Clinical Safety ToolkitStaffordshire Training Hub

Type at least two letters.

    Home / AI policy

    Understand

    An AI policy is a short document that tells everyone in the practice which AI tools they can use, what for, and how a new one gets approved.

    Why have one

    AI tools are arriving faster than practices can assess them, some through software updates and others on a locum’s or new staff member’s phone. A policy means everyone works to the same rules, and it’s one of the first things CQC inspectors may ask to see.1

    A good policy answers three questions.

    Which AI tools are we allowed to use, and for what?

    What must never go into an AI tool?

    How does a new tool get approved?

    What counts as AI

    AI is built into everyday software as well as scribes and chatbots. Your policy should cover the whole range.

    1. AI scribesListen to the consultation and draft notes
    2. AI triage and online consultationSort requests or suggest urgency
    3. AI receptionistsAnswer calls or chats, book and signpost
    4. Results and document toolsFile results, summarise and code letters
    5. Recall toolsSearch the list to find who to invite
    6. Chatbots and CopilotChatGPT, Gemini, Copilot in email and Teams
    7. Call and meeting transcriptionIn Teams or your phone system
    8. Features added in updatesAI switched on in software you already use
    Your policy should cover all of these, not just the tools you bought on purpose.

    The AI you can’t see

    The biggest risk is often the tool nobody told you about: a free chatbot, or a feature that switched itself on.

    Your approved AI scribeYour online triage toolWhat you can seeWhat you may not know aboutFree chatbot on a personal phoneA locum’s own AI scribeAI added in a software updateBrowser AI add-ons
    An AI policy brings what's under the water into view. It says which tools are approved, and makes it clear that nothing else is used for practice work.

    At Oakfield Surgery: a locum used their own AI scribe app in clinic. Nobody knew where the recordings went. The policy now says only registered tools may be used, on page one of the locum pack.

    How it fits with the rest

    The policy sets the rules, the register lists what’s approved or live and what’s being assessed, and each tool has its own clinical safety and data protection assessment underneath. NHS England expects a DPIA before AI is used with patient information.2

    The AI policyThe rules: what staff can and can't do, and how a tool gets approved
    The AI tool registerThe list: which tools are approved, for what, and by whom
    Clinical safety assessmentCould it harm a patient?Data protection impact assessmentIs patient data safe and lawful?
    Training, monitoring and incident reportingKeeping it working once it's in use

    References

    1. GP mythbuster 109: Artificial intelligence in GP services. Care Quality Commission
    2. Information governance guidance: Artificial intelligence. NHS England

    Sources on this page last checked 6 November 2026.