The BACP Ethical Framework 2026: what private practitioners need to check

For the first time since 2018, the Ethical Framework that governs your practice has been rewritten. BACP published the final version on 4 August 2026, and it becomes mandatory at midday on 3 November 2026. Until then, the 2018 Framework still applies. If you run a private practice, now is the time to check what the changes mean for how you work.

This article is not a summary of the framework. There are good summaries already out there, and the document itself is only around 20 pages. What this article tries to do is talk through the practical implications for a solo or small private practice, the kinds of things you might want to look at in your contracts, your privacy notice, your supervision records, your insurance, your clinical will. Everything is drawn from the BACP Ethical Framework 2026 and the 2018 Framework it replaces, with specific section numbers so you can verify each point yourself.

A quick word on naming. The consultation draft was titled the Ethical Framework for the Counselling Professions 2025. The final version is called the Ethical Framework for the Counselling Professions 2026. This article refers to it as the new framework or the 2026 framework throughout.

What changed between the draft and the final version

The final version keeps the structure and almost all of the section numbers of the 2025 draft, so if you started preparing based on the draft, that work is not wasted. BACP did make a number of changes. The ones most relevant to private practice are:

• AI and digital tools (2.1(e)): two new requirements. You must have informed consent before putting a client's personal data into AI or digital tools, and you must not hand your decision making over to AI.
• Privacy notice (3.1(d)): clients must now be aware of and agree to the foreseeable limits to confidentiality.
• Fees (3.4(b)): you must also explain how and when your fees will be reviewed.
• Records (3.2(c)): records must include all communications and other information held about a client.
• Ethical reasoning: the final text is firmer. Your rationale needs to answer the six questions, and shared decisions must be clearly recorded and agreed.
• Ethical principles: there are now 12 instead of 11.

BACP is also publishing new supporting resources in three categories: Ethics Essentials, Ethics in Practice and Legal Resources. These replace the current Good Practice in Action resources.

What is different from the 2018 framework

The new framework is shorter and more directive in tone. Obligations are written as numbered "Members must..." statements, each followed by a list of specific responsibilities. The 2018 framework was layered: a commitment to clients, a section on values, principles, and personal moral qualities, and 94 numbered points of good practice. The 2026 framework is three sections: Working ethically within relationships, Ethical principles (12 of them), and Core responsibilities (organised under four headings).

Some readers will find the shorter format clearer. Others have argued that a more principle-led structure actually increases the room for interpretation, because there are fewer prescribed points to fall back on. Both views are fair. What is clear is that the framework places much greater emphasis on being able to explain and evidence ethical reasoning, particularly where decisions are complex or high risk.

Several themes are also more visible in the new framework than they were in 2018: digital and online practice, AI tools, cross-border work, and anti-oppressive practice. None of these are entirely new ideas, but they appear in the framework more explicitly.

Things you may want to look at

Below are the areas where the new framework asks something different from the 2018 framework, and where it might be worth reviewing what you do today. Each item maps to a specific section of the framework.

1. Your privacy notice

Framework reference: 3.1(c) and 3.1(d)

The 2026 framework requires a "clear and accessible privacy notice that outlines all key information including, how personal data are collected, used, stored and protected in accordance with relevant data protection laws, including what rights people have in respect of these data". Section 3.1(d) goes on to require that people are aware of and agree to any foreseeable limitations to confidentiality, including "the use of digital storage systems, platforms or tools that may monitor or collect data".

The framework does not explicitly require you to name every individual processor or vendor. But practices that currently use vague descriptions of third-party systems ("industry-standard tools", "secure cloud providers") may want to consider becoming more specific about the platforms and processors involved. Greater specificity may also support transparency under UK GDPR, and it makes the foreseeable-limitations conversation with clients more honest. Because clients now need to agree to these limits, it makes sense to confirm that agreement in writing, for example in your working agreement.

2. Risk assessment for AI and digital tools

Framework reference: 2.1(e)

This is one of the more substantial additions in the 2026 framework. Section 2.1(e) asks members to "assess the risk of any artificial intelligence tool (AI), digital tool or online platform, before using them" and to be able to demonstrate five things:

1. Competence to use the tool or platform.
2. Understanding of how data are handled and stored, the risks to confidentiality, and how those risks have been mitigated.
3. Honesty and transparency with people about the use of AI, digital tools, or online platforms, and the benefits and risks involved.
4. Informed consent from clients before putting any of their personal data into AI or digital tools.
5. That decision making has not been handed over to AI. You remain responsible for checking AI output and for any decisions based on it.

The framework does not specify what form the assessment should take or how it should be recorded. A practical way to evidence this may be to maintain a short written assessment for each platform or tool that touches client data, covering what data passes through, where it is stored, who has access, what you have told clients, and whether clients have consented. The scope of "digital tool or online platform" is broad in the framework language, so reasonable interpretations could extend to practice management software, AI note-taking tools, and video platforms. For AI note-taking tools in particular, the new consent requirement means you should ask the client before using one in their sessions. The accompanying Ethics Essentials and Ethics in Practice resources may give more guidance on exactly what counts.

3. Boundaries between personal and professional social media

Framework reference: 1.3(d)

The 2018 framework asked members to take "reasonable care" to separate personal and professional social media presence. The 2026 framework is more direct: members must "ensure there is a clear boundary between our personal and professional social media, digital accounts and ensure that public communications, whether personal or professional, reflect the ethical principles set out in this Ethical Framework".

If you currently run a single account that mixes practice and personal life, this is worth a look. The same applies to client communication channels. Using a personal WhatsApp, SMS, or email address for client contact may sit less comfortably alongside this wording, especially now that section 3.2(c) requires your records to include all communications with a client. Practice-specific channels are the cleaner approach. The final wording also covers public posts, including on personal accounts: these should reflect the ethical principles in the framework.

