AI note-taking for therapists: what's actually ethical, and what could put your practice at risk

AI note-taking tools are one of the most talked-about developments in private practice right now. The promise is real: less time writing up after sessions, more presence in the room, notes that are structured and consistent. But for UK therapists, the ethical and legal terrain is genuinely complicated, and much of the guidance circulating online has been written for US practitioners working under HIPAA, not for therapists here working under UK GDPR.

This article is written specifically for UK-based therapists in private practice. It covers what the law actually requires, what the professional frameworks say, and the practical questions you need to ask before trusting any AI tool with your clients' most sensitive disclosures.

The profession is moving carefully, and that's instructive

Before getting into the detail, it helps to understand where the profession currently stands.

According to BACP's own technology survey¹, 11.6% of practitioners are already using AI in some aspect of their work. That number is growing quickly. But the same survey found that 64.2% of members have concerns about data privacy, 66.4% are worried about the accuracy of AI outputs, and 65.9% are concerned that most practitioners don't fully understand how these tools work.

That combination of growing use alongside deepening concern describes a profession trying to move thoughtfully rather than either embrace or reject a technology wholesale. BACP's Head of Policy² has explicitly noted that "there are additional ethical questions about AI use in therapy that need to be answered," while also acknowledging AI has genuine roles to play in improving access to mental health support and helping practitioners manage administrative load.

The new BACP Ethical Framework, currently in consultation and due for final publication in Autumn 2026, has specifically surveyed members on AI and technology in therapy as part of the review. The profession's formal guidance is being written right now, which means the responsibility for navigating this sits largely with individual practitioners at this moment, and it is worth navigating it carefully.

The most important distinction: AI as therapist vs AI as administrator

Much of the anxiety in the profession conflates two very different uses of AI. The debate around clients turning to ChatGPT for emotional support, or AI chatbots offering quasi-therapeutic conversations, is entirely separate from the question of whether a therapist uses an AI tool to help write up their session notes.

The ethical issues are different. The legal questions are different. And conflating them leads to either unnecessary alarm or false reassurance.

This article is about administrative AI: tools that help with documentation, transcription, and session notes. Not AI in the therapeutic relationship itself.

Why UK GDPR matters here

Most articles you will find on AI note-taking ethics are written for US therapists. They discuss HIPAA, Business Associate Agreements, and US state legislation. These frameworks do not apply to UK private practice. You are operating under UK GDPR and the Data Protection Act 2018, and the rules have some important differences.

The critical legal fact for UK therapists is this: everything your clients disclose in a therapy session, including their mental health history, diagnoses, trauma, medication, and relationship history, is special category data under Article 9 of UK GDPR. This is the most sensitive classification in UK data protection law. Health data in a therapeutic context almost certainly qualifies, and so does much of what emerges in sessions even when it is not explicitly clinical.

Processing special category data requires two things that standard personal data does not: a lawful basis under Article 6 of UK GDPR, and an additional condition under Article 9 specifically for special category data.

For most private therapists, the most practical Article 9 condition is explicit consent from your client. This does not mean you need a separate consent form every time you use a note-writing tool after a session. What it does mean is that your standard client agreements need to include clear, honest disclosure of how you use technology in your practice, and clients need to understand and agree to it before their first session.

The ICO has made clear in its guidance on AI and data protection that where AI systems process personal data, organisations must ensure transparency with individuals about how their data is being used, including when it is shared with third-party AI vendors. The ICO has updated its guidance to reflect the Data (Use and Access) Act 2025³, whose main data protection provisions came into force in February 2026, and continues to publish further guidance as remaining provisions are phased in. The core principles around special category data and meaningful consent remain firmly in place.

Consent vs disclosure: they are not the same thing

A significant source of confusion in practice is the difference between informing a client that you use AI tools (disclosure) and obtaining their genuine agreement to it (consent).

Adding a line to your standard privacy notice that says "I may use technology to assist with note-taking" is not sufficient for special category health data. UK GDPR requires consent that is freely given, specific, informed, and unambiguous.

