The new BACP ethical framework: three decisions you’ll need to make this year

The framework requires members to assess the risk of any AI tool, digital tool or online platform before using them. You need to be able to demonstrate five specific things:

• competence to use the tool
• understanding of how data are handled and any risks to confidentiality
• honesty and transparency with clients about use of the tool
• informed consent from clients before inputting any of their personal data into AI or digital tools
• that decision-making has not been deferred or outsourced to AI.

The decision is not simply whether to use AI. The framework is now explicit that you need:

• documented informed consent from each client before any of their personal data goes into an AI tool, digital tool or online platform
• a real risk assessment. Where the data goes, who else processes it, and what the residual risks are
• an understanding clear enough to explain to a client
• responsibility for the output. You cannot defer therapeutic decision-making to the tool.

For therapists currently using AI transcription or note-taking tools, this is a meaningful shift. Ticking a checkbox in your software's terms is unlikely to demonstrate the informed consent the framework expects. Many therapists will need to revisit their client consent conversations and documentation.

For therapists not using AI, the question is whether to start. The practical test is whether you could explain and defend that decision clearly to a client, supervisor, insurer or regulator.

A practical note on consent. Asking a client whether you may record or process a session through an AI tool creates a relational dynamic that warrants careful thought, as I'm sure most training would have covered. Even when a client agrees, and many will out of wanting to be a good client, they may say yes when part of them would rather not. The framework's requirement to obtain and evidence informed consent means this is now a formal conversation, whether or not you were having it before.

This is not a reason never to use AI tools. It is a reason to be sure the time saved is worth the possible cost to the relationship, and to be sure your client's yes is a real yes.

The clinical will has been given stronger and more explicit weight in the new framework. It now sits under section 4.5, "Manage breaks, endings in ways that minimise the impact for clients and service users." That framing puts it as part of the broader work of managing endings well, not as a standalone administrative task.

The framework wording is: ensure we have a clinical will in place and have appointed an executor who, bound by confidentiality, can communicate with clients and service users if we are unable to contact them ourselves, or if we die.

Many therapists discover they need one only when a supervisor or peer raises it.

A working clinical will needs four things:

• a named executor who has agreed in writing
• a confidentiality agreement with that person
• secure access arrangements for your client list
• clear instructions for how clients should be contacted if you die or become incapacitated.

If you do not have one, this is the single most actionable item in the article. Templates and guidance exist. The work is usually a few hours.

If you do have one, the question is whether it is actually workable. Does your executor know where your client list is right now? Could they access it? Have you written what they should say to clients? These are the questions an audit would ask.

This is one of the items where "I'm not legally required to have one" is a particularly weak defence. The harm of dying without a clinical will is to your clients. They have no access to their records and are left not knowing why you suddenly stopped contacting them. That harm can be significant, and repeated across every active client on your list at the time.

The framework requires a clear and accessible privacy notice that outlines how personal data are collected, used, stored and protected. It also requires you to inform clients about foreseeable limits to confidentiality, including the use of digital storage systems, platforms or tools that may monitor or collect data.

This isn't strictly a professional body issue. UK GDPR has required clear privacy information since 2018. The new framework makes the link explicit for BACP members, which is helpful because many practitioners had not connected the two.

There is also a timely legal update here. The Data (Use and Access) Act 2025 introduced a requirement to maintain a data protection complaints process, which came into force on 19 June 2026.

For private practitioners, this does not need to be elaborate, but it does need to be clear. How a client can raise a data protection concern, how you will acknowledge it, how you will investigate it, and how you will communicate the outcome.

So the question is not only, "does it explain what happens to client data?" It is also, "does it tell clients what to do if they are concerned about how that data has been handled?"

The practical test is simple. Open your current privacy notice.

• Does it clearly explain the digital systems and tools involved in handling client data?
• Does it mention your practice management software, video platform, email provider, payment processor, and any AI tools you use?
• Does it explain where confidentiality may be limited by safeguarding, legal obligations, supervision, clinical will arrangements or digital processing?
• Does it tell clients how to raise a data protection concern or complaint?

If it relies on vague phrases like "industry-standard secure tools" or "trusted third-party providers", it may not be specific enough for either the new framework or the transparency expected under data protection law.

The practical decision is simple. Write a more specific privacy notice and complaints process yourself, adapt a strong template, or get one drafted. For most practitioners, adapting a good template is the most realistic starting point.