AI note-taking in therapy: client consent in the UK, with wording you can adapt

AI note-taking consent is the client's informed agreement, given before the session, to the use of a tool that transcribes or summarises what is said in therapy. It sits alongside your contract and your privacy notice. It does not replace them.

This guide is for counsellors, psychotherapists and psychologists working in the UK. It sets out what three texts say: the BACP Ethical Framework 2026, UK GDPR and the NHS England guidance on ambient scribing. It then gives wording you can adapt, a sentence to say in session, and practical steps for refusals and withdrawals. It is not legal advice. If you are unsure about your own situation, ask the ICO, your professional body or a data protection adviser.

If you practise in France, read our France version of this guide on patient consent for AI note-taking. The rules there are different.

What the BACP Ethical Framework 2026 says

The BACP Ethical Framework for the Counselling Professions 2026 takes effect from 3 November 2026. BACP says it becomes mandatory for all members at midday that day. Until then, members keep using the 2018 framework.

Clause 2.1 is about safety. Point (e) asks members to "assess the risk of any artificial intelligence tool (AI), digital tool or online platform, before using them." Members must be able to demonstrate five things:

1. They are competent to use the tool or platform.
2. They understand how data are handled and stored, and any risks to confidentiality, and they have mitigated those risks as far as possible.
3. They are honest and transparent with people about their use of AI, digital tools or online platforms, and the benefits and risks involved.
4. They "have the informed consent of those using our services before inputting any of their personal data into AI or digital tools."
5. They have not deferred or outsourced their decision-making to AI tools. They remain responsible for critically evaluating AI output.

Point iv is the consent rule. It is clear on timing: consent comes before any personal data goes into the tool. Point iii adds that you explain the benefits and the risks, not only the benefits.

The framework also says that confidential information is disclosed only with the client's consent, or when required or permitted by law. Clause 3.1(d) asks that clients are aware of and agree to any foreseeable limits to confidentiality, including the use of digital storage systems, platforms or tools that may monitor or collect data. An AI tool that processes session content is something a client can reasonably expect to hear about. For a fuller reading of the AI clause, see our guide to the BACP Ethical Framework 2026 and AI.

What UK GDPR says

The right to be informed

The ICO guidance on the right to be informed says you must give privacy information at the time you collect personal data. That information includes your purposes, your lawful basis, your retention periods and who the data will be shared with. It must be concise, transparent, intelligible and easily accessible, in clear and plain language.

The ICO also covers AI in the same guidance. Be open about your use of AI and explain why you use it. If you start a new AI use, tell people before the processing starts. For existing clients, this means you update your privacy notice and talk to them before the first session with the tool, not after.

Lawful basis: consent is not always the basis

Under UK GDPR, you need a lawful basis under article 6. For health data, which is special category data, you also need a separate condition under article 9.

Article 9(2)(a) allows processing with the client's explicit consent. Article 9(2)(h) allows processing that is necessary for the provision of health or social care or treatment, subject to the safeguards in article 9(3). Those safeguards require the data to be processed by or under the responsibility of a professional subject to an obligation of professional secrecy.

Section 11(1) of the Data Protection Act 2018 explains how article 9(3) applies in the UK. It covers processing by or under the responsibility of a health professional or a social work professional. It also covers processing by another person who owes a duty of confidentiality under an enactment or rule of law.

The ICO page "When is consent appropriate?" adds useful points. Consent is one lawful basis, and there are others. Consent is unlikely to be appropriate when you would still process the data on another basis if consent were refused or withdrawn, when consent is a condition of the service, or when there is a clear imbalance of power. The ICO says that asking for consent when you would process the data on another basis anyway is misleading and inherently unfair.

What does this mean for you? The texts allow two readings, and which one fits your practice is your decision as data controller. One reading relies on article 9(2)(h) for clinical notes in general, including notes drafted with a tool. Another uses explicit consent under article 9(2)(a) for a specific optional tool. This article does not give a verdict on which basis you should use. What matters is that you choose one, write it in your privacy notice, and act in line with it.

Why you still ask for consent

Even if your UK GDPR basis is not consent, the BACP framework still asks for the client's informed consent before you put their data into an AI tool. These are two separate layers. In practice, the client gets a real choice about the AI tool, and you keep your notes either way.

What the NHS England ambient scribe guidance says

NHS England has published guidance on the use of AI-enabled ambient scribing products in health and care settings. The version online is version 2, for England. It is written for NHS and care settings, but it is a useful reference for private practice too.

On patients, it asks settings to be transparent about how information is used and shared. It suggests updating privacy notices and explaining how information will be used before the processing takes place, giving people the chance to object. Information given to patients can include what is being captured, what the output will be, who will use that output, and how it will be stored. It also suggests educating practitioners on how to gain permission from patients to use ambient scribing.