4. Where your records are stored, and under which law

Framework reference: 3.2(b) and 3.3(b)

The 2026 framework introduces clearer cross-border framing. Records must be "stored securely and comply with the data protection requirements of the country where the record is stored" (3.2b). And legal obligations "may vary depending on the jurisdictions in which we provide services" (3.3b).

If you work with clients who live abroad, or you yourself work from outside the UK for stretches of the year, it is worth being able to articulate where your data is stored and which legal regime applies to it. Non-UK hosting is not inherently problematic, as many international providers operate lawfully under UK adequacy arrangements and standard contractual clauses, but you should know which arrangements apply.

5. Fees and payment terms

Framework reference: 3.4

The new framework adds a financial responsibility section that did not exist in 2018. Members must be aware of and comply with tax obligations in the country where they provide services, and must provide clear and transparent information about fees, including when and how payments are to be made, and how and when fees will be reviewed.

Most practitioners already do this informally. The framework suggests it should be written down. A working agreement that sets out the session fee, when invoices are issued, acceptable payment methods, late payment terms, how and when you review your fees, and the cancellation policy is a reasonable starting point.

This sits alongside the wider tax expectation. For UK sole traders, that includes Making Tax Digital for Income Tax, which has been phased in from April 2026 for those with self-employment income above £50,000.

6. Insurance for cross-border work

Framework reference: 4.2(a)(ii)

The 2026 framework extends the insurance requirement to "all aspects of our cross-border work in all the countries in which our professional services are delivered and in which we and the people using our services live, unless prior BACP approval for non-compliance has been granted".

Insurance for cross-border practice is genuinely complicated, involving governing law, practitioner location, client location, regulatory recognition, and individual insurer exclusions. The framework does not resolve those questions. What it does is make the obligation to think about them explicit. The practical step is to confirm with your insurer whether your policy covers the jurisdictions in which you and your clients are located, and to keep that confirmation on file.

7. Clinical will

Framework reference: 4.5(e)

The 2018 framework mentioned this at point 42. The 2026 framework elevates it to a core responsibility and is more explicit: members must "ensure we have a clinical will in place and have appointed an executor who, bound by confidentiality, can communicate with clients and service users if we are unable to contact them ourselves, or if we die".

If you do not have one in place, this is a good moment to look at it. The executor is usually a trusted colleague or supervisor who has agreed in writing to take on the role, with a confidentiality agreement, secure access to a current client list, and clear instructions on how to make contact. BACP, the BPC, and several supervision networks publish templates.

8. Evidencing ethical reasoning

Framework reference: Working ethically within relationships; 1.4(d)

The framework places much greater emphasis on being able to explain and evidence ethical reasoning, particularly where decisions are complex or high risk. The "rationale for ethical decision-making" section sets out six questions a rationale needs to cover, and section 1.4(d) requires members to be able to demonstrate "our ethical rationale and reasoning, including the steps we have taken to resolve the dilemmas or challenges".

Importantly, the final text is firmer than the draft. Your rationale needs to answer the six questions, and discussions about shared decisions with clients "must be clearly recorded and agreed". The framework does not say every ethical decision needs a full written rationale, but where a rationale is required by others, it must be recorded in line with good record keeping practice, with enough detail to show what was decided and why. Supervision notes and case notes are natural places for that record.

9. Working agreement and intake materials

Framework reference: 1.2(b), with content drawn from several other sections

Several of the items above touch the working agreement. Section 1.2(b) requires members to "provide people with a record of our working agreement". The areas that the framework suggests should be reflected somewhere accessible to clients include:

• Fee, payment terms, fee reviews, and cancellation policy (3.4)
• How data is handled, in the privacy notice (3.1c, 3.1d)
• Foreseeable limits to confidentiality, including digital storage and AI tools, and the client's agreement to them (3.1d)
• Use of AI, digital tools, or online platforms, and consent before client data goes into them (2.1e iii and iv)
• Access to safeguarding policy details (2.4b)
• Breaks and endings, and the existence of a clinical will arrangement (4.5)

Whether all of this sits in a single working agreement or is split between a working agreement and a privacy notice is a matter of preference. A short standalone privacy notice that the agreement references is one workable approach.

10. A supervision session as audit

Framework reference: 4.3 and 1.4(c)

Supervision is a strong thread through the new framework. One practical idea is to block out a single supervision session to walk through your current contracts, privacy notice, digital tool use, insurance arrangements, and clinical will against the new framework. It is the kind of audit that is easier to do collaboratively than alone.

How practice systems may help

Many of these changes are less about adopting entirely new practices and more about being able to evidence existing ones consistently. For practitioners using digital systems, the practical question becomes whether those systems make that easier or harder.

In My-Therapy-Suite, several of these areas are built into the way records, agreements, and data handling are structured:

Data handling and storage

Agreements and intake

Audit trails and records

Financial responsibility

Continuity of care

None of this removes the need to do the underlying work. No practice management platform can make ethical decisions on your behalf, and using one does not remove the need for supervision, professional judgement, or independent legal advice where appropriate. What a system like this can do is reduce the friction in producing the evidence that good practice is happening.

Where to start

The new framework becomes mandatory on 3 November 2026. If you have not started yet, these steps are a good way in, and most of them can continue after that date. A reasonable sequence:

1. Read the new framework end to end. It is short, around 20 pages.
2. Look at the digital tools you currently use and what you can say about how they handle data.
3. Review your privacy notice and working agreement against the new framework.
4. Confirm your insurance position for the jurisdictions you actually work in.
5. Put a clinical will in place if you do not already have one.
6. Book a supervision session to walk through the above.

None of these is technically difficult. The work is in being thorough, getting things on paper, and being able to point to the record if anyone asks.