For UK counsellors and therapists · checked 27 August 2026

Can therapists use AI to write counselling notes? A UK guide

Yes, with conditions. No UK law bans counsellors or therapists from using AI to help write their notes. Two sets of rules apply instead. UK GDPR and the Data Protection Act 2018 apply to everyone, and they apply strictly here, because notes about a client are health data. And for BACP members, the Ethical Framework 2026, mandatory from November 2026, adds five conditions for any AI tool: you are competent to use it, you understand how it handles data, you are open with clients about it, you have their informed consent before any of their personal data goes in, and the decisions stay yours.

The short version

The question "am I allowed?" usually has three questions folded inside it. Is it legal? Does my professional body allow it? And do I have to tell my clients? This page takes them one at a time, with the sources linked so you can check the wording yourself.

The answers, in one breath: legal, yes, under the same data protection law that already governs your notes. Allowed, yes, and for BACP members the 2026 framework spells out what you need to be able to show. Tell your clients, yes: the law expects it in your privacy notice, and from November BACP expects informed consent before any client data goes into an AI tool.

About four fifths of this page is tool-neutral. It applies whether you use a dictation app, a dedicated notes tool, a general AI assistant or Joy. Joy's own answers sit in one marked section near the end. The rest is about you.

Is it legal in the UK?

Yes. There is no UK law that prohibits a therapist from using an AI tool to help write up notes, and there is no UK equivalent of the US state laws that regulate AI in therapy specifically. What applies is the law that already applies to your records: UK GDPR and the Data Protection Act 2018.

Three things follow from that. First, a note about a client is "data concerning health", which UK GDPR treats as special category data. The ICO's guidance is that you need both a lawful basis and an additional condition to process it. Most practitioners already have this in place for their notes; putting an AI tool in the chain does not change the category, it adds a processor.

Second, the roles. Under UK GDPR you are the data controller for your client records, because you decide why and how they are kept. A notes tool that processes them on your behalf is your processor, and the ICO's position is that a written contract needs to be in place whenever a controller uses a processor. In practice: the vendor should offer a data processing agreement you can read and keep. A vendor who does not have one has told you something.

Third, transparency. You must tell people what you do with their data and on what basis, and the ICO says this belongs in your privacy information. Consent is one lawful basis among several, and the ICO is explicit that no single basis is better than the others. That matters for the consent question below, because "the law" and "your professional body" do not ask for quite the same thing.

One more line worth drawing now: recording a session is different from dictating a summary afterwards. A recording captures the client's own words and voice. If you record, get your client's explicit consent first, whichever tool you use. Strictly, UK GDPR offers more than one legal route, but for something as sensitive as a recorded session, consent is the route ICO guidance points to, and from November the BACP framework asks for it outright.

This is general guidance, not legal advice for your practice. If you are unsure, the ICO's helpline is free, and your professional indemnity insurer will have a view too.

What BACP says: the five conditions

BACP has not published a standalone policy on AI tools. What it has done is write AI into the Ethical Framework for the Counselling Professions 2026, the full revision every member signs up to. The framework document says it takes effect from 1 November 2026; BACP's website says it becomes mandatory at midday on Tuesday 3 November 2026. Aim for October and the difference does not matter.

The relevant wording is clause 2.1(e). It asks members to assess the risk of any AI tool, digital tool or online platform before using it, and to be able to demonstrate five things. Here they are, with a few of the framework's own words for each and what it means in practice.

You are competent to use it

"are competent to use the tool or platform" (2.1(e)(i), PDF)

You know what goes in, what comes out, where it ends up, how to correct it and how to stop. A test run on yourself before a real client is the simplest evidence there is.
You understand how it handles data

"understand how data are handled and stored, and any risks to confidentiality" (2.1(e)(ii), PDF)

Where the data goes (a country, not "the cloud"), who else touches it, whether it is ever used to train AI, how long it is kept, how you delete it. These are questions for the vendor. For general-purpose AI assistants the same questions apply, and the answers are often the reason they are not suitable for identifiable client material.
You are open with clients about using it

"honest and transparent with people about our use of AI, digital tools or online platforms" (2.1(e)(iii), PDF)

A sentence you can say in a first session, and something written the client can read again: what the tool does, what it does not do, where their information is, and that they can say no.
You have their informed consent before any of their data goes in

"informed consent ... before inputting any of their personal data into AI or digital tools" (2.1(e)(iv), PDF)

"Before inputting" means before. Before a name, a session summary or a recording goes into any AI tool. In practice, the safest reading is a separate, explicit yes, recorded somewhere, given before the first time you use the tool for that client. For recorded sessions, a fresh yes each time recording starts. A client can decline and still work with you. More on how this sits with the law in the next section.
The decisions stay yours

"not deferred or outsourced our decision-making to AI tools" (2.1(e)(v), PDF)

A draft note is a draft. You read every AI output before it becomes part of a record, you change what is wrong, and the assessment is yours. The framework adds that you remain responsible for critically evaluating what the tool produces.

