AI notes for therapists in the UK: how they work and the 6 checks to make

An AI note tool for therapists is software that turns the spoken content of a session into a written draft, which the practitioner reviews, corrects and files.

Most of the guides you will find on this topic are written for the United States. They talk about HIPAA, insurance billing and US note formats. This guide is for counsellors, psychotherapists and psychologists in private practice in the UK. It explains how these tools work in plain terms, then gives six checks to make under UK law and UK professional rules.

For a wider view of AI in therapy work, see our guide to AI for therapists.

How AI notes work: from session to note

The details vary, but the path usually has four steps.

1. Capture and transcription

The tool captures speech during the session, on a laptop, tablet or phone. Speech recognition turns the audio into text. Some tools also let you dictate your observations after the client has left, or type a few written notes. The output of this step is a transcript, which is raw material and not a clinical note.

2. Draft

A language model reads the transcript and writes a structured draft. Depending on the tool, the draft may follow a format such as SOAP or DAP, a free narrative, or a template you set. The draft summarises what was said. It should not add anything that was not discussed.

3. Practitioner review

This is the step that matters most. You read the draft, correct errors, remove what should not be kept and add your own professional view. NHS England guidance on ambient scribes asks organisations to make sure users review and approve outputs before any further action. That guidance is written for NHS settings, but the principle is a sound one for private practice too.

4. Filing

Once you have validated it, the note goes into the client's record. From that point it is your note, written under your name and your professional duties. The transcript and the audio are separate questions, covered in check 4 below.

For a closer look at the method, read our guide to AI note-taking in therapy sessions.

The 6 checks to make before using AI notes in the UK

These checks follow the order in which problems tend to appear. The first three are legal. The last three are about how the tool itself behaves.

Check 1: your lawful basis for health data

Session content is health data, which is special category data under UK GDPR. You need a lawful basis under article 6 and a condition under article 9. For therapy, the usual condition is article 9(2)(h), processing for health or social care purposes.

Article 9(2)(h) comes with a secrecy safeguard. Section 11(1) of the Data Protection Act 2018 explains when that safeguard is met. It covers processing by or under the responsibility of a health or social work professional. It also covers processing by any other person who owes a duty of confidentiality under an enactment or a rule of law. This second limb may be relevant to counsellors and psychotherapists who are not registered with a statutory regulator. If you are unsure which limb applies to you, take advice.

The point to remember is simple. The lawful basis belongs to you, as the controller. No supplier can choose it for you. Write it down, and make sure your privacy notice tells clients that you use an AI tool and why.

Check 2: a written processor contract (data processing agreement)

When an AI tool handles client data for you, the supplier is normally your processor. Article 28 UK GDPR requires a written contract between you and that processor. Suppliers often call it a data processing agreement, or DPA.

According to the ICO, the contract must set out the subject matter, duration, nature and purpose of the processing, the types of data and the categories of people concerned. It must also contain compulsory terms. The main ones are these.

• The processor acts only on your documented instructions, including for international transfers.
• People who handle the data are bound by confidentiality.
• The processor takes the security measures required by article 32.
• It needs your prior written authorisation to use sub-processors, and stays liable for them.
• It helps you respond to clients who exercise their rights, and helps with breaches and DPIAs.
• At the end of the contract, it deletes or returns the data, as you choose.
• It gives you the information needed to show compliance and allows audits.

Ask every provider for its DPA before you enter any client data. Read the list of sub-processors. If a provider cannot show you one, treat that as a warning sign.

Check 3: where data is hosted and accessed

Ask where the data is stored and where it is processed, including by the AI model. NHS England guidance puts the same question in plain words: where is data being accessed from, shared and stored?

The ICO explains that a transfer is not only sending data abroad. Making data accessible to a separate organisation outside the UK also counts. So a UK server may not settle the question if support staff or sub-processors abroad can reach the data.

Hosting outside the UK is not forbidden. Under paragraph 4 of Schedule 21 to the Data Protection Act 2018, a transfer to a destination listed in paragraph 5 is treated as approved by regulations under article 45A UK GDPR. Paragraph 5 lists, among others, the EEA states, Gibraltar, certain EU institutions and a number of other countries. The ICO guide on international transfers says that when adequacy regulations cover a transfer, data can flow without any extra safeguard. It adds that you should still check any organisation you share data with. Paragraph 4 also lets the government remove destinations by regulations, so this is worth checking again from time to time.

In practice, this means EEA hosting is not in itself a barrier, provided the contract and security are right. A transfer to a country without UK adequacy regulations needs extra safeguards, which is more work for you.

Check 4: what happens to the audio

Audio of a therapy session is some of the most sensitive data you will ever hold. Ask three questions. Is audio stored at all? If so, for how long and where? Who can access it?

