Aipedia: Counsellors and psychotherapists

AI notetakers and session transcription in therapy

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

Therapists can use AI notetakers, but BACP members need informed consent before any session content goes into the tool and must treat the transcript as part of the client record. A recording of therapy is among the most sensitive data a practice holds, so a leak or a wrong summary can quickly become a complaint or claim.

Part of: AI in counselling and psychotherapy

In short

AI notetakers record a session, transcribe it and produce a summary or draft note. Under the BACP Ethical Framework 2026, in force from 3 November 2026, you must assess the tool before use (2.1(e)), obtain the client's informed consent before their data goes in (2.1(e)(iv)), keep the session space private (2.1(b)) and keep records that are accurate, secure and include all information held (3.2). Transcripts stored in the cloud by a supplier raise confidentiality and data protection questions. PI usually responds to negligence claims about your notes, but data breach costs may need separate cover.

How therapists use AI notetakers

An AI notetaker listens to an online or in-person session, produces a transcript and then generates a summary, themes or a draft clinical note. Some are separate apps; others are features switched on inside video platforms or practice management software. The appeal is obvious: less time writing notes and more attention on the client during the session.

The concern is just as clear. A transcript captures far more than a therapist's note would: names of third parties, disclosures of abuse, details of self-harm, and things a client said in distress. UKCP's feature on AI and psychotherapy raises cloud transcription as a confidentiality risk, and BACP's Ethics essentials session warns against uploading identifying information to untested systems.

The duties that apply

Several existing duties apply to this work:

2.1(e)(i) to (iii) of the 2026 Framework: assess the tool before use, be competent with it, understand how data are handled and stored, and be open with the client about benefits and risks.
2.1(e)(iv): informed consent before any of the client's personal data is input. For a notetaker, that means before recording starts.
2.1(b): digital and remote spaces must be private and free from intrusion. A recording device or bot in the session is a change to that space.
3.1(c) and (d): the privacy notice must explain the tool and that it collects data.
3.2(a) to (c): records must be factual, adequate and relevant, stored securely, and include all communications and information held. If you keep the transcript, it is part of the record, and a client can ask for it.

Session content is special category health data under UK GDPR, so a lawful basis, a data processing agreement with the supplier and a retention rule are needed whatever the Framework says.

What can go wrong

Illustrative scenario: a counsellor uses a notetaker built into a video platform. The client agreed in general terms to "digital notes" at assessment. Months later the client requests their records and receives a full transcript, including a disclosure about a family member, plus an AI summary that describes them as "minimising alcohol use", a phrase they never used. They complain that they never agreed to recording and that the summary is inaccurate. The counsellor cannot show what the client was told, or where the supplier stored the audio.

Other risks include a supplier security incident exposing transcripts, transcripts being used to train a model, the tool mishearing an accent or a quiet voice, and a summary being copied into a report for a third party without checking.

How PI usually responds

A claim that an inaccurate note caused loss, or that a breach of confidence caused distress, is the kind of allegation therapist PI is usually designed to answer, subject to the policy terms. Points to check:

whether the wording covers breach of confidence and data protection claims, and any limit on them (see GDPR and data breach cover within PI);
whether incident response, notification and forensic costs after a supplier breach sit in PI or need a cyber policy;
whether regulatory fines are covered, which is often restricted;
any AI or technology clause, and whether you declared AI use at renewal.

BACP 4.2(a) requires PI and liability cover; it does not say what that cover must include for AI. Tell your insurer promptly about a complaint or a supplier breach notice, as late notification can affect cover.

Practical controls

Put these controls in place:

Choose a tool after a written risk assessment covering storage location, retention, training use, access and deletion.
Put a data processing agreement in place with the supplier.
Get specific, recorded consent before recording, and offer a no-recording option without penalty.
Delete audio once the note is finalised, unless you have a reason to keep it, and say so in the privacy notice.
Read and correct every AI summary before it enters the record.
Never paste AI summaries into reports without checking them against your own memory and notes.
Review whether the tool still meets your assessment when the supplier changes its terms.

Our consent and contracting guide has wording points for the working agreement, and the BACP 2026 Framework guide covers the duties in full.

How Apex helps

Apex arranges PI for counsellors and psychotherapists. A broker can check how your policy treats confidentiality and data claims arising from recorded sessions, and whether cyber cover is worth adding. See the AI in counselling hub for related guides, including preparing for supervision with AI.

Sources

Frequently asked

Can I record therapy sessions with an AI notetaker?

Yes, if you have assessed the tool, understand where the data goes, and have the client's informed consent before recording starts. Under BACP 2.1(e)(iv) consent must come before personal data is input. Offer clients the option to decline without it affecting their therapy.

Is the AI transcript part of the client record?

If you keep it, it is likely to be. BACP 3.2(c) says records include all communications, notes and other information held about clients, and data protection law gives clients a right of access. Some therapists may delete audio and raw transcripts once a checked note is written.

Will my insurance cover a data breach by the notetaker supplier?

A claim by the client for breach of confidence may fall under PI, subject to the wording. Your own response costs, such as notification and forensic work, are more often a cyber insurance matter. Check both policies and any data limits before relying on either.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.