AI documentation in therapy: what European practitioners must know

AI documentation assistants can reduce the administrative burden in therapy — but before any European practitioner introduces one, there are legal, ethical, and clinical questions specific to mental health that demand careful answers. This article sets out what those questions are and how to address them.

I need to remove that em dash. Let me do the full revision properly.

AI documentation assistants can reduce the paperwork load in therapy, but before any European practitioner introduces one, there are legal, ethical, and clinical questions specific to mental health that demand careful answers. This article sets out what those questions are and how to address them.

Why therapy is a categorically different environment for AI documentation

Therapy sessions generate disclosures that patients may never have shared with anyone else. The content, including trauma histories, suicidal ideation, sexual identity, relationship violence, and psychotic experiences, isn't just clinically sensitive. In many cases it forms the very foundation of the therapeutic relationship. An AI documentation assistant that listens to, transcribes, and structures that content introduces a layer of data processing that has no equivalent in most other clinical settings.

Therapists are bound not only by data protection law but by the ethical codes of their professional associations, the confidentiality obligations intrinsic to their therapeutic modality, and, in many European jurisdictions, specific statutory protections for mental health records that go beyond general health data rules. A 2025 peer-reviewed narrative review in DIGITAL HEALTH found that AI tools in mental health frequently operate in legal grey areas around consent, data usage, and cross-border data flows, and that the General Data Protection Regulation (GDPR) offers only baseline protections that don't yet account for the unique ethical and clinical nuances of AI-based mental health interventions. That gap between the regulatory floor and the clinical reality is the central problem this article addresses.

How GDPR applies, and why legitimate interest is not available

Under GDPR compliance in healthcare, health data already qualifies as special category data under Article 9. Therapy session content goes further still. It may simultaneously engage multiple Article 9 categories: health data, sexual orientation or gender identity, religious or philosophical beliefs, and mental state. This has direct implications for which lawful basis a practitioner can rely on.

The default position under Article 9 is that processing special category data is prohibited unless one of a closed list of exceptions applies. For most therapy documentation, the relevant exception will be either explicit consent under Article 9(2)(a), or processing necessary for the provision of health care under Article 9(2)(h). Either basis must be combined with Article 9(3), which requires that processing is carried out by, or under the responsibility of, a professional bound by an obligation of professional secrecy. Legitimate interest is unavailable here: it applies only to ordinary personal data, not special category data. A 2025 arXiv review on privacy-preserving mental health AI notes that therapy sessions must be recorded only with explicit, informed patient consent, with clear details on anonymisation, secure storage, and data use.

Therapists who are self-employed or working in small private practices bear this compliance responsibility directly as the data controller. If the AI vendor processes data on the therapist's behalf, the vendor acts as a data processor, and the legal relationship between controller and processor must be set out in a written Data Processing Agreement before any data is shared.

Consent in therapy requires particular care

GDPR requires that consent be freely given, specific, informed, and unambiguous. In a therapeutic relationship, the "freely given" requirement deserves particular scrutiny. Patients in therapy are often psychologically vulnerable and emotionally dependent on their therapist, a power imbalance that doesn't exist in the same way in a routine general practitioner (GP) consultation.

A valid, GDPR-compliant consent process for AI documentation in therapy should cover, at minimum, the following ground. The patient needs a clear explanation of what the AI tool does, specifically that it listens to, transcribes, and structures session content. They should know the identity of the AI vendor and the country in which data is processed and stored, what data is retained and for how long, and who can access it. Critically, the consent document must include an explicit statement that consent to AI documentation is separate from consent to treatment, and that withholding or withdrawing that consent won't affect the quality of care provided. There must also be a mechanism for the patient to withdraw consent at any time, with a clear explanation of what happens to previously processed data upon withdrawal.

That last point carries particular weight in practice. If a patient withdraws consent and the vendor cannot demonstrate that their data has been deleted from training sets, logs, or processing infrastructure, the practitioner may face a compliance problem that is very difficult to resolve retrospectively.

What to ask your AI vendor before sharing any session data

For European therapists, data residency is a legal requirement, not a technical detail. Under GDPR, transferring personal data outside the European Economic Area (EEA) is restricted unless specific safeguards are in place, and because therapy session content is Article 9 special category data, the bar for demonstrating adequate protection in any transfer outside the EEA is correspondingly high.

Before selecting an AI documentation assistant, get clear written answers to the following from any vendor: where data is processed and stored (on-device, on EU/EEA servers, or in a third country); whether a compliant Data Processing Agreement is in place before any data is shared; whether the vendor holds ISO 27001 certification or an equivalent security standard and whether a Data Protection Impact Assessment has been conducted; and whether session data is used for model training, which is a separate processing purpose that requires its own lawful basis and, almost certainly, explicit consent.

Treat any vendor that is vague about data residency or reluctant to provide a written Data Processing Agreement as a significant compliance risk. A 2025 arXiv review on clinical mental health AI datasets notes that GDPR places strict limitations on the use and sharing of sensitive health information, limitations that complicate both the creation of representative datasets and the deployment of AI tools in psychotherapy contexts. A vendor that cannot answer these questions clearly is almost certainly not operating within those constraints.

