has all the answers" should not mean waiting. The authors close on the honest note that the lines are being drawn in real time. We agree the lines are unsettled. But the behaviors that protect people, crisis escalation, resistance to sycophancy, honesty about what the tool is, do not depend on where the wellness line lands. Those can be specified and tested now.

The behavior arrived before the rules

The numbers are no longer small. The APA's 2026 survey found 39 percent of psychologists have patients who used AI to self-diagnose. KFF's March 2026 poll found about one in six US adults used an AI chatbot for mental health information or advice in the past year, rising to more than a quarter of adults under 30. A RAND survey in JAMA Network Open found 13.1 percent of Americans aged 12 to 21 had used generative AI for advice when distressed, and most found it helpful. People are not waiting for permission, and cost and access are part of why.

Most of that use happens in general-purpose assistants. None of them is marketed as therapy, none has been evaluated as therapy, and that is precisely why most of the new rules do not reach them.

Three regulatory models, three blind spots

Trackers report more states following in 2026, including Rhode Island and Maine, but the details vary and change fast. Treat this table as a starting point and check your own state's statute.

Bans regulate the word, not the conversation. Illinois's Wellness and Oversight for Psychological Resources Act is clear and enforceable: no one may offer therapy to the public through AI. It protects people from a company advertising an AI therapist. It does nothing about the person confiding in a general assistant at 2 a.m., because nobody offered that assistant as therapy. A ban can also push careful, purpose-built tools to rename themselves "wellness" while leaving their behavior unchanged.

Disclosure is necessary and not sufficient. Utah's model, telling users they are talking to AI and limiting how their data is used, addresses deception and privacy. People in distress already know they are talking to a chatbot; the risk is what the chatbot does next.

Crisis-protocol mandates come closest to the real risk. California's SB 243 regulates behavior: detect suicidal ideation, respond with resources, protect minors. That is the right target. What it lacks, like the others, is a way to check that a protocol works.

The FDA pathway fits prescriptions, not consumer reality. The FDA's November 2025 advisory committee worked through a hypothetical prescription chatbot for depression and named the right risks: hallucination, sycophancy, bias, missed deterioration. But the FDA reviews tools that claim to treat a condition. Consumer chatbots avoid the claim, and the reissued general wellness guidance leaves most of them outside review.

The line that matters is behavior

The debate keeps returning to definitions: is this therapy or wellness, a device or an app. Those lines decide who has jurisdiction. They do not decide whether a person in crisis is helped or harmed. What matters is a short list of behaviors that every system people use for emotional support should get right, whatever it calls itself:

• Crisis recognition and escalation, including the intermediate risk levels where a 2026 review found chatbots consistently struggle, and a handoff to humans rather than an attempt to manage a crisis alone.
• Resistance to sycophancy, because an assistant tuned to agree will validate the beliefs therapy is meant to loosen. See sycophancy, the core risk.
• Honesty about what it is: AI, not a clinician, and never a licensed professional, which the APA's November 2025 advisory asks Congress to make law.
• Protection against dependency, designing for people's human relationships rather than replacing them. See anti-dependency design.
• Data handled as health data, whether or not HIPAA technically applies.

The evidence bar should rise too

The strongest trial of a generative AI therapy chatbot to date, Therabot in NEJM AI, showed meaningful symptom reductions over four weeks. Its critics in the same journal noted it compared against a waitlist, was evaluated by its own developers, and measured the human-chatbot bond with a scale built for human therapists. Those are fair points, and they apply to the whole field, including us. The next generation of evidence needs active comparators, independent evaluation, longer follow-up, and reporting of harms, not only benefits.

Safety evaluation can be standardized today. VERA-MH, an open-source evaluation of how chatbots detect and respond to suicide risk, was validated against licensed clinicians' ratings in 2026. We cover it in measuring AI companion safety. A regulator could require published results on an evaluation like this before a system is offered for emotional support, without needing to settle whether it is therapy.

What we hold ourselves to while we wait

Cindra is a companion for people living with chronic pain, built around acceptance and commitment therapy. It is not a therapist and does not present itself as one. Rather than wait for a rule that fits, we have written down the standards we build against, and published them in this series so others can reuse and criticize them:

• a written safety requirements document and hazard analysis before launch
• defined safety thresholds and release gates a version must pass
• crisis detection that runs alongside the conversation and escalates to humans, described in crisis response
• a clear statement of who should not use an AI companion
• ongoing monitoring, privacy protection, and a kill switch after launch

None of this makes Cindra a replacement for clinical care, and none of it is a substitute for regulation. It is what we think every company in this space can do now, and what the rules, when they arrive, should require of all of us.

This article is general information about technology and regulation. It is not medical or legal advice, and laws change quickly; check the current statute in your state. If you are in crisis or thinking about suicide, call or text 988 in the US, or your local emergency number, now.