NHS England guidance does not set a retention period. It asks organisations to decide how long each type of data is kept, naming the audio, the transcript and the final output separately. Apply the same logic in private practice. Decide in advance what you keep, and write it down. The less you keep, the less there is to protect, to disclose on request, or to lose.

Check 5: whether your data trains the model

Some AI providers improve their models with customer data. For therapy content, that is a serious question. Ask the provider directly whether session data, transcripts or notes are ever used to train or improve a model, and whether this is stated in the contract. A clear "never", in writing, is the answer you want. If the answer depends on a setting, find out which setting applies to you by default.

Check 6: MHRA status

On 29 July 2026, the MHRA published guidance on ambient voice technology. It sets out when a scribe tool is a medical device.

A product is outside the device rules when its intended purpose is administrative. The MHRA's examples include transcription, summarising an encounter for clinician review, formatting data into structured notes, clinical coding, and drafting letters. The key condition is that the product is not intended to give clinical suggestions or recommendations beyond what was discussed.

A product becomes a medical device in other cases.

• It generates insights that suggest diagnoses or treatments, even with a warning attached.
• It acts without validation by the clinician, for example by deciding on tests and placing orders.
• It is marketed with medical claims, such as guiding diagnosis and treatment planning or improving patient outcomes.

The MHRA adds that a general disclaimer, such as "not for diagnosis", is not enough if medical claims appear elsewhere, including on websites, in sales presentations or in adverts. So read the marketing, not only the terms. If a tool promises clinical insights, it may need to be regulated as a medical device. Our article on whether an AI scribe is a medical device covers this guidance in more depth.

What AI must not do in your notes

A note tool is there to write. It is not there to think in your place. The line is clear in both professional ethics and regulation.

The BACP Ethical Framework 2026 takes effect on 3 November 2026. Clause 2.1(e) asks members to assess the risk of any AI tool, digital tool or online platform before using it. Its sub-points ask members to:

• be competent to use the tool;
• understand how data are handled and stored, and any risks to confidentiality;
• be honest and transparent with people about their use of AI;
• have the informed consent of clients before inputting any of their personal data;
• not defer or outsource their decision-making to AI tools, and remain responsible for critically evaluating AI output.

In practice, this means AI must not decide, diagnose or replace your clinical judgement. It should not choose what goes in the final note. It should not frame a formulation you have not made. It should not write risk assessments you have not carried out yourself. If a draft contains a phrase you would not have written, delete it.

Read every draft as if a colleague had written it. Would you sign it as it stands? If you are not a BACP member, check what your own professional body's code says about AI and record keeping.

How Delta works

Delta is an AI assistant for mental health and allied health practitioners. Here is how it answers the six checks, so you can compare it with any other tool.

• How it works. During the session, Delta transcribes what is said, then prepares a session report that you review. You can also dictate observations right after the session, or add written notes. The report is added to the client's file, so the whole follow-up and its progress are in one place. Delta takes into account your profession and therapeutic approach, such as CBT, EMDR, psychodynamic, systemic or person-centred work. It also drafts assessment reports, letters and certificates.
• Lawful basis. This stays your responsibility as the controller, as with any tool.
• Processor contract. Ask Delta for its data processing agreement, as you would ask any provider, and read it before entering client data.
• Hosting, audio and training. Data is hosted in France with a host certified for health data (HDS, the French health data hosting certification). AI processing, transcription included, runs on servers located in France. The client's name and identifying details are pseudonymised before AI processing. No audio file is kept. Data is never used to train models. Data is encrypted in transit and at rest. France is an EEA state, and EEA states are listed in paragraph 5 of Schedule 21.
• Scope. Delta transcribes, summarises and drafts documents that you review and validate. Clinical judgement stays with you. You can compare this with the MHRA criteria above.

To learn more, read what Delta is, the security page and the pricing page, where plans are shown in euros. There is a 14-day free trial without a card. If you are comparing several tools, see our review of the best AI scribes for therapists in the UK.

Sources

• Data Protection Act 2018, section 11 (legislation.gov.uk)
• Data Protection Act 2018, Schedule 21, paragraph 4 (legislation.gov.uk)
• Data Protection Act 2018, Schedule 21, paragraph 5 (legislation.gov.uk)
• ICO, International transfers: a guide
• ICO, What needs to be included in the contract? (controllers and processors)
• MHRA, Ambient voice technology-enabled products (gov.uk, 29 July 2026)
• NHS England, Guidance on the use of AI-enabled ambient scribing products in health and care settings
• BACP, Ethical Framework for the Counselling Professions 2026 (PDF)