A myth worth retiring: there is no such thing as a "BACP-compliant" or "BACP-approved" AI tool. BACP does not run a scheme that approves, certifies or endorses products, and the framework sets requirements for you, the member, not for vendors. A tool can make those requirements easier or harder to meet. That is the only claim anyone can fairly make about one, including us.

The 2026 framework also asks members to be able to give a rationale for their ethical decisions, in a form that works in supervision. Put that next to the five conditions and the shape is clear: for each AI tool you use, be able to say what you checked, what you tell clients, how they consented and why you chose it. Our guide to the full 2026 framework walks through the dates, the other changes and a pre-November checklist.

Do I need to tell my clients?

Yes. But there are two layers, and it helps to keep them apart, because they ask for different things and people often blur them.

The law: UK GDPR

If you dictate or type your own summary after a session, you are keeping notes the way you always have, with the tool acting as your processor under UK GDPR. You would normally cover this by naming a secure third-party note-taking provider in your privacy notice.

If you record a session, you need your client's explicit consent first.

Either way, being open with clients about how you keep notes is good practice.

Your professional body: BACP, from November 2026

Clause 2.1(e)(iv) asks for informed consent before any of a client's personal data goes into an AI tool. A dictated summary with the client's name in it is personal data, so for BACP members this covers dictation as well as recording.

In everyday terms: a separate, explicit yes, before the first use, recorded somewhere. For recorded sessions, a fresh yes each time recording starts.

If you are already using an AI tool with existing clients, that conversation happens before November, not after.

So the privacy notice is the floor, set by law, for everyone. Informed consent to the tool is what BACP adds on top, for its members, from November. If you belong to another body, its wording may differ, and the next section covers the two we are asked about most. When in doubt, BACP's is the more careful of the two layers above, and nothing stops a UKCP or NCPS member from adopting it.

Our free 90-minute course on the 2026 framework, launching late September, ends with a consent wording and a client explanation you can adapt. You can join the waitlist here.

What UKCP and NCPS say

Not the same as BACP, and not the same as each other. As of 27 August 2026, we could not find AI written into either body's code of ethics the way BACP has.

UKCP UKCP has published a discussion piece on artificial intelligence and psychotherapy, written for it by a technology writer as part of the consultation on its next three-year strategy. It raises the confidentiality risks of cloud transcription, platforms that train on session material, and back-office AI tools used without much thought. It is a discussion piece, not a rule, and we could not find a formal UKCP position or code change on AI tools. UKCP's Code of Ethics and Professional Practice still applies to its members, and so does UK GDPR.
NCPS NCPS has published two opinion pieces on AI (September 2025 and an update the same month) by its head of public affairs and advocacy. The line most relevant to notes: clients should be informed about how their data is used and consent to such uses, especially where third-party platforms are involved, and should always know what is stored, for how long, and how to delete it. It also says plainly that AI supervision should not replace supervision. These are opinion pieces from NCPS rather than code requirements, and NCPS has not, as far as we can find, issued a rule specific to AI note-taking.
If you belong to more than one body Meet the strictest standard you are bound by. If BACP is one of them, its five conditions are the highest bar of the three, and they sit comfortably alongside what UKCP and NCPS have published so far. If it is not, nothing stops you adopting them anyway.

Before you use any AI tool for notes

The whole of the above, as a list. One afternoon once, then a few minutes per new client.

Ask the vendor where client data is stored, by country, who its sub-processors are, whether client data is ever used to train AI, how long recordings and transcripts are kept, and how you delete everything. Write the answers down with a date.
Get the data processing agreement and keep it on file. No DPA, no tool.
Add the tool to your privacy notice as a named provider of note-keeping, with the country the data lives in.
Add consent to the tool to your client agreement as a separate, explicit yes, and note each client's answer. For recorded sessions, say it out loud before recording starts, every time.
Try it on yourself first, then read every note before it is saved. If you could not write the note yourself, you are not ready to let a tool draft it.
Write five lines of rationale (what it does, what you checked, the risks and how you reduce them, what clients are told, when you will review it) and take them to supervision. The fuller pre-November checklist is here.

How Joy answers the five

This is the section about us. Everything above applies to any tool; here is how Joy measures up against the same five conditions, with the documents linked so you can check.

1. Competence The part of Joy this page is about is small enough to learn in one go: after a session you talk for a minute, Joy drafts the note, and you read it and approve it. Your first 20 sessions are free with no card, so there is room to try it on yourself before a real client. The help centre at help.joy.day covers the rest.
2. Data handling Session data is hosted in the EU, on Google Cloud in Sweden. Joy Solutions AB is a Swedish company working under GDPR and the UK Data Protection Act 2018. You are the data controller and Joy is your processor; the data processing agreement is public, with the sub-processor list in its appendix B. Your clients' data is never used to train AI. Never, on any plan. Not with consent, not de-identified, not at all.
3. Transparency with clients The sentence to say is short: "I use a tool called Joy to help me write up my notes. It is a Swedish company, your notes stay in the EU, nothing is used to train AI, and I read and approve every note myself." A fuller client explanation is part of our free course on the 2026 framework.
4. Consent before input Joy does not ask your clients for anything, so consent sits where it belongs: with you, in your client agreement. For video sessions held in Joy, there is no on-screen consent step for your client yet, so you ask for consent to record out loud at the start of the call, every time.
5. Decisions stay yours Nothing goes into a client record without you reading it first. Joy drafts, you author. It does not make clinical recommendations and does not assess risk. If a draft is wrong, you change it or discard it.