Freely given means the client must be able to decline without it affecting their care. Specific means they need to understand what type of tool is being used and broadly what it does with their data. Informed means they need to know where their data goes, who processes it, where it is stored, and how long it is retained. Unambiguous means a clear affirmative action, not something implied by silence.

NHS England's guidance on AI scribing tools in clinical settings, published in April 2025⁴, makes this concrete: patients must be informed at the start of any session that the tool is being used, given a genuine right to object without penalty, and clinicians must verify and approve every AI-generated output before it enters the clinical record. Explicit consent is not required under the guidance, but transparency is, and if a patient objects, the tool cannot be used. In private practice the bar is higher still, given the particular sensitivity of psychotherapy content.

In practice, your client agreements should cover what AI-assisted tools you use for documentation, what happens to their information when it is processed, and that they have the right to request manual notes instead. Clients should be given that alternative, and told clearly that declining AI tools has no effect on their care.

The question most therapists are not asking: where are the servers?

Here is the most commonly overlooked risk in this area. The majority of AI note-taking tools currently marketed to therapists, including several well-known platforms, are built by US companies whose data is processed on servers outside the UK. Under UK GDPR, transferring special category data to a country outside the UK requires specific legal safeguards. The UK's adequacy decisions cover some countries but not all, and the US does not have a blanket adequacy finding.

Before using any AI tool with client session content, you need to know where the data is processed, what transfer mechanism is in place if data leaves the UK, whether the vendor will provide a Data Processing Agreement, whether session data is used to train AI models, and what happens to any recordings after notes are generated.

A platform that processes and stores data within the UK removes cross-border transfer risk entirely and makes your data protection obligations significantly simpler to discharge.

The hallucination problem is a clinical problem

One ethical concern that applies regardless of jurisdiction is the reliability of AI-generated notes. AI language models can hallucinate, producing confident-sounding output that includes details never actually discussed in the session. In any clinical context, a fabricated detail in a session note can be harmful. In therapy, where notes may inform risk assessments, treatment planning, and safeguarding decisions, the stakes are particularly high.

BACP's survey found that 66.4% of members are concerned about the accuracy of AI outputs. This concern is well-founded, and it points to a clear ethical requirement: every AI-generated note must be reviewed and edited by the practitioner before it enters the client record. The AI produces a draft; the clinical judgement of the therapist determines what is accurate, relevant, and appropriate to record.

One practical way to reduce hallucination risk is to give the AI sufficient clinical context when generating notes, including the session type, modality, and relevant background. Tools designed specifically for clinical practice are more likely to produce accurate structured output than general-purpose AI writing tools.

If you are ever asked to justify the contents of a client record, whether in a complaint, a safeguarding inquiry, or legal proceedings, you need to be able to say that the record reflects your clinical judgement, not an algorithm's output. "The AI wrote it and I did not read it carefully" is not a defensible position.

AI notes, dictation, and transcription: the consent question depends on which tool you are using

Not all AI documentation tools work the same way, and the consent question is very different depending on which type you are using. Understanding the distinction matters, both for your own peace of mind and so you are not creating unnecessary friction with your clients.

Post-session dictation

This is where the therapist speaks or types their own observations after the session has ended, and AI helps structure and complete the note. The client is not involved at this stage. No client audio is recorded or processed. The therapist is simply choosing what to include, in the same way they would when writing notes by hand.

From a consent perspective, this is the most straightforward scenario. You do not need a separate consent process for using a dictation or AI note tool after sessions. What you do need is a clear statement in your standard client agreement that you use software to help with clinical documentation, along with the name or type of tool and where data is stored. This is disclosure, not consent, and it sits comfortably within the kind of privacy notice therapists should already have in place.

Post-session transcription of a recording

This is where the session is recorded, and the recording is later processed to generate a transcript or notes. Client audio is involved here, so the consent question is more significant, but it is still manageable. The key is that consent is obtained at the point of recording, before the session begins, not separately at the point of running the transcript through an AI tool.

