Our approach
- Written for this toolkit. The explanations, diagrams, worked examples and templates are original. Oakfield Surgery is fictional.
- We link rather than copy. Where another organisation has published guidance, a template or a video, we link to the original and credit it. We don’t host copies of other organisations’ documents.
- Public sector information. Some national guidance from NHS England and GOV.UK is published under the Open Government Licence. We summarise and link to it with attribution.
- Facts from published reports. The real incidents are short summaries of facts reported in the sources listed, each linked on its card.
- No endorsements. Staffordshire Training Hub doesn’t endorse any supplier, product or provider. Products are named only where a published source names them.
If you think we’ve used your work without proper credit, please email niraj.samani@gpfirst.net and we’ll put it right.
National standards and guidance
| Source | Publisher |
|---|---|
| DCB0160: Clinical risk management in the deployment and use of health IT systems | NHS England |
| DCB0129: Clinical risk management in the manufacture of health IT systems | NHS England |
| Guidance on the use of AI-enabled ambient scribing products | NHS England |
| Template DPIA for AI-enabled ambient scribing products | NHS England |
| Learn from Patient Safety Events: primary care | NHS England |
| GP mythbuster 109: Artificial intelligence in GP services | Care Quality Commission |
| GP mythbuster: Learn from patient safety events | Care Quality Commission |
| Data protection impact assessments | Information Commissioner’s Office |
| Patient safety issues associated with EPR systems: a thematic review | HSSIB, November 2025 |
Information governance
| Source | Publisher |
|---|---|
| Consent and confidential patient information | NHS England |
| Contracts and liabilities between controllers and processors | Information Commissioner’s Office |
| Consultation on draft guidance about automated decision-making | Information Commissioner’s Office, March 2026 |
| Understanding the national data opt-out | NHS England |
| Records Management Code of Practice | NHS England |
| DSPT help: incident reporting | NHS England |
| The Caldicott Principles | National Data Guardian |
| Appointing a data protection officer | BMA |
| Data Security Awareness, Level 1 | e-Learning for Healthcare |
AI policy
| Source | Publisher |
|---|---|
| Information governance guidance: Artificial intelligence | NHS England |
| The 5 key questions we ask | Care Quality Commission |
| Yellow Card scheme | MHRA |
The example AI policy, tool register and staff card were written for this toolkit. You’re free to copy and adapt them.
Explainers
| Source | Publisher |
|---|---|
| Digital Technology Assessment Criteria (DTAC) | NHS England |
| Regulating medical devices in the UK | MHRA |
| Ambient voice technology-enabled products | MHRA, July 2026 |
| CAF-aligned DSPT: evolution of our assurance model | NHS England |
| Cyber Essentials overview | National Cyber Security Centre |
| IM1 pairing integration | NHS England |
| Ambient voice technology self-certified supplier registry | NHS England |
| Generative AI framework for HM Government | Cabinet Office |
Evidence and incidents
| Source | Used for |
|---|---|
| Digital health technology compliance with clinical safety standards in the NHS in England | JMIR, October 2025 |
| UK health service AI tool generated false diagnoses for one patient | Fortune, July 2025 |
| QRISK2 in TPP fixed but up to 270,000 patients affected | Digital Health, June 2016 |
| The Independent Breast Screening Review | December 2018 |
| How using Excel may have caused thousands of unreported COVID cases | Digital Health, October 2020 |
Training and further reading
| Source | Publisher |
|---|---|
| Clinical risk management training | NHS England |
| Clinical risk management e-learning | e-Learning for Healthcare |
| Bitesize digital training: understanding DCB0160 | Greater Manchester Primary Care Provider Board |
| AVT in general practice: a best practice toolkit | South West AVT collaboration |
| NHS AI and Digital Regulations Service | NHS |
Sources on this page last checked 3 November 2026.