Home » Insights » AI Session Notes in Psychology Practice: How to Document Compliantly

AI Session Notes in Psychology Practice: How to Document Compliantly

AI session notes on a laptop in a therapy office

AI-powered scribes and transcription tools are becoming common in psychology practice — and for good reason. They reduce administrative burden, free up cognitive space during sessions, and speed up the documentation process significantly. But AI session notes come with professional obligations that many practitioners have not yet fully considered. Under the updated HPCSA Booklet 20, published in November 2025, using any AI tool to generate or assist with session documentation places specific requirements on how you review, correct, store, and disclose that process (Health Professions Council of South Africa, 2025). You can read an overview of the full Booklet 20 framework in our guide to AI and digital ethics in psychology practice.

This post covers what those requirements mean in practice — specifically for the documentation workflow most psychologists are already using or considering.

Why AI session notes create a distinct compliance obligation

When you write a session note yourself, you are the author. When an AI tool generates or summarises a session note, you are the reviewer — and that distinction matters professionally. HPCSA Booklet 20 is explicit: practitioners remain professionally accountable for every clinical decision and every clinical record, regardless of what an AI tool has suggested, generated, or recommended (Health Professions Council of South Africa, 2025).

Consequently, an AI-generated note that you have not reviewed is not a compliant clinical record. Furthermore, an AI-generated note that you have reviewed but not corrected — where errors or misrepresentations remain — is also not a compliant clinical record. The note that enters your clinical file must reflect your professional judgement, not simply the output of an automated system.

Additionally, session notes processed through any AI tool involve the transmission and storage of special personal information under Section 26 of the Protection of Personal Information Act — a higher standard of data protection than applies to general records (Information Regulator of South Africa, 2020). This has direct implications for which tools you can use and how those tools must handle client data. For a full breakdown of how to evaluate your tools for POPIA compliance, see our guide on checking your AI tool for POPIA compliance.

What a compliant AI session note review process looks like

Booklet 20 does not prescribe a specific review workflow, but it does require that AI outputs be treated as preliminary inputs rather than final conclusions (Health Professions Council of South Africa, 2025). In practice, this means your review process needs to be substantive — not a quick scan before clicking save.

A compliant review should cover four things. First, factual accuracy: does the AI note correctly represent what the client said, what you observed, and what clinical decisions were made? Second, clinical completeness: has anything clinically significant been omitted, minimised, or framed in a way that does not reflect your professional assessment? Third, appropriate language: AI tools trained on general healthcare datasets may use clinical language that does not reflect the specific therapeutic approach or registration category context of your work. Fourth, the absence of hallucination: AI transcription and summarisation tools can generate plausible-sounding content that was never actually said. Any content you cannot verify against your own recollection of the session must be removed.

Specifically, the reviewed and corrected note — not the raw AI output — is what should enter the clinical record. If your practice management software auto-saves the AI draft at any point before your review is complete, this presents a compliance risk that you need to address with your software provider.

Informed consent before using AI session notes

Before using any AI transcription or summarisation tool in a client’s care, you must obtain informed consent. This is a requirement under both HPCSA Booklet 20 and the APA’s 2025 ethical guidance for AI in psychology (American Psychological Association, 2025). Crucially, informed consent in this context means more than a general reference to digital record-keeping in your intake form.

Your consent process must explain what the AI tool does — specifically that it records, transcribes, or summarises session content. It must explain what data is collected, where that data is stored, and whether it is processed outside South Africa. It must also explain what the client’s right to decline looks like in practice. Clients who decline the use of AI documentation tools may not be disadvantaged or refused access to your services as a result of that refusal (Health Professions Council of South Africa, 2025).

Therefore, your intake documentation needs a dedicated AI disclosure clause — not a general digital consent — and you need a non-AI documentation pathway ready for clients who opt out. For more on what a compliant non-AI pathway requires, see our article on what to do when a client declines an AI tool.

Storage, access, and cross-border data transfer

One of the most commonly overlooked compliance risks in AI session documentation is where the data goes after a session ends. Most AI transcription and summarisation tools are cloud-based, which means audio recordings, transcripts, and summaries may be transmitted to and stored on servers outside South Africa.

Under Section 72 of POPIA, cross-border transfers of personal information — including psychological session content — are restricted. The receiving party must be subject to law, binding corporate rules, or a binding agreement providing adequate protection substantially similar to POPIA (Information Regulator of South Africa, 2020). This means you cannot simply assume a popular international tool is compliant. You need to check the platform’s data residency policy and, where data leaves South Africa’s borders, verify that appropriate cross-border transfer protections are in place.

Furthermore, you must have a data processing agreement in place with any third-party platform that processes client session data on your behalf. If the platform does not offer one, it is not suitable for use with client records under South African law.

What to do if you are already using an AI scribe

If you are currently using an AI transcription or summarisation tool and have not yet conducted a formal compliance review, the steps are straightforward. First, identify which tool you are using and locate its privacy policy and data processing agreement. Second, verify where session data is stored and whether any cross-border transfers occur. Third, review your existing informed consent documentation to confirm it discloses the specific use of AI in session recording and summarisation. Fourth, establish a documented review process for AI-generated notes before they enter the clinical record.

If you supervise other practitioners, these obligations extend to your supervision responsibilities. You are accountable for ensuring that supervised practitioners understand and apply the same documentation standards (Health Professions Council of South Africa, 2025).

Meeting your ethics CEU requirements is one of the most practical ways to build working knowledge of these standards. Explore the PsyCampus 2026 CPD packages — HPCSA-accredited and designed around current practice obligations — or check whether you qualify for a recent graduate discount of up to 40%.

References

Scroll to Top