Aipedia: Counsellors and psychotherapists

Client consent and contracting for AI use in therapy

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

BACP members need informed consent before entering client data into any AI or digital tool, and the working agreement and privacy notice are where that consent is set up. From 3 November 2026, a missing or vague consent record is likely to be the first weak point in any complaint about AI use.

Part of: AI in counselling and psychotherapy

In short

The BACP Ethical Framework 2026 links AI to contracting. Members must give people a record of the working agreement (1.2(b)), be honest about AI use and its benefits and risks (2.1(e)(iii)), obtain informed consent before inputting personal data into AI or digital tools (2.1(e)(iv)), and use a privacy notice that covers tools that monitor or collect data (3.1(c) and (d)). Consent needs to be specific, recorded and revisited when tools change. Clients who refuse should be offered an alternative without detriment. Good records of consent also support a defence if a complaint or claim follows.

Why contracting is the starting point

The BACP Ethical Framework 2026 becomes mandatory on 3 November 2026. Its AI duties ask members to be able to demonstrate that they assessed tools, were transparent and had consent. The working agreement and privacy notice are the natural places to do that, because they are already written down and given to every client.

The duties that apply

These duties apply whether or not AI is involved:

1.2(a): honest, accurate information about your services.
1.2(b): give people a record of the working agreement.
2.1(e)(iii): be honest and transparent about your use of AI, digital tools or online platforms and the benefits and risks.
2.1(e)(iv): informed consent before inputting any personal data into AI or digital tools.
3.1(c): a clear, accessible privacy notice explaining how personal data are collected, used, stored and protected, and people's rights.
3.1(d): people must be aware of and agree to foreseeable limits to confidentiality, including the use of digital storage systems, platforms or tools that may monitor or collect data.

UK GDPR applies alongside the Framework. Consent under the Framework is a professional duty; it does not replace the need for a lawful basis for processing health data.

What to put in the working agreement

A working agreement that covers AI should set out:

Which AI tools or features you use, described in plain terms (for example "an AI notetaker that transcribes our online sessions").
What each does with the client's information, where it is stored and for how long.
The benefits to the client and the risks, including accuracy and data risks.
That you check all AI output and make all decisions yourself.
That the client can say no to any tool, and what happens instead.
That you will ask again before introducing a new tool.

Put the detail in the privacy notice and refer to it from the agreement. Separate consent for each tool is clearer than one general clause.

Handling a client who refuses

A client may decline AI use for any reason, including past experiences of surveillance or simple preference. Under 2.1(e)(iv) you need consent before inputting their data, so a refusal means not using the tool for that client. Offer a genuine alternative, such as handwritten or typed notes, and make sure it does not affect the quality of the service. Record the refusal. If a platform you work through cannot switch off a feature, you may need to discuss whether that platform is suitable for the client.

What can go wrong

Illustrative scenario: a counsellor's agreement says "I may use digital tools to support my practice." A year later, a client discovers their sessions were transcribed by AI and complains that "digital tools" did not tell them that. The counsellor cannot show any discussion. The complaint is upheld against the 2026 Framework, and the client also claims for distress. The counsellor's PI responds to the claim, subject to the terms, but the lack of consent evidence weakens the defence.

Keeping evidence of consent

These steps make consent easier to evidence later:

Use a signed or acknowledged working agreement and keep it in the client file.
Note in the session record when AI use was discussed and the client's decision.
Keep version-dated copies of your privacy notice.
Re-consent when a tool changes significantly or a new one is added.

These records also help with documenting AI use for insurers and with any notification of a circumstance.

How Apex helps

Apex arranges PI for counsellors and psychotherapists, and a broker can talk through how consent records support a claim. Related: the BACP 2026 Framework, AI notetakers, does PI cover AI and the counselling AI hub.

Sources

Frequently asked

Is one general clause on "digital tools" enough?

Probably not. BACP 2.1(e)(iv) requires informed consent, and 3.1(d) requires clients to be aware of tools that may monitor or collect data. Naming each type of tool and what it does, with a choice for each, is clearer and easier to evidence.

What if a client refuses AI use?

Then do not use the tool with their data. Offer a genuine alternative, such as manual notes, without affecting the service. Record the refusal. If a platform cannot switch a feature off, discuss whether the platform is suitable for that client.

Does consent under the Framework replace UK GDPR requirements?

No. Informed consent under BACP 2.1(e)(iv) is a professional duty. You still need a lawful basis and a condition for processing health data under UK GDPR, a privacy notice that meets 3.1(c), and suitable agreements with any supplier that processes data for you.

Do I need new consent when I change tools?

It is good practice to ask again when you add a tool or a tool changes significantly, because consent must be informed. Keep dated copies of your privacy notice and record each discussion in the client file.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.