AI note-taking for therapists in Ireland: data protection questions first
AI tools that write or summarise session notes are being marketed to therapists everywhere. Before you try one, it helps to know what Ireland's Data Protection Commission has said about AI and personal data, and what your obligations are when the data is a client's mental health history. This is a guide to the questions, not a product recommendation.
A note on this guide: it is general information for practitioners, not legal advice. Where a point depends on your professional body or your own circumstances, we say so rather than guess.
The starting point: your notes are special category data
Under Article 9 of the GDPR, processing health data is prohibited by default unless an exception applies, such as explicit consent for specified purposes or processing for the provision of health care by a person bound by professional secrecy. An AI tool does not change that rule. If you paste a session transcript or your own notes into a tool, you are processing special category data, and everything in your existing GDPR approach applies to the tool as well.
What the Data Protection Commission has said
In a blog post of 18 July 2024 on AI, large language models and data protection, the DPC makes several points that are directly useful to a practitioner. We summarise only what the post states:
- Impact assessments. Processing in this area "may require" a data protection impact assessment, particularly with new technology, combined datasets, or data about minors or vulnerable people, and the DPC suggests an assessment may be good practice even when it is not strictly required. Organisations using AI as a data controller should carry out a formal risk assessment.
- Transparency. Be clear with people about what processing happens and how they can exercise their rights, and understand where personal data goes when a third party is involved and whether it is retained or reused. Provider documentation should explain how data is handled in an understandable and accessible form.
- Accuracy. The DPC warns that AI products such as LLMs "can be prone to producing inaccurate or biased information", and that relying on outputs without critical human review carries risk.
The post is general guidance on AI and does not discuss therapists or health data in particular, so apply it as a framework rather than as a ruling on your practice.
Ten questions to ask any AI note tool
- Where does the audio, text or transcript go? Which company, which country, which sub-processors?
- Is it kept, and for how long? Can you delete it, and is deletion confirmed?
- Is client data used to train or improve the model? If the answer is not a clear no in writing, do not use it for real clients.
- Is there a data processing agreement that meets Article 28, covering instructions, confidentiality, security, sub-processors, assistance and deletion at the end?
- Does the vendor describe its security measures in terms you can assess against Article 32?
- What does the client know? A recording or transcript of a therapy session is a significant step for the client; they should be told clearly and be able to say no without consequences for their care.
- Who checks the output? A summary can omit or distort what was said. You remain responsible for the record.
- Do you need a DPIA? Given the DPC's comments on vulnerable people and new technology, writing one is a sensible discipline even if you conclude it is optional for a solo practice.
- What does your professional body say? Ask it directly; guidance on AI in clinical practice is developing and we do not want to state a position that may have changed.
- Can you work without it? Keep your normal note-taking process intact so that the tool is a convenience, not a dependency.
Related guide
Read this next: GDPR checklist for psychologists in Ireland
Safer ways to get the benefit
Much of the time saved by AI note tools comes from structure rather than from text generation. A consistent template for each session (presenting issue, interventions, risk, plan) cuts writing time, keeps notes comparable over months and is something you fully control. Our guide to what to include in session notes sets out a simple structure.
Whatever you choose, test with fictional data first. Write an invented client, run it through the tool, and read what comes out as if you were the client reading their own file.
Where Nerela stands
This article does not claim that Nerela offers AI-written notes, and it is not a comparison of AI scribe products. Nerela is a practice management system for scheduling, client records and session notes, with data hosted in the EU. If and when you assess any tool that touches client notes, the questions above are the ones to bring.
Sources
All pages below were consulted on 7 November 2026.
- Data Protection Commission: AI, large language models and data protection (18 July 2024)
- GDPR Article 9: processing of special categories of personal data
- GDPR Article 28: processor
- GDPR Article 32: security of processing
Frequently asked questions
Can I put client session notes into a general-purpose AI chatbot?+
We would not. A general-purpose chatbot is rarely set up with a processor contract, clear retention terms or a written commitment not to use inputs for training. Health data is special category data under Article 9 GDPR, so check each of those points in writing before any real client data goes anywhere.
Do I have to tell clients if I use an AI tool?+
The DPC's guidance stresses transparency about what processing happens and how people can exercise their rights. For something as personal as therapy, tell clients clearly and let them decline. Confirm the wording with your professional body.
Is a DPIA mandatory for AI note tools?+
The DPC says processing may require a DPIA, particularly with new technology or vulnerable people, and suggests one may be good practice even where not strictly required. Whether it is mandatory in your case is a question for your data protection adviser.
Are AI notes accurate enough to rely on?+
The DPC warns that AI products can produce inaccurate or biased information and that relying on outputs without human review creates risk. Treat any generated text as a draft that you check against what actually happened.
Keep your practice records in one secure place
Scheduling, client records and session notes in one place, hosted in the EU. Free for 14 days, no card.
14 days free, no card · No lock-in · We answer directly
Nerela is practice management software built for psychologists and clinics: scheduling and online booking, patient records and session notes, payment receipts and reports — in one place, with data hosted in the European Union. You start with 14 days free, no card, and you talk directly to the people building the product.
Start on Nerela — 14 days free →