Aipedia: Counsellors and psychotherapists

AI on online therapy platforms: duties and liability

Aipedia, by the Apex broking team · Last reviewed 2026-10-30

If you work through an online therapy platform that uses AI for matching, monitoring or analytics, you still have to assess it and tell clients about any data it collects. The platform's technology may sit outside your control, but complaints and claims about the therapy will usually still name you.

Part of: AI in counselling and psychotherapy

In short

Online therapy platforms use AI to match clients with therapists, scan messages for risk, analyse engagement and produce session insights. Under the BACP Ethical Framework 2026, members must assess the risk of any online platform before using it (2.1(e)), keep digital spaces private (2.1(b)) and tell clients about platforms or tools that monitor or collect data (3.1(d)). Whether you or the platform is the data controller affects who answers for a data breach. Platform terms often place clinical responsibility on the practitioner, so check your own PI covers platform work.

How platforms use AI

Therapists may see clients through platforms that handle marketing, booking, payment and video. Many add AI features: matching algorithms that assign clients based on questionnaire answers, risk scanning of messages, engagement analytics, automated check-ins, and summaries of sessions or homework. Some features are visible to the therapist; others run in the background.

The 2026 Framework puts online platforms alongside AI tools in clause 2.1(e), so signing up to a platform is a decision members must assess, not simply accept.

The duties that apply

These duties apply whether or not AI is involved:

2.1(e) of the BACP Ethical Framework 2026: assess the risk of any online platform before using it, understand how it handles and stores data, and be open with clients about its use.
2.1(b): physical, digital and remote meeting spaces must be private and free from intrusion. A platform that records or analyses sessions changes that space.
3.1(d): tell clients about "digital storage systems, platforms or tools that may monitor or collect data".
2.1(e)(v): do not defer clinical decisions, such as suitability or risk, to platform algorithms.
3.2(b): records must be stored securely, which requires knowing where the platform keeps them.

Data controller roles

Under UK GDPR, the controller decides why and how personal data is processed. On some platforms the platform is the controller for client data and the therapist is a contractor; on others the therapist is controller and the platform a processor; sometimes both are controllers for different purposes. The answer decides who must handle subject access requests, who notifies a breach, and who a client is likely to pursue. Read the platform's terms and privacy notice, and make sure your own privacy information is consistent with them. Data breach liability for professional firms explains the wider picture.

What can go wrong

Illustrative scenario: a counsellor works through a platform whose AI matching service assigns a client presenting with "work stress". In the second session it is clear the client has a trauma history outside the counsellor's competence. The counsellor continues for several weeks rather than referring on, partly because the platform discourages reassignment. The client complains that they were placed with an unsuitable practitioner and that their messages were being analysed without their knowledge. The platform points to its terms, which say clinical suitability is the practitioner's responsibility.

Platform versus practitioner liability

Platforms may limit their own liability and place clinical responsibility on the practitioner in their terms. Some platforms hold insurance for their own operations; that does not usually protect you. A claim about the therapy itself will usually be made against the therapist, and a data claim may be made against both. PI for therapists usually responds to professional services claims, subject to the terms, but check that your declared activities include platform work and online practice, as BACP 4.2(a) requires cover for all UK practice whether online, remote or in person. Data breach costs may need specific data cover within PI or a cyber policy.

Practical controls

Practical controls include:

Before joining, read the platform's terms on clinical responsibility, data roles, AI features and insurance.
Record your 2.1(e) assessment, including which AI features are active.
Check that clients are told about monitoring and analytics, and add your own explanation if the platform's is unclear.
Make your own suitability and risk judgements, and refer on when needed.
Keep your own copy of key records if the terms allow, so you can respond to a complaint.

How Apex helps

Apex arranges PI for counsellors and psychotherapists who work through platforms and in private practice. A broker can check your policy covers the platforms you use. Related: AI risk scoring, consent and contracting for AI, AI on telehealth platforms in occupational health and the counselling AI hub.

Sources

Frequently asked

Do I need to assess a therapy platform under the BACP Framework?

Yes. Clause 2.1(e) of the 2026 Framework applies to any AI tool, digital tool or online platform, so members should assess a platform before using it, including its AI features, data handling and storage, and be open with clients about it.

Who is responsible if the platform's AI matches a client badly?

Platform terms may place clinical responsibility on the practitioner. You remain responsible for assessing suitability and working within your competence, and for referring on if needed. A client complaint about the therapy is likely to focus on your decisions.

Do clients need to know the platform analyses their messages?

Yes. BACP 3.1(d) requires clients to be aware of and agree to the use of platforms or tools that may monitor or collect data. If the platform's own notice is unclear, explain it yourself at contracting and record the conversation in the client file.

Does my PI cover work done through an online platform?

Usually, if online practice and platform work are within the activities you declared and the policy territory. BACP 4.2(a) requires cover for all UK practice whether online, remote or in person. Confirm with your broker, as wordings and declarations differ.

Check your PI covers how you use AI

Tell us about your firm and the work you do. A broker will review how your current PI treats AI-assisted work, or arrange new cover. No fee for a quote. Or call 0117 325 0027.

Start a PI quote Request a callback

Apex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information about how AI is used in the profession and how insurance may respond. It is not legal, regulatory or insurance advice on your circumstances, and it does not guarantee that cover will be available or on what terms.