We did not find steps in the guidance on how to note a patient's choice in the file, or on what to do when a patient declines. The practical steps below fill that gap with ordinary good practice.

Written consent wording you can adapt

Put this in your counselling contract or your intake form, and link it to your privacy notice. Adapt the words in brackets. Keep it short and honest about risks. For a full contract, see our counselling contract template for the UK.

Use of an AI note-taking tool

"With your agreement, I use an AI note-taking tool called [name of tool] during our sessions. It transcribes what is said and prepares a draft of my session notes. I read, correct and approve every note myself. The tool does not make any decisions about your therapy.

Your data is processed by [name of provider] on servers located in [country]. [The audio is / is not kept after transcription.] Your data is [not] used to train AI models. Notes are kept for [retention period], as set out in my privacy notice.

Like any digital tool, it carries some risk to confidentiality. I have checked how the provider handles and protects data, and I have a data processing agreement with them.

Using this tool is your choice. If you say no, I will write my notes by hand or type them myself after the session. This will not change the care you receive in any way. You can change your mind at any time, by telling me in a session or by message, and I will stop using the tool from that point."

I agree to the use of an AI note-taking tool: Yes / No

Name, signature, date

Only write what you have checked with your provider. If you do not know whether audio is kept, or where servers are, ask before you use the tool. You must ask any provider for its data processing agreement.

A sentence to say in session

A signed form is not enough on its own. Informed consent is a conversation. At the start of the first session using the tool, say something like this:

"Before we start, I want to check something we mentioned in the contract. I use a tool that transcribes our session and drafts my notes, which I then check myself. You can say no, now or at any point, and it will not affect our work together. Do you have any questions about it? Are you happy for me to use it today?"

Leave real space for the answer. Some clients will say yes to please you. Watch for hesitation, and say again that no is a perfectly good answer.

How to note the client's choice in the file

Keep a short, factual entry in the client's file. It shows you can demonstrate consent, as clause 2.1(e) asks. Include:

• the date the tool was explained, and in what form (contract, conversation or both);
• what was explained: purpose, provider, where data is processed, risks, the right to refuse;
• the client's answer, in their own words where helpful;
• whether a signed form is on file;
• any conditions the client set, for example "not for sessions about [topic]";
• any later change, with its date.

Keep the consent form with the client's file, under the same retention period as your other notes.

If the client refuses

A refusal is a normal outcome. Respect it fully.

• Do not use the tool for that client. Write your notes manually, as you would without it.
• Do not penalise the client in any way: no change of fee, session length, waiting time or tone.
• Note the refusal in the file, briefly and without comment.
• Do not keep asking. You may mention it again later only if it is appropriate, for example if the tool or your way of using it changes. Even then, ask once and accept the answer.

If the client withdraws consent mid-therapy

Clients can change their mind. Handle it simply.

1. Stop using the tool from that moment, including in the current session if needed.
2. Note the withdrawal and its date in the file.
3. Switch to manual notes for future sessions.
4. Check what happens to data the tool has already processed. Look at your privacy notice and your provider's terms, and tell the client what you can and cannot do.
5. Explore the withdrawal in therapy if it seems clinically relevant, without pressure to reverse it.

Children and young people

Neither clause 2.1(e) nor the NHS England guidance sets specific consent rules for children. The BACP framework lists age and capacity among the factors that can affect a person's ability to engage in collaborative dialogue. The NHS guidance mentions children and young people among the people whose data may be involved. If you work with young clients, apply your usual approach to consent and capacity, involve parents or carers where your policy requires it, and take advice if you are unsure.

How this works with Delta

Delta is an AI assistant for mental health and allied health practitioners. During the session, Delta transcribes what is said, then prepares a session report that you review and validate. You can also dictate observations right after the session, or add written notes. The report is added to the client's file, and Delta takes your therapeutic approach into account. Read more on automatic session transcription and on Delta for therapists.

For your consent wording, here are the facts to fill in. Data is hosted in France with a host certified for health data (HDS, the French health data hosting certification). AI processing, transcription included, runs on servers located in France. The client's name and identifying details are pseudonymised before AI processing. No audio file is kept. Data is never used to train models. Data is encrypted in transit and at rest. Details are on the security page. As with any provider, ask Delta for its data processing agreement before you start.

Sources

• BACP, Ethical Framework for the Counselling Professions 2026 (PDF)
• BACP, Preparing for the 2026 Ethical Framework
• NHS England, Guidance on the use of AI-enabled ambient scribing products in health and care settings (version 2)
• ICO, Right to be informed
• ICO, When is consent appropriate?
• UK GDPR, article 9 (legislation.gov.uk)
• Data Protection Act 2018, section 11 (legislation.gov.uk)