Your client agreement needs to cover that sessions may be recorded for note-taking purposes, where the recording is stored and for how long, and that it will be deleted once notes have been generated. Clients should be given a genuine right to decline recording without any effect on their care. A good platform will handle deletion automatically and give you confirmation that it has happened.

Live transcription during a session

This is where a tool listens and transcribes in real time while the session is taking place. This carries the highest consent requirements and deserves the most careful handling. The client needs to know before the session begins that live transcription is happening, understand what the tool does with the audio, and have a clear and penalty-free way to decline.

Some practitioners find that certain clients, particularly those with trauma histories, those involved in legal proceedings, or those who are particularly private, prefer not to be recorded in any form. That is a reasonable position to hold and should be respected without question. For these clients, post-session dictation is a straightforward alternative that requires no recording at all.

How My-Therapy-Suite approaches this

We built our AI-assisted documentation tools with UK private practice compliance as a starting point, not an afterthought. Here is what that means in practice.

• Template consent agreements. We provide therapists with ready-to-use consent templates covering AI-assisted documentation, which can be adapted and sent directly to clients via the platform. These are written as agreements between you and your client, covering what they need to know about how their information is handled during your work together.
• A documented DPA with every therapist. Each therapist on MTS has a Data Processing Agreement with us, accessible via our homepage. This sets out our obligations as a data processor and yours as the data controller. We also have DPAs in place with every third-party vendor we use, requiring them to meet the same or stricter standards we hold ourselves to.
• Data stored in UK-certified data centres. All data processed and stored through MTS is held in certified UK data centres. This removes the cross-border transfer question for UK practitioners entirely.
• Personal Identifiable Information (PII) redaction before any vendor processing. Before any session content is sent to an AI vendor for note generation, we redact personally identifiable information, including names, addresses, and contact details. The AI works on de-identified clinical content. Your clients' identities are not exposed to third-party systems.
• Therapist review built into the workflow. AI-generated notes are provided as editable records. Clinical oversight remains with you throughout.
• Clinical context to support accuracy. Our tools are designed to take clinical context into account when generating notes, including session type, therapeutic modality, and relevant background. This reduces the risk of generic or inaccurate output, though practitioner review remains essential.
• Defined data retention. Our DPA sets out the retention periods that apply to any data processed through our systems.

The goal is not to replace clinical judgement. It is to reduce the administrative burden of note-writing so that more of your time goes into the work that actually matters.

Practical checklist for evaluating any AI tool

If you are looking at any platform for AI-assisted documentation, ours or anyone else's, here are the questions worth asking before you commit.

On compliance

• Does the vendor provide a Data Processing Agreement?
• Where are the servers, and is data processed and stored in the UK or a country with an ICO adequacy decision?
• If data leaves the UK, what transfer mechanism covers it?
• Has the vendor conducted a Data Protection Impact Assessment for their AI processing?

On data use

• Is session content used to train AI models?
• Is personally identifiable information redacted before any third-party processing?
• How long is audio or transcript data retained after notes are generated?
• Can data be deleted on request?

On consent

• Does the vendor provide consent templates or language you can adapt for your clients?
• Is your consent process specific enough to cover AI-assisted documentation under UK GDPR?
• Is opting out genuinely penalty-free, and do you have an alternative in place?

On clinical oversight

• Does the tool produce a record you can review and edit?
• Does it take clinical context into account to reduce inaccurate output?
• Do you have a process for catching and correcting errors before they become part of a client file?

The bottom line

AI-assisted documentation is a legitimate and practical way to reduce administrative load in private practice. Used well, it gives you more headspace after sessions for clinical reflection rather than formatting. The tools have improved significantly, and the profession's use of them is growing.

What matters is choosing the right tool, under the right terms, and using it in a way that your clients understand and have agreed to. The legal framework in the UK is clear enough to navigate. It just requires asking the right questions of any vendor you consider.

BACP's updated ethical framework, due Autumn 2026, will give the profession more formal guidance. In the meantime, the standard that applies is the one that has always applied: your clients' interests and their right to privacy come first, and any technology you use in your practice should make it easier to uphold that standard, not harder.