Does the AI assistant's presence affect the therapeutic relationship?

Beyond the legal framework, there is a clinical concern that has no straightforward regulatory answer: does the presence of an AI documentation assistant, even one operating silently in the background, alter the therapeutic relationship? The therapeutic alliance is one of the most robust predictors of therapy outcomes across modalities. Some patients, on learning that their words are being transcribed and processed by an AI system, may self-censor. Others may find the knowledge reassuring if the practitioner presents it transparently.

A landmark JAMA Psychiatry study published in March 2026, the largest study to date on AI ambient scribes in psychiatric documentation, found that AI scribes increased the documentation of neuropsychiatric symptoms, but that visits where an AI scribe was used were significantly less likely to result in a documented psychiatric intervention, such as a referral, new diagnosis, or antidepressant prescription, compared with visits where no scribe was used (adjusted odds ratio 0.83; 95% confidence interval, 0.72 to 0.95). The study was conducted in primary care rather than specialist psychotherapy settings, and the authors note that further research is needed to determine whether these changes affect patient outcomes. It doesn't establish causation, and it represents the strongest available evidence that more documentation does not automatically translate into better clinical care.

Practitioners should evaluate, before deployment and on an ongoing basis, whether the tool's presence is affecting patient disclosure or the quality of the therapeutic encounter. That includes directly asking patients about their experience, and being willing to stop using the tool with specific patients where clinical judgement suggests it is getting in the way.

The clinician is responsible for every word in an AI-generated note

As one practitioner-facing legal explainer makes clear, clinicians bear full responsibility for the accuracy of AI-generated notes. An AI-generated draft saved to the medical record system without review becomes the clinician's document, carrying the same legal and professional weight as a note written entirely by hand.

In therapy, this review obligation is particularly consequential. Content that a therapist may appropriately hold in mind during a session isn't necessarily appropriate to record verbatim in a structured clinical note. That note may be accessible to other healthcare providers, subject to a subject access request, or subpoenaed in legal proceedings. Four categories require particular care:

• Safeguarding disclosures: content that may trigger mandatory reporting obligations should be documented with precision and in accordance with local safeguarding protocols, not left to an AI draft

• Third-party identifiers: names of individuals mentioned by the patient should generally not appear in structured clinical notes

• Sexual orientation, gender identity, immigration status, and similar information disclosed in session requires careful handling; its presence in an AI-generated note may not be appropriate or necessary

• Documentation of suicidal ideation, self-harm, or risk to others carries specific clinical and legal weight and should be written or reviewed with corresponding care

Research using natural language processing of psychotherapy notes for suicide risk prediction has shown that the language used in therapy notes is clinically informative, which is precisely why practitioners need to be deliberate about what goes into those notes in the first place.

National law goes further than GDPR, and so does EU device regulation

GDPR sets a floor, not a ceiling. In Germany, psychotherapists are subject to strict professional secrecy obligations (Schweigepflicht) under §203 of the Criminal Code, with criminal liability for breaches caused by inadequate data processing arrangements. France's Commission Nationale de l'Informatique et des Libertés (CNIL) has issued specific guidance on health data processing and holds regulatory oversight of AI systems that handle health data. In the Netherlands, mental health practitioners are subject to the Wet op de geneeskundige behandelingsovereenkomst (WGBO) and obligations under the BIG register alongside GDPR. In Ireland, the Data Protection Commission has been active in cross-border data transfer cases, and practitioners should also be aware of the Mental Health Act 2001. Italy's Garante per la protezione dei dati personali has taken enforcement action against AI companies handling health data, including temporary restrictions and significant fines.

The regulatory picture is further complicated by the EU AI Act and Medical Device Regulation (MDR). Under MDR 2017/745, software qualifies as a medical device if it is intended for a medical purpose, including diagnosis, monitoring, or treatment. The distinction matters in practice. A tool that only transcribes speech and structures clinical notes is generally not classified as a medical device, whereas a tool that analyses session content to flag suicide risk, suggest diagnoses, or support clinical decision-making is likely to require MDR classification and a conformity assessment, and may also be classified as high-risk AI under the EU AI Act. A 2025 peer-reviewed analysis in the European Heart Journal – Digital Health confirmed that high-risk AI medical devices are subject to dual regulation under both frameworks. An EU AI Act analysis published on PubMed Central notes a specific provision in Recital 29 that carves out AI systems used for lawful psychological treatment with explicit patient consent, but this carve-out applies only to prohibited AI practices such as emotion recognition, not to the general regulatory obligations on high-risk AI systems. Ask any vendor directly for the tool's regulatory classification under both the MDR and the EU AI Act before adopting it.

Pre-deployment checklist for mental health practitioners

The following represents a minimum standard of due diligence before introducing an AI documentation assistant into a therapy practice in Europe.