What we do not do yet

Joy does not show your client an on-screen notice when a video recording starts. Until it does, the spoken sentence is the consent step, and it is yours to say.
Joy does not keep a record of each client's consent for you. Keep it in your agreement, as you would for any other consent.
The consent wording and client sheet are not in the product yet. They come with the free course, and you can use them with any tool.

If Joy's policies say something different from this page, the page is wrong and we will fix it. Tell us at hello@joy.day. Weighing Joy against another tool? We keep a side-by-side with Upheal, including where they win.

A note from Charlotta

Hi, I'm Charlotta, one of Joy's co-founders. I have built healthcare technology for over a decade, on both sides of the table: as CEO of companies that deliver care themselves, and as the vendor behind the tools they run on.

We wrote this page because "can I use AI for my notes?" is a fair question with a real answer, and most of what is written about it is either a sales page or a scare. The answer is yes, with conditions, and the conditions are reasonable. They are also the questions I would want a therapist to ask of Joy, so we put our own answers next to them, including the things we have not built yet.

If you think we have read a clause wrong, or something here goes out of date, email me at charlotta@joy.day. It comes straight to me, and I read everything.

Charlotta

Co-founder, Joy

Quick answers

Can therapists use AI to write notes?

Yes, with conditions. No UK law bans it. UK GDPR and the Data Protection Act 2018 apply to the notes as special category health data, so you need a lawful basis and an additional condition, privacy information that tells clients how their data is handled, and a written contract with the vendor that processes it. For BACP members, the Ethical Framework 2026 adds five conditions for any AI tool from November 2026: competence, understanding how data are handled, transparency with clients, informed consent before any client data goes in, and keeping the decisions yours.

Is it legal for therapists to use AI for notes in the UK?

Yes. There is no UK law prohibiting it and no UK equivalent of the US state laws on AI in therapy. The law that applies is UK GDPR and the Data Protection Act 2018: notes about a client are special category health data, you remain the data controller, the tool is your processor, and the ICO expects a written contract between the two and clear privacy information for clients. Recording a session is where you should always get explicit consent first: more than one legal route exists on paper, but consent is the one professional guidance points to, and from November the BACP framework requires it.

Do I need to tell my clients I use AI for their notes?

Yes. Under UK GDPR, if you dictate or type your own summary after a session, you would normally cover a note-taking provider in your privacy notice; if you record a session, you need explicit consent first. For BACP members, clause 2.1(e)(iv) of the 2026 framework goes further and asks for informed consent before any of a client's personal data goes into an AI tool, dictated summaries included, as a separate, explicit yes before the first use.

What does BACP say about AI?

There is no standalone BACP AI policy. The Ethical Framework 2026, mandatory from November 2026, asks members in clause 2.1(e) to assess the risk of any AI tool before using it and to be able to show five things: competence, understanding of data handling, transparency with clients, informed consent before inputting client data, and that decision-making has not been handed to the tool. BACP does not approve or certify AI tools, so "BACP-compliant" describes something that does not exist.

Can AI replace therapists?

No. An AI notes tool drafts text from what you said; the relationship, the judgement and the responsibility stay with you, and the BACP framework's fifth condition exists to keep it that way.

Does the therapist see and edit the notes an AI tool writes?

They should, with any tool: reading and correcting every draft before it becomes part of the record is what the framework's "decisions stay yours" condition asks for. In Joy, nothing enters a client record until you have read it, and you can change or discard any draft.

Try it on your next session

Your first 20 sessions with Joy are free. No card, and no clock on them.

Try Joy for free

No credit card needed. Takes 30 seconds.

BACP member getting ready for November? Join the waitlist for our free 90-minute course on the 2026 framework.

Checked on 27 August 2026 against the Ethical Framework for the Counselling Professions 2026 (PDF), BACP's Preparing for the 2026 Ethical Framework page, UKCP's Artificial intelligence and psychotherapy, NCPS's AI in counselling and psychotherapy and September 2025 update, and the ICO's guidance on lawful basis, special category data and controller-processor contracts. Short quotations from the framework are reproduced for the purpose of explanation; the framework is © 2026 British Association for Counselling and Psychotherapy. This page is made by Joy Solutions AB and is not affiliated with, endorsed by or approved by BACP, UKCP, NCPS or the ICO. It is general guidance, not legal advice for your practice. Spotted something out of date? Tell us at hello@joy.day and we will fix it.