Vendor due diligence

• Confirm EU/EEA data residency for both processing and storage

• Obtain and review a signed Data Processing Agreement before any data is shared

• Verify ISO 27001 certification or equivalent security posture

• Confirm the tool's regulatory classification under the EU Medical Device Regulation and EU AI Act

• Clarify whether session data is used for model training and on what lawful basis

Consent and patient communication

• Develop a written consent process that is separate from general treatment consent

• Ensure the consent document explains what the tool does, who the vendor is, where data goes, and how long it is retained

• Confirm that patients can decline AI documentation without any effect on their care

• Establish a clear process for handling consent withdrawal, including data deletion requests

Note review workflow

Define which parts of session content the AI assistant is permitted to capture, and establish a mandatory review and editing step before any AI-generated note is saved to the medical record system. Identify in advance the categories of content that require particular care or manual documentation: safeguarding disclosures, third-party names, sensitive identity markers, and risk assessments. Document the review workflow in your practice's data protection policy.

Regulatory, professional, and ongoing obligations

• Verify national requirements with your data protection authority and professional regulatory body

• Conduct a Data Protection Impact Assessment — mandatory under GDPR Article 35 for large-scale processing of special category data, and strongly advisable even for smaller practices

• Notify your professional indemnity insurer and confirm that AI-assisted documentation is covered under your policy

• Regularly review whether the tool's presence is affecting therapeutic disclosure or session quality

• Stay informed about updates to the EU AI Act implementation timeline, Medical Device Regulation guidance, and national regulatory developments

Frequently asked questions

▶ Why does AI documentation in therapy raise different concerns than in other clinical settings?

Therapy content can simultaneously engage several Article 9 special category types in a single session, health data, sexual orientation, religious belief, mental state, in a way that almost no other clinical encounter does. That density of protected data categories means a single misconfigured AI tool can create multiple concurrent GDPR violations, not just one.

▶ What lawful basis can a therapist rely on when processing session content through an AI documentation assistant?

Legitimate interest is unavailable for special category data. The realistic options are explicit consent under Article 9(2)(a) or health care provision under Article 9(2)(h), both of which must be paired with Article 9(3). In practice, explicit consent is the safer choice because it gives the patient a clear, documented right to withdraw.

▶ What must a valid consent process for AI documentation in therapy include?

The hardest element to get right is withdrawal. Patients must be told exactly what happens to their data if they withdraw consent, and if the vendor cannot confirm deletion from training sets and processing logs, the practitioner is left with a compliance problem that is very difficult to fix after the fact.

▶ What questions should a therapist ask an AI vendor before sharing any session data?

Ask for the answers in writing before signing anything. A vendor that provides verbal reassurances about data residency or defers the Data Processing Agreement until after onboarding has already signalled that compliance is not a priority. That response alone is sufficient grounds to look elsewhere.

▶ Can the presence of an AI documentation assistant affect the therapeutic relationship?

The JAMA Psychiatry study published in March 2026 found that visits where an AI scribe was used were significantly less likely to result in a documented psychiatric intervention than unscribed visits (adjusted odds ratio 0.83, 95% confidence interval 0.72 to 0.95). The study was conducted in primary care, so direct extrapolation to specialist psychotherapy is not yet supported by evidence.

▶ Who is legally responsible for the accuracy of AI-generated therapy notes?

The clinician. Saving an unreviewed AI draft to the medical record system is the practical equivalent of signing a note you did not write. Professional indemnity insurers are increasingly asking whether AI-assisted documentation is part of a practice's workflow, so confirming coverage before deployment is a concrete step many practitioners overlook.

▶ What categories of session content require particular care when reviewing AI-generated notes?

Risk documentation is the category where errors carry the most immediate consequences. Research using natural language processing of psychotherapy notes for suicide risk prediction has shown that the language in those notes is clinically informative, which means imprecise or AI-generated phrasing in a risk assessment can affect downstream clinical decisions made by other practitioners who rely on the record.

▶ Does GDPR provide sufficient protection for mental health data processed by AI tools?

GDPR is a floor. The more immediate practical question for most European therapists is which national layer applies to them. Germany imposes criminal liability under §203 of the Criminal Code for breaches caused by inadequate data processing arrangements. Italy's Garante has issued temporary restrictions and significant fines against AI companies handling health data. Check with your national authority before deploying any tool.

▶ When does an AI documentation assistant become a medical device under EU law?

The dividing line is whether the tool interprets clinical content or generates clinical recommendations. Transcription and note structuring generally fall outside MDR 2017/745. Suicide risk flagging or diagnostic suggestions bring the tool inside it, triggering a conformity assessment and, where the EU AI Act also applies, dual regulation under both frameworks.

▶ Is a Data Protection Impact Assessment required before deploying an AI documentation assistant in a therapy practice?

Mandatory under GDPR Article 35 for large-scale processing of special category data, and advisable for smaller practices too. A completed Data Protection Impact Assessment also gives you documented evidence of due diligence if a regulator or insurer later asks what steps you took before deployment, which is a practical reason to do it even when it is not strictly required.